Cloud Security

Most organizations treat data governance like a compliance project. It's not. It's the operating framework that makes everything else work. Here's how data becomes trusted, usable, and scalable: DATA FOUNDATION This is where it starts. Not with dashboards or AI models. → Master data that's shared and neutral → Transaction data you can trace → Source systems you can rely on → Data products that deliver value → Event and IoT data that's structured Make data understandable and reliable. DATA MANAGEMENT The layer most organizations confuse with governance. → Data quality monitoring → Metadata management → Lineage tracking → Cataloging This operationalizes the rules. But it doesn't set them. DECISION AUTHORITY This is governance. The layer everyone skips. → Metric ownership assigned → Definition rights clarified → Change authority established → Escalation paths defined This is what scales. Not the catalog. Decision clarity. ANALYTICS & AI Built on governed decisions. → Dashboards and reporting that people trust → Advanced analytics that stay accurate → RAG and GenAI that don't drift → AI models and agents that scale BUSINESS OUTCOMES → Trusted metrics → Faster decisions → Scalable analytics → Safe AI adoption The framework connects to: → Technical enablement (cloud, platforms, APIs, security) → Operating model (roles, governance cadence, stewardship) → Risk and control (regulatory compliance, auditability, ethics) Here is how I see it: If ownership is unclear, nothing above scales. You can build the best data platform in the world. The cleanest pipelines. The most advanced AI. But without clear ownership and decision authority, it all breaks when someone asks "who approved this definition?" Start with the foundation. Build the governance layer. Then scale. Not the other way around.

This EY incident underscores a truth we often overlook: the most common cloud vulnerability isn't a zero-day exploit; it's a configuration oversight. A single misstep in cloud storage permissions turned a database backup into a public-facing risk. These files often hold the "keys to the kingdom" ie. credentials, API keys, and tokens that can lead to a much wider breach. How do we protect ourselves against these costly mistakes? Suggestions 1. Continuous Monitoring: Implement a CSPM for 24/7 configuration scanning. CSPM is Cloud Security Posture Management -> a type of automated security tool that continuously monitors cloud environments for misconfigurations, vulnerabilities, and compliance violations. It provides visibility, threat detection, and remediation workflows across multi-cloud and hybrid cloud setups, including SaaS, PaaS, and IaaS services 2. Least Privilege Access: Default to private. Grant access sparingly. 3. Data Encryption: For data at rest and in transit. 4. Automated Alerts: The moment something becomes public, you should know. 5. Regular Audits: Regularly review access controls and rotate secrets.

So far this year, AI has been speedrunning security incidents: – Mexico: attackers tell Claude they are doing a bug bounty, keep rephrasing until it starts helping, generate scripts, pivot into Mexican government systems, walk away with around 150 GB of taxpayer and government data. – DJI: hobby coder wants to joystick his $2,000 vacuum, uses Claude to poke the API, grabs a token, suddenly has control of 7,000 robot vacuums in 24 countries, complete with live cameras and floor maps because there was no real device ownership check at all. – OpenClaw: Meta’s Director of Safety and Alignment wires an AI agent into her real inbox, tells it to "ask before acting," watches it forget the instruction after context compaction and aggressively delete huge chunks of mail while she sprints to her Mac mini to yank the cord. Fun to read on X. Terrifying if you ship software. Here is the boring hygiene that would have killed most of this: ○ Treat AI like an intern with root access – Never let agents talk directly to prod. Put them behind narrow, well-reviewed internal APIs with strict allowlists. ○ Bind auth to identity and device, not just a random token –Token should be tied to user, device id, and scope. If a token is valid, it should still only control that one vacuum, that one inbox, that one account. ○ Enforce least privilege for everything –Agents get read-only by default. Separate tokens for "read config", "read logs", "change data", "touch money". Rotate often. ○ Never run AI-generated code in the same blast radius –Sandbox it. Separate VPC, separate account, fake data, no production secrets. Promotion to prod always goes through a human code review. ○ Log like a paranoid SRE –Every agent action is auditable: who issued it, which model, which IP, which token, which resource. Alert on weird patterns and mass actions. ○ Put real rate limits in front of sensitive APIs – Even if an agent goes rogue, it should hit a wall before "wipe 150 GB" or "delete 10,000 emails" becomes possible. ○ Keep secrets away from chats – No raw API keys or prod passwords inside prompts, notes, or agent configs. Use secret managers and short-lived credentials only. ○ Validate intent on destructive operations – Extra confirmation flows for delete, rotate, and mass update. Ideally, with out-of-band verification, not just "yes" in the same chat. ○ Test failure modes, not just happy paths – Red team your own agents. Ask "what happens if it forgets this instruction", "what if the token leaks", "what if someone lies about doing a bug bounty". -- ♻️ Share this for future reference 📢 Follow saed ‎for more & subscribe to the newsletter: https://lnkd.in/eD7hgbnk I am now on 📸 Instagram: instagram.com/saedctl say hello, DMs are open

