Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “SRE”
25 publicationsRespond to an exposed AWS access key beyond the quarantine policy
In a published test, AWS attached its quarantine policy 10 seconds after a key leaked, but the policy denies actions without ending access. This playbook covers what it leaves open, which credentials outlive the key, and the order of containment.
Detection & response · Amazon Web Services / GitHub / Google Cloud · By Cloud Security DeskAdmit MCP servers before agents can call their tools
An MCP server's tool descriptions can change after approval with no new release. Record provenance and execution context, hash the definitions per authorization context, enforce the pin at a gateway or allowlist, and watch for drift.
AI systems · MCP / AWS / Anthropic / GitHub / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskRoll out configuration changes as carefully as code
Flags, policy rows, generated files and customer settings triggered several global outages between 2024 and 2026. Seven primary incident reports show how each change slipped past its safeguards, and which controls their authors adopted afterward.
Resilience · Amazon Web Services / Microsoft Azure / Google Cloud / Cloudflare / CrowdStrike · By Cloud Security DeskInvestigate stolen cloud credentials used to run AI models
When stolen keys run foundation models in your account, the evidence is split between CloudTrail, usage logs that may never have been enabled and a bill that lags by a day or more.
Detection & response · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskFind the Kubernetes RBAC permissions that lead to cluster admin
Group RBAC grants by what they yield, not by verb. Then close the nodes/proxy exec path with v1.36 fine-grained kubelet permissions, narrow impersonation, and prove each removal with a negative test.
Identity & access · Kubernetes / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskFind the AWS global control planes in your recovery path
Thirteen AWS control planes run in us-east-1 or us-west-2, and ordinary calls from other Regions still reach them. Audit runbooks, SDK settings and the last exercise, then swap each dependency for a data-plane operation.
Resilience · Amazon Web Services · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskGive Kubernetes pods cloud credentials without static keys
EKS Pod Identity, IRSA, AKS Workload ID and Workload Identity Federation for GKE all swap a projected token for short-lived credentials. What leaks if you stop there is the node's own identity.
Identity & access · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskStop S3 ransomware that encrypts objects with customer-provided keys
SSE-C ransomware rewrites S3 objects under a key only the attacker holds. AWS now blocks SSE-C by default on most buckets; this guide covers what that default misses and the controls that close the gap.
Detection & response · Amazon Web Services · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskDesign health checks that remove broken instances without causing outages
A health check is an automated decision to remove capacity. Keep load balancer checks local, learn what your platform does when every target fails, and set probe timing from documented defaults.
Resilience · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskPlan for the backlog that follows a regional cloud outage
AWS fixed the DNS fault behind its October 2025 us-east-1 outage within three hours, yet recovery ran into the afternoon. Design retries, queues and capacity automation for that second phase.
Resilience · Amazon Web Services · By Cloud Security DeskChoose a multi-region database consistency model before you need failover
The replication model decides which writes survive a Region failure. Compare asynchronous and quorum options in DynamoDB, Aurora, Spanner and Cosmos DB by recovery point, write latency and the reconciliation each one leaves you.
Resilience · Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskBack up a Kubernetes cluster so workloads can actually be restored
A Kubernetes backup has to carry definitions, Secrets and volume data, and the restore depends on identity, keys and images it never held. Plan the layers, the restore order and the checks that prove recovery.
Resilience · Kubernetes / Velero / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskGive AI agents their own identity instead of borrowed user tokens
An agent that replays a user's token is invisible in logs and cannot be revoked on its own. Give it a principal, delegate narrowly through token exchange, and use what Entra, AgentCore and Google now provide.
Identity & access · Microsoft Entra / Amazon Web Services / Google Cloud / IETF / Model Context Protocol · By Cloud Security DeskChoose and verify CloudWatch Logs retention
Choose CloudWatch Logs retention from supported values, verify the saved setting, and account for delayed deletion, archives, and log-group ownership.
Detection & response · AWS · By Cloud Security DeskDecide what happens when an AI guardrail fails
Distinguish denial, incomplete checks and late results, then decide what may cross each protected release point.
AI systems · Algolia / TrueFoundry / Conductor · By Cloud Security DeskFind the shared dependencies behind a cloud outage
Use the June 2025 Google Cloud and Cloudflare reports to review shared runtime, control, identity and recovery dependencies without turning one outage into a provider ranking.
Resilience · Google Cloud / Cloudflare / AWS · By Cloud Security DeskMake secret rotation reach every running application
Secret managers, mounted files, application memory and connection pools can disagree about the active credential. Test each stage before calling rotation complete.
Workload security · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskWhat coding benchmarks can prove about a model
A coding benchmark result depends on its tasks, harness and tests. A reproducible count of SWE-bench Verified shows why the denominator belongs beside every comparison.
AI systems · By Cloud Security DeskError budgets for controlled service degradation
Protect essential work under load while counting rejected and degraded requests against the service promise that users were actually given.
Resilience · Google / Envoy · By Cloud Security DeskCloud incident severity needs a service impact model
Connect incident priority to service consequences, scope and time criticality while preserving evidence confidence and the authority to revise the decision.
Detection & response · NIST / FIRST · By Cloud Security DeskCloud detection coverage after the ATT&CK data model change
Connect current ATT&CK strategies and analytics to available events, implemented rules and test evidence, while keeping taxonomy counts separate from protection.
Detection & response · MITRE · By Cloud Security DeskStop retries from amplifying an outage
Count attempts across the complete request path, give retries a finite owner and budget, and define how repeated intent avoids duplicate side effects.
Resilience · AWS · By Cloud Security Desk