Tag: security
All the articles with the tag "security".
Cedar, and the decision point my AI flow was missing
Cedar is an authorisation language that is deliberately less powerful than its competitors, formally verified, and widely assumed to be an AWS only concern. All three of those are why it was the right tool for gating what an AI flow is allowed to do.
Security Critical Functions, and the things that control them
UK telecoms security regulation defines two categories of system, one nested inside the other. The distinction is better thinking than most security frameworks manage, and it applies well outside telecoms.
Measuring a control you cannot see failing
Most detection tools report what they found and say nothing about what they missed. Planting known records is how you get the number nobody will give you.
Macie and the hard problem of finding PII
Macie cannot reliably tell a payment card number from one of your own reference numbers. The privacy argument explains why that is hard to fix with your data, and not why it remains unfixed.
Prompt injection through operational data
If you point a language model at your logs, tickets or alerts, an attacker who can write to any of those is writing part of your prompt. What that enables, and how to contain it.