cloud security
14 posts
CISA admin pushed GovCloud keys to GitHub
A CISA administrator committed AWS GovCloud credentials to GitHub. The failure is the issuance model, not the commit.
CISA pushed GovCloud keys to GitHub
Technical analysis of a CISA admin leaking AWS GovCloud keys on GitHub - exposure mechanics, CloudTrail detection paths, and residual session risk post-rotation.
CISA administrator published GovCloud keys to GitHub
A CISA administrator's publication of AWS GovCloud keys to public GitHub exposes the gap between cloud segregation policy and runtime control.
Entra ID trades your credential for a token
Microsoft Entra ID resolves trust at sign-in and honors bearer tokens on reference, not verification, which is how one compromised login becomes a cloud breach.
The 2021 bucket that sat open for nine years
Abandoned files, forgotten buckets, and stale subdomains are the cheapest way attackers get in. Here is how to find yours before they do.
Contractor pushed the boundary keys
A CISA contractor pushed AWS GovCloud admin keys to a public GitHub repo. The credential format, not the contractor, is the failed control.
Vercel hands attackers your build pipeline
Technical IR playbook for a Vercel CI/CD compromise: attack chain, MITRE ATT&CK mapping, telemetry gaps, containment sequence, and residual exposure.
Your MSSP is selling you blindness.
MSSPs run perimeter-era detection while attackers operate inside the identity boundary. The gap is structural, not a resourcing problem.
European Commission AWS Compromise: Identity Boundary Failure Confirmed
Analysis of the European Commission AWS compromise reveals a confirmed failure in identity boundary enforcement. Credential harvesting via phishing led to direct access using valid elevated credentials, exposing systemic gaps in cloud authentication controls.
OAuth Consent Abuse: A Trust Boundary Collapse in Microsoft 365
A malicious browser extension exploited OAuth consent in Microsoft 365 to gain full tenant access. No password or MFA was required. The attack bypassed all perimeter controls and created a persistent, unrevocable access path-highlighting a fundamental flaw in identity trust models.
Public Integration Without Authentication Exposes Critical Control Failure
A public-facing integration lacking identity validation created a critical access boundary failure. No evidence confirms data access or exposure duration. Enforcement at the edge is mandatory for any publicly reachable endpoint.
Identity Trust Drift in Cloud Access Control: A Systemic Failure Mode
A systems-level analysis of how static token models in cloud platforms create persistent access risks when identity trust is not reevaluated after initial validation, exposing a fundamental drift between design and operational reality.