Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “RPO”
116 publicationsStop pull_request_target workflows from running fork code
GitHub blocks pull_request_target in public repositories by default from November 2, 2026. Find the workflows that run fork code with secrets, split them, pin a checkout that refuses unsafe refs, and allow the rest deliberately.
Workload security · GitHub · By Cloud Security DeskRun AI coding agents in GitHub Actions without exposing secrets
Treat the agent job as an untrusted-input processor. Follow the outside text from the trigger that admits it to the credentials it can reach, then split reading from writing so a successful injection reaches nothing worth stealing.
AI systems · GitHub / Anthropic / Google / Microsoft · By Cloud Security DeskTreat a cloud model retirement as a security change
Bedrock and Agent Platform fail closed on a model's retirement date, while Foundry can swap a different model in behind the same deployment name. Read the three calendars, compare the replacement's controls and decide per deployment.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskRespond to an exposed AWS access key beyond the quarantine policy
In a published test, AWS attached its quarantine policy 10 seconds after a key leaked, but the policy denies actions without ending access. This playbook covers what it leaves open, which credentials outlive the key, and the order of containment.
Detection & response · Amazon Web Services / GitHub / Google Cloud · By Cloud Security DeskRoll out Entra token protection without breaking unsupported clients
Token protection makes Entra ID refuse token requests that a device-bound session does not back. Scope it to supported apps and platforms, triage report-only data by code and platform, and cover what stays unbound.
Identity & access · Microsoft Entra / Microsoft Intune / Microsoft Graph · By Cloud Security DeskPlan for incident reporting clocks that start at different moments
GDPR, NIS2, DORA, the SEC, the US banking agencies and CERT-In each start their reporting clock at a different decision. Plan around those triggers, the evidence each first notice needs and the rules still pending.
Detection & response · European Union / U.S. Securities and Exchange Commission / U.S. federal banking agencies / CISA / CERT-In / UK Parliament / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskFind the Kubernetes RBAC permissions that lead to cluster admin
Group RBAC grants by what they yield, not by verb. Then close the nodes/proxy exec path with v1.36 fine-grained kubelet permissions, narrow impersonation, and prove each removal with a negative test.
Identity & access · Kubernetes / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskLock down self-hosted model servers before exposing them
Built-in credentials in vLLM, SGLang and Triton cover less than their names suggest, Ollama's local API has none, and vLLM and SGLang leave their internal planes unauthenticated. Here is what stays open and what must sit in front.
AI systems · vLLM / SGLang / Ollama / NVIDIA Triton Inference Server / Kubernetes / nginx · By Cloud Security DeskPlan for an outage at your CDN or edge provider
When the CDN, WAF and edge provider fails, traffic can move to a regional WAF, a second CDN or the origin, and each keeps less protection. Decide early whether a second path is worth securing.
Resilience · Microsoft Azure / Cloudflare / Amazon Web Services / Google Cloud · By Cloud Security DeskUse DNS egress filtering without mistaking it for a firewall
Resolver-layer filters in AWS, Azure and Google Cloud decide which names a workload can resolve, not where it connects. What each provider says its DNS control misses, and the connection control to pair with it.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskValidate the judge before trusting automated AI evaluations
Managed agent evaluators score your traces with a second model. Measure that judge against your own reviewers with chance-corrected agreement, probe its biases, and pin the judge model before its pass rate gates a release.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskKeep semantic response caches inside authorization scope
A semantic cache returns whatever its nearest stored prompt earned. Put tenant, user or entitlement scope, template and model into an exact-match partition, close the write path, and treat thresholds as a correctness setting.
AI systems · Microsoft Azure / Google Cloud / Redis / GPTCache / Amazon Web Services · By Cloud Security DeskGive a SaaS vendor an AWS role without creating a confused deputy
A vendor's cross-account role is safe only if your trust policy demands an exact external ID, the vendor's backend generates and enforces it per tenant, and your reviews catch drift and offboard the role.
Identity & access · Amazon Web Services · By Cloud Security DeskCompare just-in-time privileged access in AWS, Azure and Google Cloud
Entra PIM and Google Cloud PAM make roles temporary natively, while AWS relies on TEAM or partner tools. All three end elevation by removing an assignment, and sessions, caches and minted tokens can keep running.
Identity & access · Amazon Web Services / Microsoft Azure / Microsoft Entra / Google Cloud · By Cloud Security DeskPlan Azure disaster recovery for a region without a pair
Thirteen Azure regions have no pair and eight more pair with a restricted-access region. This guide shows which built-in geo-redundancy disappears, what replaces it service by service, and how to choose the recovery region.
Resilience · Microsoft Azure · By Cloud Security DeskTest PostgreSQL row-level security with the application role
Row-level security only filters queries from roles that do not bypass it. Test with the production login role, through the production pooler, with transaction-local tenant context and a patched minor release.
Workload security · PostgreSQL / PgBouncer / Amazon Web Services / Microsoft Azure / Google Cloud / Supabase · By Cloud Security DeskRoll over a SAML signing certificate without an SSO outage
Replacing an identity provider's SAML signing key is a separate contract with every service provider. Classify each one by how it learns keys, overlap where it can hold two and finish by removing the old key everywhere.
Identity & access · Microsoft Entra / Okta / Google Workspace / Amazon Web Services · By Cloud Security DeskPlan the move from ingress-nginx to Gateway API
Ingress-nginx is archived and will not be patched again. Contain the old controller, inventory the behaviors your clients depend on, and cut over to Gateway API with evidence and a rollback path.
Workload security · Kubernetes / Google Cloud / AWS / Azure · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskDesign AI agents that contain indirect prompt injection
Filters lower the odds that an agent obeys injected text. Architecture decides what an obeying agent can reach. Compare six published patterns and CaMeL by what each removes, what it costs and what it still misses.
AI systems · Google DeepMind / AgentDojo / NIST / OWASP / Microsoft · By Cloud Security DeskMap cloud incident response to NIST SP 800-61 Revision 3
Revision 3 turned NIST's incident handling guide into a CSF 2.0 profile. Translate its rows into provider contracts, cloud evidence, containment authority and recovery ownership, and fix the log defaults first.
Detection & response · NIST / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskGive Kubernetes pods cloud credentials without static keys
EKS Pod Identity, IRSA, AKS Workload ID and Workload Identity Federation for GKE all swap a projected token for short-lived credentials. What leaks if you stop there is the node's own identity.
Identity & access · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskStop S3 ransomware that encrypts objects with customer-provided keys
SSE-C ransomware rewrites S3 objects under a key only the attacker holds. AWS now blocks SSE-C by default on most buckets; this guide covers what that default misses and the controls that close the gap.
Detection & response · Amazon Web Services · By Cloud Security Desk