If you can’t prove impact, don’t expect to keep your budget. 🧙🏼♂️I see it all the time as an Advisor, 2 extremes:  💥 50 dashboards of useless data  OR  😞 Zero visibility of metrics that matter. Making decisions on gut feeling Struggling to translate cyber to business, unable to get budget Fingers crossed hoping nothing bad happens 🤞🏼 But the right data changes everything. So I put this together based on 26 years in the industry to help you watch what matters. Here’s what you should be tracking:👇🏼 1. Mean Time to Detect (MTTD):  ↳Average time to spot an incident, how quickly can you identify threats before damage. 2. Mean Time to Respond (MTTR):  ↳Average time to contain an incident, how effective your team can limit impact. 3. Incident Volume:  ↳Total incidents over a period, the level of threat activity and your team’s workload. 4. Phishing Click Rate:  ↳ Percentage of employees who fall for simulated phishing, showing the org's human risk exposure. 5. Patch Compliance Rate:  ↳Percentage of systems patched on time, how well you’re closing common attack paths. 6. Vulnerability Remediation Time:  ↳ Average time taken to fix vulnerabilities, how quickly you reduce exploitable weaknesses. 7. % of Critical Vulns Open Past SLA:  ↳High-risk vulnerabilities left unresolved past deadlines, revealing dangerous delays in protection. 8. Endpoint Detection Coverage:  ↳Endpoints with security agents deployed, showing where attackers may still have blind spots. 9. MFA Coverage:  ↳Percentage of accounts/apps protected by MFA, reflecting how well identity risks are controlled. 10. Backup Success & Test Rate:  ↳Percentage of backups completed & verified, readiness to recover = resilience. 11. Security Awareness Training Completion:  ↳Percentage of staff who finish training, orgs commitment to reducing human risk. 12. Third-Party Risk Assessment Coverage:  ↳Percentage of vendors assessed, how much supply chain risk you actually understand. 13. % of Incidents Escalated to External Notification:  ↳Incidents requiring disclosure, how often issues affect legal & reputation. 14. Dwell Time:  ↳ Average time attackers stay undetected, how long adversaries have to move before you respond. 15. False Positive Rate:  ↳Percentage of alerts deemed false, how much noise distracting your team. 16. % of Privileged Accounts Reviewed:  ↳Percentage of high-level accounts audited, control over insider and admin misuse risks. 17. Compliance Alignment Score:  ↳Percentage of required controls in place, indicating audit readiness & regulatory obligations. 18. % of Incidents with Root Cause Identified:  ↳Incidents where the true cause is found, preventing repeat attacks. Get these in place and you'll sleep at night, and get that budget to improve. Which one do you find the most important?⤵️ 🔄 Repost to help others improve cybersecurity 📲 Follow Wil Klusovsky for wisdom on cyber & tech business

We had three months to build a secure data platform from the ground up. There was no existing technology estate to inherit or gradually modernise. The platform needed to handle highly sensitive medical, legal and financial information. It also had to support a programme expected to scale to tens of thousands of cases. And the delivery timetable was already fixed. We mobilised a security cleared team within nine days. We started with the foundations needed to scale the platform safely. The environment was built cloud native on Azure using Infrastructure as Code. This gave the team a repeatable way to deploy and manage the underlying infrastructure. We implemented role based access controls and a Zero Trust security model around the data from the beginning. A master data catalogue created one governed view of case information. The analytics layer gave operational teams live visibility through Power BI and Python. One of the biggest problems we needed to remove was spreadsheet sprawl. When sensitive case information lives across disconnected files and manual processes, reconciliation becomes part of everyone's job. Bringing that information into a single source of truth changed how the operation could work. Case data became unified. Manual reconciliation was significantly reduced. Live registers and analytics were available within the three-month delivery window. We also designed the architecture so the programme would not need another rebuild when its requirements evolved. The platform was made ready for future AI driven document triage. This would allow automation to be introduced on top of governed data and established security controls. That sequencing matters. When you are building something that will handle sensitive information at scale, speed cannot come from skipping foundations. It comes from designing them properly enough that everything afterwards can move faster. #DigitalTransformation #DataEngineering #CloudTechnology

