Cloud Architecture & Security

When a provider labels a CVSS 10 as “No Action Required”, the patch is on the service side… but the risk does not disappear. In corporate cloud, shared responsibility means assuming the impact can still materialize: telemetry, exposure, credentials, configuration, and operational response are still yours.

“Bucket squatting” in GCP around Vertex AI (CVE-2026-2473) showed a dangerous pattern: if a pipeline trusts predictable Cloud Storage names and does not validate bucket ownership/identity, an attacker can create that bucket first and force malicious uploads/reads, leading to remote execution and model poisoning. This article breaks down the scenario, operational signals, and mitigations applicable in enterprises.

Exposing Ollama as an API on a public instance without authentication is a recipe for data leakage, compute abuse, and shadow AI. This article walks through a typical cloud architecture, the most common failure points, and how to implement segmentation, API Gateway, authentication, and verifiable operational controls.

Denial of Wallet (DoW) exploits cloud elasticity to force consumption and drive up costs: cryptomining, massive scaling, artificial traffic, and abuse of managed services. This article breaks down real signals, containment, and operational guardrails (quotas, anomaly alerts, IAM) to reduce economic impact without breaking operations.

Ransomware in the cloud doesn’t always “copy and encrypt” externally: it often hijacks your own controls, especially KMS, to leave you without access to snapshots and objects in S3. This article breaks down how it happens, what signals give it away, and which operational controls (versioning and Object Lock) make the difference when the attacker uses your own encryption against you.

A Break-Glass account without traceability is not “insurance”: it is a backdoor that ends up being used to operate day to day. How attribution breaks, why it happens in large organizations, and how to set up practical guardrails: temporary unlock with a ticket, high-severity alerts, and MFA with split custody.

Controlling egress in a VPC is not “closing the internet”; it is designing routes, endpoints, and inspectable controls so that a compromised instance cannot freely talk to C2 or exfiltrate data. An operational guide with decisions and validation in AWS/Azure.

The “Confused Deputy” pattern appears when a SaaS with access to your cloud does not correctly validate which customer is requesting an action. The result can be that another account within the SaaS itself—or an attacker—ends up operating in your tenant. What it looks like in real integrations (CI/CD, monitoring, billing) and how to mitigate it with concrete guardrails (ExternalId, OIDC with iss/aud, conditions by tags/IP) without breaking operations.

Using a secrets manager does not “buy” you security automatically. The set-and-forget syndrome appears when it is assumed that Azure Key Vault, AWS Secrets Manager, or GCP Secret Manager solve encryption, access control, and rotation by default. In practice, failures come from massive permissions, non-existent rotation, and a false sense of network protection.

BloodHound Enterprise expands its reach beyond Microsoft to map identity attack paths that traverse Okta and GitHub. In companies where identity is the new perimeter, this expansion makes it possible to see (and prioritize) real chaining between SSO, repositories, and privileges.