Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “SSH”
14 publicationsAdmit MCP servers before agents can call their tools
An MCP server's tool descriptions can change after approval with no new release. Record provenance and execution context, hash the definitions per authorization context, enforce the pin at a gateway or allowlist, and watch for drift.
AI systems · MCP / AWS / Anthropic / GitHub / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskTune managed WAF rules without opening a bypass
Fix a managed WAF false positive by changing one rule for one route, then decide what happens to the request body bytes AWS WAF, Azure WAF and Cloud Armor never inspect.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskVerify EC2 containment beyond a security group change
Swapping a compromised EC2 instance into an isolation security group stops new connections, not tracked ones. Learn which flows survive, how long idle timeouts let them run, and how to prove the cut happened.
Detection & response · Amazon Web Services · By Cloud Security DeskUse DNS egress filtering without mistaking it for a firewall
Resolver-layer filters in AWS, Azure and Google Cloud decide which names a workload can resolve, not where it connects. What each provider says its DNS control misses, and the connection control to pair with it.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskRemove public SSH access from an EC2 security group
Remove internet-wide EC2 SSH rules after testing Session Manager or restricted SSH. Check all groups, IPv6, fresh sessions, and recovery access.
Workload security · AWS · By Cloud Security DeskConnect to a Google Cloud VM with IAP and OS Login
Connect to a Linux VM through IAP and OS Login, check each permission and network layer, and remove old SSH paths with a tested recovery plan.
Identity & access · Google Cloud · By Cloud Security DeskFind why an Azure VM cannot reach a service
Use a specific source and destination with Network Watcher and separate network reachability from app health.
Detection & response · Azure · By Cloud Security DeskRestrict SSH and RDP access with an Azure network security group
Inspect effective rules, preserve the approved management path and test a fresh connection.
Workload security · Azure · By Cloud Security DeskKeep build credentials out of the image and its evidence
A temporary BuildKit secret mount controls credential delivery, not everything a build command can do with the credential or leave in its outputs.
Workload security · Docker / GitHub · By Cloud Security DeskShort SSH certificates still need explicit access boundaries
An SSH certificate supplies bounded identity claims. The issuer, server, client and incident operator still make separate access decisions.
Identity & access · OpenSSH · By Cloud Security DeskCertificate renewal under shorter validity limits
Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.
Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security DeskClose the AWS sessions that survive identity shutdown
Removing a login does not by itself establish that issued AWS credentials have lost their authority. Build a revocation procedure that accounts for both.
Identity & access · AWS · By Cloud Security Desk