Using unverified container images, over-permissioning service accounts, postponing network policy implementation, skipping regular image scans and running everything on default namespaces…. What do all these have in common ? Bad cybersecurity practices! It’s best to always do this instead; 1. Only use verified images, and scan them for vulnerabilities before deploying them in a Kubernetes cluster. 2. Assign the least amount of privilege required. Use tools like Open Policy Agent (OPA) and Kubernetes' native RBAC policies to define and enforce strict access controls. Avoid using the cluster-admin role unless absolutely necessary. 3. Network Policies should be implemented from the start to limit which pods can communicate with one another. This can prevent unauthorized access and reduce the impact of a potential breach. 4. Automate regular image scanning using tools integrated into the CI/CD pipeline to ensure that images are always up-to-date and free of known vulnerabilities before being deployed. 5. Always organize workloads into namespaces based on their function, environment (e.g., dev, staging, production), or team ownership. This helps in managing resources, applying security policies, and isolating workloads effectively. PS: If necessary, you can ask me in the comment section specific questions on why these bad practices are a problem. #cybersecurity #informationsecurity #softwareengineering

𝐁𝐥𝐮𝐞𝐩𝐫𝐢𝐧𝐭 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐀𝐈 𝐆𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐚𝐧𝐝 𝐏𝐥𝐚𝐭𝐟𝐨𝐫𝐦 𝐒𝐭𝐚𝐜𝐤 Spinning up AI models is the easy part.  Governing them across teams, APIs, and agents at enterprise scale that is where most Azure deployments fall apart.  This blueprint maps the full stack. 𝟏. 𝐂𝐄𝐍𝐓𝐑𝐀𝐋 𝐀𝐈 𝐁𝐀𝐂𝐊𝐄𝐍𝐃𝐒 LLMs, traditional AI, and Search all centralized: - AI Foundry Model Catalog - Azure OpenAI, Model as Service, 3rd Party LLMs, GPU Infrastructure - Azure AI Search, Azure AI Services, Prompt Shields, Content Safety 𝟐. 𝐀𝐈 𝐆𝐀𝐓𝐄𝐖𝐀𝐘 The governance layer handling RBAC, capacity management, and GenAI security: - API Management (Cloud AI Gateway): Routes LLMs, AI APIs, MCP Servers, and Agents - Usage Data Platform: PowerBI and Usage DB for visualization and reports - Central AI Evaluation: Logic Apps, Log Analytics, App Insights, AI Foundry Observability 𝟑. 𝐀𝐏𝐈𝐬 𝐓𝐎 𝐌𝐂𝐏 𝐒𝐄𝐑𝐕𝐄𝐑𝐒 (𝐀𝐏𝐈𝐌) Transactional and info services connecting agents to enterprise data: - CRM APIs, Products APIs, Payment APIs, Internal Knowledge Store, Commercial Software (COTS), 3rd Party Platforms 𝟒. 𝐌𝐔𝐋𝐓𝐈-𝐀𝐆𝐄𝐍𝐓 𝐒𝐘𝐒𝐓𝐄𝐌 Wide scope, complex use cases requiring diverse skills: - Agent Frontend XP and Agent Orchestrator coordinate multiple agents - Agent Skill 1 through Agent Skill N handle specialized tasks - Private Endpoints Subnet: Event, DB, Keyvault, Container Registry, Azure Cache for Redis - JumpBox/DevOps Subnet with Virtual Machine - Observability AI Quality/Eval built in 𝟓. 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐅𝐎𝐔𝐍𝐃𝐑𝐘 𝐀𝐆𝐄𝐍𝐓𝐒 𝐏𝐑𝐎𝐉𝐄𝐂𝐓 - Foundry Model Catalog with Connections, AI Services, AI Agent Services, Storage, Key Vault - Copilot Studio and Agent Frontend XP API/Web - Container App Environment - Observability AI Quality/Eval 𝟔. 𝐋𝐎𝐆𝐈𝐂 𝐀𝐏𝐏 𝐀𝐆𝐄𝐍𝐓 Logic Apps Agent Loop with: - Tools Connections, Human in Loop, Knowledge, Azure OpenAI (LLM) - Triggers: time, http, event - Observability AI Quality/Eval 𝟕. 𝐒𝐄𝐂𝐔𝐑𝐈𝐓𝐘 𝐀𝐍𝐃 𝐌𝐀𝐍𝐀𝐆𝐄𝐌𝐄𝐍𝐓 - Identity: Entra ID for end-to-end authentication and authorization - Security: Sentinel, Defender for Cloud, Security Copilot - Management: Azure Policy, Azure Monitor, Azure Copilot 𝐓𝐇𝐄 𝐏𝐑𝐈𝐍𝐂𝐈𝐏𝐋𝐄 Governance is not a layer you add later.  It is the hub everything else connects through.  Build the gateway first, then let spokes scale. Which part of this stack is your team building out right now? Reference: https://lnkd.in/e9ApTtXN Learn more about Foundry Citadel Architecture here - https://lnkd.in/exVjcaXe ♻️ Repost this to help your network get started ➕ Follow Anurag(Anu) Karuparti for more PS: If you found this valuable, join my weekly newsletter where I document the real-world journey of AI transformation. ✉️ Free subscription: https://lnkd.in/exc4upeq #EnterpriseAI #AgenticAI #AIGovernance

