Real-world cloud security. Explained and applied.
Ransomware in the cloud doesn’t always “copy and encrypt” externally: it often hijacks your own controls, especially KMS, to leave you without access to snapshots and objects in S3. This article breaks down how it happens, what signals give it away, and which operational controls (versioning and Object Lock) make the difference when the attacker uses your own encryption against you.
IMDSv1 allows access to metadata and temporary credentials from the instance itself without any anti-SSRF mechanism. In corporate environments, an SSRF in an internal app can end in exfiltration of the instance role’s credentials and escalation in AWS. Enforcing IMDSv2 drastically reduces that risk by requiring per-session tokens.
A Break-Glass account without traceability is not “insurance”: it is a backdoor that ends up being used to operate day to day. How attribution breaks, why it happens in large organizations, and how to set up practical guardrails: temporary unlock with a ticket, high-severity alerts, and MFA with split custody.
Controlling egress in a VPC is not “closing the internet”; it is designing routes, endpoints, and inspectable controls so that a compromised instance cannot freely talk to C2 or exfiltrate data. An operational guide with decisions and validation in AWS/Azure.
The supply chain in container registries fails when we treat public base images as “trusted” and when we use mutable tags like :latest. This article grounds the abuse scenario, why a corporate registry is not synonymous with security, and how to operate ECR/ACR/GCR with immutability, push-time scanning, and signature policies (Cosign/Notation) that actually block unsafe deployments.
Origin IP Bypass happens when an attacker discovers the real IP of the origin behind a WAF/CDN (CloudFront, Azure Front Door, Cloudflare) and attacks it directly. The result: your rules and rate limiting no longer apply. Here is how it happens, what signals to spot it in production, and how to close it in a verifiable way.
Synchronizing on‑prem Active Directory with Entra ID or AWS IAM Identity Center without segmentation turns a local incident into a cloud compromise. Identity is the bridge: Pass-the-Hash, Kerberoasting, and misassigned privileges can escalate to global roles if you don’t apply filters, privilege separation, and strict MFA.
An attacker with read permissions can avoid a massive SELECT and exfiltrate complete databases by sharing snapshots with an external account or making them temporarily public. This operational guide explains how RDS/EBS and equivalents are abused, which events to look for in logs, and how to block it with guardrails (SCP/Azure Policy) and real-time alerts.
“We encrypt it with KMS” is not a security measure if the default key does not enforce additional controls. Provider-managed encryption often allows implicit decryption for anyone with permissions on the resource. This article debunks the myth and explains how to restrict key usage (CMK) with policies and conditions such as kms:ViaService, and what changes between AWS, Azure, and GCP.
The “Confused Deputy” pattern appears when a SaaS with access to your cloud does not correctly validate which customer is requesting an action. The result can be that another account within the SaaS itself—or an attacker—ends up operating in your tenant. What it looks like in real integrations (CI/CD, monitoring, billing) and how to mitigate it with concrete guardrails (ExternalId, OIDC with iss/aud, conditions by tags/IP) without breaking operations.