Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Evidence”
158 publicationsTreat a cloud model retirement as a security change
Bedrock and Agent Platform fail closed on a model's retirement date, while Foundry can swap a different model in behind the same deployment name. Read the three calendars, compare the replacement's controls and decide per deployment.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskRespond to an exposed AWS access key beyond the quarantine policy
In a published test, AWS attached its quarantine policy 10 seconds after a key leaked, but the policy denies actions without ending access. This playbook covers what it leaves open, which credentials outlive the key, and the order of containment.
Detection & response · Amazon Web Services / GitHub / Google Cloud · By Cloud Security DeskAdmit MCP servers before agents can call their tools
An MCP server's tool descriptions can change after approval with no new release. Record provenance and execution context, hash the definitions per authorization context, enforce the pin at a gateway or allowlist, and watch for drift.
AI systems · MCP / AWS / Anthropic / GitHub / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskRoll out Entra token protection without breaking unsupported clients
Token protection makes Entra ID refuse token requests that a device-bound session does not back. Scope it to supported apps and platforms, triage report-only data by code and platform, and cover what stays unbound.
Identity & access · Microsoft Entra / Microsoft Intune / Microsoft Graph · By Cloud Security DeskPlan for incident reporting clocks that start at different moments
GDPR, NIS2, DORA, the SEC, the US banking agencies and CERT-In each start their reporting clock at a different decision. Plan around those triggers, the evidence each first notice needs and the rules still pending.
Detection & response · European Union / U.S. Securities and Exchange Commission / U.S. federal banking agencies / CISA / CERT-In / UK Parliament / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskInvestigate a SaaS integration breach through its OAuth tokens
A vendor that stores OAuth tokens for your SaaS tenants has been breached. Confirm from your own logs what the tokens did, revoke them on every platform, and search the exposed records for secrets.
Detection & response · Salesforce / Google Workspace / Microsoft Entra ID · By Cloud Security DeskInvestigate stolen cloud credentials used to run AI models
When stolen keys run foundation models in your account, the evidence is split between CloudTrail, usage logs that may never have been enabled and a bill that lags by a day or more.
Detection & response · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskFind the Kubernetes RBAC permissions that lead to cluster admin
Group RBAC grants by what they yield, not by verb. Then close the nodes/proxy exec path with v1.36 fine-grained kubelet permissions, narrow impersonation, and prove each removal with a negative test.
Identity & access · Kubernetes / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskFind the AWS global control planes in your recovery path
Thirteen AWS control planes run in us-east-1 or us-west-2, and ordinary calls from other Regions still reach them. Audit runbooks, SDK settings and the last exercise, then swap each dependency for a data-plane operation.
Resilience · Amazon Web Services · By Cloud Security DeskFind the Entra changes that Backup and Recovery cannot roll back
Microsoft Entra Backup and Recovery rolls listed properties back to a daily backup kept for seven days. Credentials, role assignments, owners and user consent stay in place, and an unscoped recovery can undo your own containment.
Resilience · Microsoft Entra / Microsoft Graph · By Cloud Security DeskVerify EC2 containment beyond a security group change
Swapping a compromised EC2 instance into an isolation security group stops new connections, not tracked ones. Learn which flows survive, how long idle timeouts let them run, and how to prove the cut happened.
Detection & response · Amazon Web Services · By Cloud Security DeskUse DNS egress filtering without mistaking it for a firewall
Resolver-layer filters in AWS, Azure and Google Cloud decide which names a workload can resolve, not where it connects. What each provider says its DNS control misses, and the connection control to pair with it.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskValidate the judge before trusting automated AI evaluations
Managed agent evaluators score your traces with a second model. Measure that judge against your own reviewers with chance-corrected agreement, probe its biases, and pin the judge model before its pass rate gates a release.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskCompare just-in-time privileged access in AWS, Azure and Google Cloud
Entra PIM and Google Cloud PAM make roles temporary natively, while AWS relies on TEAM or partner tools. All three end elevation by removing an assignment, and sessions, caches and minted tokens can keep running.
Identity & access · Amazon Web Services / Microsoft Azure / Microsoft Entra / Google Cloud · By Cloud Security DeskPlan Azure disaster recovery for a region without a pair
Thirteen Azure regions have no pair and eight more pair with a restricted-access region. This guide shows which built-in geo-redundancy disappears, what replaces it service by service, and how to choose the recovery region.
Resilience · Microsoft Azure · By Cloud Security DeskRestore EBS volumes at the speed your recovery plan assumes
A restored EBS volume is slow until every block arrives from S3. Price the provisioned initialization rate, fast snapshot restore credits and Regional limits as recovery-time arithmetic before an RTO depends on them.
Resilience · Amazon Web Services · By Cloud Security DeskPlan the move from ingress-nginx to Gateway API
Ingress-nginx is archived and will not be patched again. Contain the old controller, inventory the behaviors your clients depend on, and cut over to Gateway API with evidence and a rollback path.
Workload security · Kubernetes / Google Cloud / AWS / Azure · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskDesign AI agents that contain indirect prompt injection
Filters lower the odds that an agent obeys injected text. Architecture decides what an obeying agent can reach. Compare six published patterns and CaMeL by what each removes, what it costs and what it still misses.
AI systems · Google DeepMind / AgentDojo / NIST / OWASP / Microsoft · By Cloud Security DeskMap cloud incident response to NIST SP 800-61 Revision 3
Revision 3 turned NIST's incident handling guide into a CSF 2.0 profile. Translate its rows into provider contracts, cloud evidence, containment authority and recovery ownership, and fix the log defaults first.
Detection & response · NIST / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskStop S3 ransomware that encrypts objects with customer-provided keys
SSE-C ransomware rewrites S3 objects under a key only the attacker holds. AWS now blocks SSE-C by default on most buckets; this guide covers what that default misses and the controls that close the gap.
Detection & response · Amazon Web Services · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskKnow where cloud AI services process your prompts
Bedrock inference profiles, Foundry deployment types and Agent Platform endpoints each decide where a prompt is processed, separately from where data rests. Compare what each provider commits to and how to enforce it.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security Desk