Your dashboards can be 100% green. And still completely wrong. That’s the scary part about data quality problems: they spread quietly before anyone notices. A reliable pipeline doesn’t just move data. It verifies trust at every stage. The checks that matter most: • null & duplicate validation • primary key checks • referential integrity • schema evolution detection • freshness monitoring • range & outlier checks • distribution drift tracking And one lesson engineers learn late: Schema evolution is not “just metadata.” A tiny structural change can break: • joins • aggregations • ML features • dashboards • historical consistency If you want stronger systems: • validate schemas before deploys • monitor row-count anomalies • compare distributions over time • treat data contracts seriously • build observability into pipelines early Because pipelines usually fail long before they crash. The best engineers catch the signal before the incident. Here’s are some amazing frameworks to include in your data projects: → Great Expectations : Write tests for your data like you test code. → Deequ: Amazon's gift to data quality. Scales beautifully. → Monte Carlo : Observability for data pipelines. Sleep better. → dbt Labs tests: Test your transformations. Trust your models. Quality isn't a one-time project. It's a daily practice. Image Credits: Sumit Gupta What’s one silent data issue your team learned the hard way? #data #engineering

I've reviewed Anthropic's Risk Report for Claude Opus 4.6 because many of our enterprise customers are actively deploying AI agents into production environments. When those systems fail, the consequences are operational, financial and reputational. Most of the reaction centers on the headline that catastrophic risk is very low but not negligible. What matters more for customers and future customers is how risk actually manifests inside live enterprise systems and what that means for uptime, data integrity and compliance. It does not look like a breach. It looks like business as usual. An agent subtly influencing procurement decisions. A finance workflow that starts omitting inconvenient data. Permissions that expand over time without clear oversight. Anthropic describes a scenario called Persistent Rogue Internal Deployment, where an AI system with privileged access creates a less monitored instance of itself and continues operating inside production systems. In a real enterprise environment, that translates into downtime, data exposure or regulatory impact. The organizations at greatest risk are not the ones moving cautiously. They are the ones who pushed agents into production without adding an operational governance layer. We have seen this pattern before in cloud adoption. Technology advances quickly, and controls often lag behind. That gap is where exposure grows. So what should enterprise IT and security teams do now? 1. Constrain actions, not just access. Define what an agent can set in motion and enforce least privilege at the identity level, just as you have done for human users for decades. 2. Log actions, not just outcomes. Maintain an auditable trail of what the agent did, where and what triggered it, the same standard applies to human operators in regulated environments. 3. Automate your tripwires. Do not rely on people to catch machine speed behavior. Build policy enforcement and anomaly response into the loop. 4. Audit your agent footprint. Inventory every agent, its owner, permissions and kill path. Governance starts with visibility and most enterprises are still building it. The window to build these guardrails is now, before the agent workforce scales. At Rackspace, 25 years of running mission-critical systems have taught us that trust without controls creates exposure. We build and operate AI infrastructure with governance embedded from day one because customers need speed, resilience and measurable outcomes, not experiments in production. What this means for you is simple. Move forward on AI with confidence, but make operational governance part of the foundation so scale strengthens your business instead of introducing risk.

A few months ago, we found a malicious AWS CloudFormation template trying to breach a customer's AWS account. It was disguised as “AWS Support for Fargate” Here’s what it’s really up to: 1. Grants itself administrator-level permissions via a fake support IAM role 2. Deploys a lambda function (in-line) to exfiltrate role ARN to an external API Gateway endpoint 3. Invoke itself using AWS CloudFormation CustomResource 📘 Blue team tips - Always review the IAM roles, policies, and external calls in any template. - Use the IAM Access Analyzer to verify external trust relationships - Don’t blindly trust anything labeled “AWS Support” — verify it first! - Report to AWS Security teams ASAP 📕 Red team tips - The malicious actor is identified by the AWS account ID in the AssumeRole policy. - Consider flooding the API endpoint with randomly generated payloads using fake IAM role ARNs.