Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “NIST”
129 publicationsStop pull_request_target workflows from running fork code
GitHub blocks pull_request_target in public repositories by default from November 2, 2026. Find the workflows that run fork code with secrets, split them, pin a checkout that refuses unsafe refs, and allow the rest deliberately.
Workload security · GitHub · By Cloud Security DeskRun AI coding agents in GitHub Actions without exposing secrets
Treat the agent job as an untrusted-input processor. Follow the outside text from the trigger that admits it to the credentials it can reach, then split reading from writing so a successful injection reaches nothing worth stealing.
AI systems · GitHub / Anthropic / Google / Microsoft · By Cloud Security DeskRespond to an exposed AWS access key beyond the quarantine policy
In a published test, AWS attached its quarantine policy 10 seconds after a key leaked, but the policy denies actions without ending access. This playbook covers what it leaves open, which credentials outlive the key, and the order of containment.
Detection & response · Amazon Web Services / GitHub / Google Cloud · By Cloud Security DeskAdmit MCP servers before agents can call their tools
An MCP server's tool descriptions can change after approval with no new release. Record provenance and execution context, hash the definitions per authorization context, enforce the pin at a gateway or allowlist, and watch for drift.
AI systems · MCP / AWS / Anthropic / GitHub / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskRoll out Entra token protection without breaking unsupported clients
Token protection makes Entra ID refuse token requests that a device-bound session does not back. Scope it to supported apps and platforms, triage report-only data by code and platform, and cover what stays unbound.
Identity & access · Microsoft Entra / Microsoft Intune / Microsoft Graph · By Cloud Security DeskPlan for incident reporting clocks that start at different moments
GDPR, NIS2, DORA, the SEC, the US banking agencies and CERT-In each start their reporting clock at a different decision. Plan around those triggers, the evidence each first notice needs and the rules still pending.
Detection & response · European Union / U.S. Securities and Exchange Commission / U.S. federal banking agencies / CISA / CERT-In / UK Parliament / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskInvestigate a SaaS integration breach through its OAuth tokens
A vendor that stores OAuth tokens for your SaaS tenants has been breached. Confirm from your own logs what the tokens did, revoke them on every platform, and search the exposed records for secrets.
Detection & response · Salesforce / Google Workspace / Microsoft Entra ID · By Cloud Security DeskInvestigate stolen cloud credentials used to run AI models
When stolen keys run foundation models in your account, the evidence is split between CloudTrail, usage logs that may never have been enabled and a bill that lags by a day or more.
Detection & response · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskTier Entra administrator roles by the control they can take
Microsoft's own password reset and sensitive action tables show which Entra roles can take over which accounts. Use them, plus the non-role paths, to set three tiers, assignment rules and the controls that keep lower tiers out.
Identity & access · Microsoft Entra / Microsoft Graph · By Cloud Security DeskFind the Kubernetes RBAC permissions that lead to cluster admin
Group RBAC grants by what they yield, not by verb. Then close the nodes/proxy exec path with v1.36 fine-grained kubelet permissions, narrow impersonation, and prove each removal with a negative test.
Identity & access · Kubernetes / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskKnow what service mesh mTLS proves about the caller
A mesh handshake proves that a peer held a key for a namespace and service account. It says nothing about the user or the operation, and permissive defaults, probes and waypoints open paths around it.
Workload security · Istio / Linkerd / Kubernetes / Google Cloud / Microsoft Azure / Amazon Web Services · By Cloud Security DeskFind the AWS global control planes in your recovery path
Thirteen AWS control planes run in us-east-1 or us-west-2, and ordinary calls from other Regions still reach them. Audit runbooks, SDK settings and the last exercise, then swap each dependency for a data-plane operation.
Resilience · Amazon Web Services · By Cloud Security DeskLock down self-hosted model servers before exposing them
Built-in credentials in vLLM, SGLang and Triton cover less than their names suggest, Ollama's local API has none, and vLLM and SGLang leave their internal planes unauthenticated. Here is what stays open and what must sit in front.
AI systems · vLLM / SGLang / Ollama / NVIDIA Triton Inference Server / Kubernetes / nginx · By Cloud Security DeskFind the Entra changes that Backup and Recovery cannot roll back
Microsoft Entra Backup and Recovery rolls listed properties back to a daily backup kept for seven days. Credentials, role assignments, owners and user consent stay in place, and an unscoped recovery can undo your own containment.
Resilience · Microsoft Entra / Microsoft Graph · By Cloud Security DeskVerify EC2 containment beyond a security group change
Swapping a compromised EC2 instance into an isolation security group stops new connections, not tracked ones. Learn which flows survive, how long idle timeouts let them run, and how to prove the cut happened.
Detection & response · Amazon Web Services · By Cloud Security DeskValidate the judge before trusting automated AI evaluations
Managed agent evaluators score your traces with a second model. Measure that judge against your own reviewers with chance-corrected agreement, probe its biases, and pin the judge model before its pass rate gates a release.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskCompare just-in-time privileged access in AWS, Azure and Google Cloud
Entra PIM and Google Cloud PAM make roles temporary natively, while AWS relies on TEAM or partner tools. All three end elevation by removing an assignment, and sessions, caches and minted tokens can keep running.
Identity & access · Amazon Web Services / Microsoft Azure / Microsoft Entra / Google Cloud · By Cloud Security DeskPlan Azure disaster recovery for a region without a pair
Thirteen Azure regions have no pair and eight more pair with a restricted-access region. This guide shows which built-in geo-redundancy disappears, what replaces it service by service, and how to choose the recovery region.
Resilience · Microsoft Azure · By Cloud Security DeskSeparate API gateway JWT checks from backend authorization
A gateway that accepts a JWT has checked its signature, issuer, audience and time window. It has not checked token type, revocation, cached decisions or object ownership. This mapping shows which side owns each decision.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskTest PostgreSQL row-level security with the application role
Row-level security only filters queries from roles that do not bypass it. Test with the production login role, through the production pooler, with transaction-local tenant context and a patched minor release.
Workload security · PostgreSQL / PgBouncer / Amazon Web Services / Microsoft Azure / Google Cloud / Supabase · By Cloud Security DeskRestore EBS volumes at the speed your recovery plan assumes
A restored EBS volume is slow until every block arrives from S3. Price the provisioned initialization rate, fast snapshot restore credits and Regional limits as recovery-time arithmetic before an RTO depends on them.
Resilience · Amazon Web Services · By Cloud Security DeskRoll over a SAML signing certificate without an SSO outage
Replacing an identity provider's SAML signing key is a separate contract with every service provider. Classify each one by how it learns keys, overlap where it can hold two and finish by removing the old key everywhere.
Identity & access · Microsoft Entra / Okta / Google Workspace / Amazon Web Services · By Cloud Security DeskPlan the move from ingress-nginx to Gateway API
Ingress-nginx is archived and will not be patched again. Contain the old controller, inventory the behaviors your clients depend on, and cut over to Gateway API with evidence and a rollback path.
Workload security · Kubernetes / Google Cloud / AWS / Azure · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security Desk