Check the SaaS settings you assumed were safe
A business subscription does not automatically select the right sharing and access controls. Define the intended configuration, review administrators and integrations, and test the user experience.
Infrastructure Security
Infrastructure Security
Keep a list of the remote admin tools you allow
A legitimate support tool still creates an access path. Record the tool, managed systems, operators, authentication, session records, and how access is removed.
Passwords that are still in Git history
Deleting a secret from the latest version does not invalidate it or remove every earlier copy. Contain the credential first, then assess repository history and any evidence of use.
Who can reach a Kubernetes cluster
A cluster’s exposure includes more than its public endpoint. Review administrators, workload identities, role bindings, credentials, network paths, and access to sensitive configuration.
What a container does not isolate
A container’s boundary depends on its configuration and the host it shares. Review privilege, mounted resources, credentials, network access, and runtime controls as a complete deployment.
Where ordinary IT ends and a safety system begins
A system connected to physical operations can fail in ways that affect safety, not only information. Coordinate security work with the people responsible for the process and its safe operation.
Who can use an encryption key, and how you would know
The right to manage a key and the right to use it are different powers. Review who can decrypt, change policy, rotate, export, or delete keys, and what evidence those actions leave.
Backups that ransomware cannot rewrite
A backup is vulnerable if an attacker can erase or rewrite it using the same authority that controls production. Review the backup’s administrative path as well as its storage features.
How to use certificate transparency logs
Certificate Transparency records can help you notice unexpected certificate issuance. They are useful clues to investigate, not proof that the named service is live or that it was compromised.
Where SAML and OpenID Connect sign-in usually fail
A signed identity message still needs the correct issuer, audience, destination, and request context. Review the integration as a complete sign-in and account lifecycle.