Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “soft”
43 publicationsKeep a Google Cloud Storage bucket private
Use public access prevention and uniform bucket-level access for Cloud Storage, then test IAM readers, signed links, and application dependencies.
Workload security · Google Cloud · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskRecover deleted Google Cloud Storage objects with soft delete
Choose a Cloud Storage soft delete window, restore a specific object generation, validate its contents, and account for retention and cleanup.
Resilience · Google Cloud · By Cloud Security DeskGive Azure readers access to one resource group
Assign Reader without granting write access or assuming it grants data access.
Identity & access · Azure · By Cloud Security DeskRead an Azure Key Vault secret from a VM without a password
Set up one system-assigned VM identity and a vault-scoped secret permission.
Identity & access · Azure · By Cloud Security DeskGet an Azure alert when a role assignment changes
Detect successful RBAC changes and test alert delivery without expanding a production role.
Detection & response · Azure · By Cloud Security DeskFind why an Azure VM cannot reach a service
Use a specific source and destination with Network Watcher and separate network reachability from app health.
Detection & response · Azure · By Cloud Security DeskCheck and stop anonymous access to Azure blobs
Understand account and container settings and prove both anonymous denial and intended app access.
Workload security · Azure · By Cloud Security DeskRestrict SSH and RDP access with an Azure network security group
Inspect effective rules, preserve the approved management path and test a fresh connection.
Workload security · Azure · By Cloud Security DeskHandle Azure OpenAI rate limits without retry storms
Separate deployment quota, short request bursts and bounded client retry behavior.
AI systems · Azure · By Cloud Security DeskConnect to Azure OpenAI without an API key
Prove Entra-based inference with a scoped runtime identity before disabling local authentication.
AI systems · Azure · By Cloud Security DeskRecover a deleted Azure blob with soft delete
Choose the right recovery action for a blob, version or container and verify restored bytes.
Resilience · Azure · By Cloud Security DeskRecover a deleted Azure Key Vault secret
Distinguish secret recovery from vault recovery and verify versioned application references.
Resilience · Azure · By Cloud Security DeskKeep Kubernetes audit records useful without logging secrets
Design a question-led Kubernetes audit policy with explicit body limits, rule precedence, lifecycle stages and provider-specific acceptance checks.
Detection & response · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskBind confidential GPU inference to a verified key release
Require composite evidence, owner policy and verified recipient binding before confidential inference receives protected key material.
AI systems · NVIDIA / Azure · By Cloud Security DeskSet explicit trust boundaries for Entra partner access
Accepting another tenant’s authentication claims is a specific trust decision, not blanket approval of its users, devices or access to your applications.
Identity & access · Microsoft · By Cloud Security DeskCatch late security events without replaying every alert
Separate event time, ingestion time and execution health so delayed records can be evaluated without turning every broader lookback into a replay.
Detection & response · Microsoft Sentinel / Microsoft Defender · By Cloud Security DeskFind the Purview audit history your investigation can still retrieve
Resolve Purview audit availability at the record level by separating actor eligibility, retention policy, collection status, investigator scope and export limits.
Detection & response · Microsoft Purview / Microsoft 365 · By Cloud Security DeskRestrict device code sign-in without breaking approved clients
Restrict device-code authentication through an explicit client and resource policy, and test the tracked sessions that can outlive the initial browser approval.
Identity & access · Microsoft / IETF · By Cloud Security DeskPasskey deployment needs a recovery design
A workforce passkey rollout needs a recovery contract before broad enforcement. Separate credential custody, enrollment evidence and application sessions.
Identity & access · NIST / FIDO Alliance / Microsoft Entra · By Cloud Security DeskWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskA defensible cloud patch queue starts with exploitation evidence
Join exploitation evidence to affected assets, exposure, ownership and verified remediation without turning CVSS, EPSS or a catalog entry into a complete risk score.
Detection & response · CISA / NIST / FIRST · By Cloud Security DeskSecurity evidence for AI release decisions
A release approval should identify the changed application, the claims its tests support and the evidence that expires when a model, prompt, data path or runtime changes.
AI systems · By Cloud Security DeskRecovery objectives that match the cloud service
Define the business function, outage clock, recoverable data and dependency assumptions before choosing a cloud disaster-recovery architecture.
Resilience · AWS / Azure / Google Cloud / NIST · By Cloud Security Desk