Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “RPO”
36 publicationsPasskey deployment needs a recovery design
A workforce passkey rollout needs a recovery contract before broad enforcement. Separate credential custody, enrollment evidence and application sessions.
Identity & access · NIST / FIDO Alliance / Microsoft Entra · By Cloud Security DeskA defensible cloud patch queue starts with exploitation evidence
Join exploitation evidence to affected assets, exposure, ownership and verified remediation without turning CVSS, EPSS or a catalog entry into a complete risk score.
Detection & response · CISA / NIST / FIRST · By Cloud Security DeskChoosing isolation for a Kubernetes tenant
A namespace, a virtual control plane and a sandboxed runtime protect different boundaries. Start with tenant authority before choosing the cluster architecture.
Workload security · Kubernetes / gVisor / Kata Containers · By Cloud Security DeskSecurity evidence for AI release decisions
A release approval should identify the changed application, the claims its tests support and the evidence that expires when a model, prompt, data path or runtime changes.
AI systems · By Cloud Security DeskRecovery objectives that match the cloud service
Define the business function, outage clock, recoverable data and dependency assumptions before choosing a cloud disaster-recovery architecture.
Resilience · AWS / Azure / Google Cloud / NIST · By Cloud Security DeskEntra emergency access that survives normal sign-in failure
A second administrator account does not prove an independent recovery path. Test the credential, workstation, policy and alert dependencies together.
Identity & access · Microsoft Entra · By Cloud Security DeskWhat cloud snapshots cannot preserve
Separate live execution, persisted disk and provider records before an authorized containment decision destroys evidence that a snapshot cannot recover.
Detection & response · AWS / NIST · By Cloud Security DeskA controlled return from the SQS dead letter queue
Repair the failure, check consumer compatibility and return failed work with a bounded rate, observable stop conditions and business reconciliation.
Resilience · AWS · By Cloud Security DeskRotate Entra application certificates with proof of adoption
A renewed certificate can exist in Key Vault while a running client still uses the old key. Define the evidence that makes application rotation complete.
Identity & access · Microsoft Entra / Azure Key Vault · By Cloud Security DeskDesign an outbound fetch service that contains SSRF
A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.
Workload security · OWASP / IANA · By Cloud Security DeskShort SSH certificates still need explicit access boundaries
An SSH certificate supplies bounded identity claims. The issuer, server, client and incident operator still make separate access decisions.
Identity & access · OpenSSH · By Cloud Security DeskCloud incident severity needs a service impact model
Connect incident priority to service consequences, scope and time criticality while preserving evidence confidence and the authority to revise the decision.
Detection & response · NIST / FIRST · By Cloud Security DeskCertificate renewal under shorter validity limits
Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.
Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security DeskMeasure SCIM offboarding at the application
A successful provisioning update proves a directory action, not the end of every application session. Define and test the application's offboarding contract.
Identity & access · SCIM / Microsoft Entra · By Cloud Security DeskThe telemetry collector is part of the evidence boundary
Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.
Detection & response · OpenTelemetry · By Cloud Security DeskCloud detection coverage after the ATT&CK data model change
Connect current ATT&CK strategies and analytics to available events, implemented rules and test evidence, while keeping taxonomy counts separate from protection.
Detection & response · MITRE · By Cloud Security DeskKnow when AWS KMS encryption needs an envelope
KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.
Workload security · AWS · By Cloud Security DeskModel output needs its own trust boundary
A model can produce valid JSON containing an unauthorized identifier, an unsafe link or text that a renderer interprets as code. The application consuming that output owns the next trust decision.
AI systems · OpenAI · By Cloud Security DeskWhere DNS failover loses control of the clock
Separate authoritative routing, resolver caches, stale answers, runtime caching and existing connections when describing what DNS failover can achieve.
Resilience · AWS / Cloudflare / Oracle · By Cloud Security DeskKeep database changes compatible with application rollback
Preserve an explicit relationship between old code and migrated state through additive changes, safe backfills, and a defined rollback window.
Resilience · Kubernetes / GitLab · By Cloud Security DeskMap every connection beyond the private AI endpoint
Trace inference, retrieval, tools, administration, and telemetry separately before describing an AI application as private.
AI systems · AWS · By Cloud Security DeskTrace Google service account impersonation across every hop
A short-lived token can carry a broad identity. Review who can mint it, which account it represents and whether the original caller remains visible.
Identity & access · Google Cloud · By Cloud Security DeskKeep sensitive prompts out of routine telemetry
Collect diagnostic metadata for a defined purpose and treat prompts, retrieved documents, tool arguments, and responses as a separate content-capture decision.
AI systems · AWS · By Cloud Security DeskPlace AWS guardrails on the principal and the resource
SCPs and RCPs constrain different sides of a request. A useful review records both the applicable guardrails and the policies that actually grant access.
Identity & access · AWS · By Cloud Security Desk