Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “TLS”
21 publicationsFind the Kubernetes RBAC permissions that lead to cluster admin
Group RBAC grants by what they yield, not by verb. Then close the nodes/proxy exec path with v1.36 fine-grained kubelet permissions, narrow impersonation, and prove each removal with a negative test.
Identity & access · Kubernetes / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskKnow what service mesh mTLS proves about the caller
A mesh handshake proves that a peer held a key for a namespace and service account. It says nothing about the user or the operation, and permissive defaults, probes and waypoints open paths around it.
Workload security · Istio / Linkerd / Kubernetes / Google Cloud / Microsoft Azure / Amazon Web Services · By Cloud Security DeskPlan for an outage at your CDN or edge provider
When the CDN, WAF and edge provider fails, traffic can move to a regional WAF, a second CDN or the origin, and each keeps less protection. Decide early whether a second path is worth securing.
Resilience · Microsoft Azure / Cloudflare / Amazon Web Services / Google Cloud · By Cloud Security DeskUse DNS egress filtering without mistaking it for a firewall
Resolver-layer filters in AWS, Azure and Google Cloud decide which names a workload can resolve, not where it connects. What each provider says its DNS control misses, and the connection control to pair with it.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskSeparate API gateway JWT checks from backend authorization
A gateway that accepts a JWT has checked its signature, issuer, audience and time window. It has not checked token type, revocation, cached decisions or object ownership. This mapping shows which side owns each decision.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskRoll over a SAML signing certificate without an SSO outage
Replacing an identity provider's SAML signing key is a separate contract with every service provider. Classify each one by how it learns keys, overlap where it can hold two and finish by removing the old key everywhere.
Identity & access · Microsoft Entra / Okta / Google Workspace / Amazon Web Services · By Cloud Security DeskPlan the move from ingress-nginx to Gateway API
Ingress-nginx is archived and will not be patched again. Contain the old controller, inventory the behaviors your clients depend on, and cut over to Gateway API with evidence and a rollback path.
Workload security · Kubernetes / Google Cloud / AWS / Azure · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskMove cloud logs to cheaper tiers without losing detection coverage
CloudWatch Infrequent Access, the Sentinel data lake and Cloud Logging exclusions all cut ingestion cost by removing real-time detection hooks. Place each source by the rules that read it, then prove the replacements fire.
Detection & response · AWS / Microsoft Azure / Google Cloud · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskRun code written by AI agents inside a disposable sandbox
Treat agent-generated code as untrusted input. Pick a microVM or user-space kernel boundary, keep egress and credentials off by default, and destroy the session when the user or conversation ends.
AI systems · Amazon Web Services / Microsoft Azure / Google Cloud / Firecracker / gVisor / OWASP · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskBind OAuth tokens to the client that presents them
DPoP can make possession of an access token insufficient for use, provided the issuer, client and resource server implement the same proof and key-binding contract.
Identity & access · IETF / Google · By Cloud Security DeskDesign RDS IAM authentication around the connection pool
Generate IAM database tokens for the physical connections that need them, and keep token validity separate from the lifetime of an already-established SQL session.
Workload security · AWS · By Cloud Security DeskGive Kubernetes admission webhooks an explicit failure contract
Treat an admission webhook as a control-plane dependency with explicit behavior for denial, call failure, mutation and the changes needed to repair it.
Workload security · Kubernetes · By Cloud Security DeskDesign an outbound fetch service that contains SSRF
A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.
Workload security · OWASP / IANA · By Cloud Security DeskCertificate renewal under shorter validity limits
Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.
Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security DeskThe telemetry collector is part of the evidence boundary
Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.
Detection & response · OpenTelemetry · By Cloud Security DeskPrepare cloud workloads for hybrid post-quantum TLS
Hybrid support in a library is not proof that every TLS hop uses it. Verify negotiation, compatibility and fallback while keeping certificate authentication separate.
Workload security · IETF / NIST / OpenSSL / Cloudflare · By Cloud Security DeskWhere DNS failover loses control of the clock
Separate authoritative routing, resolver caches, stale answers, runtime caching and existing connections when describing what DNS failover can achieve.
Resilience · AWS / Cloudflare / Oracle · By Cloud Security DeskMap every connection beyond the private AI endpoint
Trace inference, retrieval, tools, administration, and telemetry separately before describing an AI application as private.
AI systems · AWS · By Cloud Security Desk