Carbonato: does permission to create containers reach the host?
Publishing an image and administering its execution are different powers. Follow the identity creating a workload and the capabilities that workload receives.
Blog
Practical guides on penetration testing, vulnerability research, and AI-powered security tools.
Articles
150 articles
JadePuffer in Azure: who can delete what recovery depends on?
A copy helps only when the business can preserve and use it. Connect the power to delete resources with the access required to recover a service.
FortiBleed: who can recover administrative control of a firewall?
The device controlling entry also needs a recovery plan. Review who can act when the usual administration path stops working.
The Mabna case: following academic accounts into digital libraries
An academic account can reach services administered by different organizations. Assessment needs to follow that path and identify where each permission ends.
Research partnerships: connect funding decisions with access
A contract may identify who funds a project without showing who can access its results. Follow funding, deliverables and permissions throughout the partnership.
Warlock and SharePoint: who can distribute changes across the network?
Securing the entry server and controlling a distributed change are complementary tasks. Follow who authorizes each stage and who confirms its outcome.
After an invoicing incident: who can change where a payment goes?
Knowing an invoice does not establish authority to change its receiving account. Review how a request is confirmed, approved and executed.
The key changed hands. What about the company car’s digital access?
Returning a physical key may leave accounts and histories associated with the vehicle. Define who may view information and how to verify that an association has ended.
The AI invitation looks credible. Who approved the next access request?
A convincing conversation can lead to a login request outside an approved workflow. Test the transition from accepting an invitation to granting access.