Author: rodrigtech
-
Network Security Perimeters in Azure
Introduction Microsoft has announced the public preview of Network Security Perimeters, a new Azure service that creates isolation boundaries for Platform-as-a-Service (PaaS) resources deployed outside your virtual network. With Network Security Perimeters, you can: This capability lets organizations define precise security perimeters around their Azure PaaS workloads controlling what external services can connect but also provide…
-
GCP Service Account Impersonation
Google Cloud Platform identity is a large domain of the GCP Security Engineer exam and the emphasis also expands on the use of Service Accounts. Similar to Azure environments service accounts by abstraction come in the form of being used for various services to access other resources via REST APIs. Notably these resources without proper…
-
Container Scanning in Kubernetes
While the escapades of Certified Kubernetes Security specialist renewal are continued and ongoing I’ve felt it was best to craft another scenario to leverage for the container security portion of the exam. Particularly you’re required to remediate many items in your cluster and ideally these items should be caught in your CI/CD pipeline before deployment.…
-
DeepSeek-V3 (MoE)
DeepSeek-V3 is an open-source large language model that boast a 671-billion parameter Mixture-of-Experts architecture with only 37 billion parameters activated per token. This specific model uses Multi-Head Latent Attention (MLA) for inference this compresses the attention keys and values in a low dimensional latent representation. Additionally this has also the strategy of Auxiliary-Loss-Free load balancing…
-
Hacking Kubernetes via ServiceAccountTokens
Kubernetes has a large amount of advancements and inherent good security principles but these are dependent on configurations that are typically not well-known to end users. Predominantly the constructs of Service Accounts or (Non-human Identities) for the masses are populated in many services as they act as the go-between for service to authenticate and operate…
-
Evaluations in Azure Foundry
Evaluations in the application of Generative AI serve as a backstop component to build trust and confidence in your AI-centric applications. Measuring the output and context as it is produced in your application can help you grasp in a verifiable method how your application will perform under certain conditions. Given the natural language usage of…
-
Image Policy Webhook
Image Policy Webhook is a native Kubernetes admission plugin that enforces security policies by validating container images before they are deployed. This ensures that only trusted and compliant images run in your environment. This will take the image that is attempted to be applied compare against predefined policies, and if those policies allow the image…
-
PyRIT for LLM Security
Microsoft launched PyRit (Python Risk Identification Tool) back in 2024 this serves as a open source framework to identify risk with Generative AI systems using the framework to test with multiple methods of attacks. Given the expansion of methods for Jailbreaking systems this allows for the dynamic adaption of attacks to quickly automate processes of…
-
Garak Red Teaming LLMs
As Generative AI is playing a role in multiple organizations so is the popularity of tools for identifying risks and vulnerabilities. In this blog I’m exploring Garak a LLM vulnerability scanner developed by NVIDIA and is a OSS project to help strengthen LLM Security. When the term “Red Team” appears in the approach of simulation…
-
Bill of Materials CKS Refresher
A Software Bill of Materials (SBOM) is like the ingredients list on your food package—it reveals what components, libraries, and dependencies go into building the final software. Just as checking food labels helps you understand nutritional content and potential allergens, an SBOM provides transparency into third-party components, helping identify vulnerabilities early in the software supply…