Cybersecurity
The Engineer's Guide to Cloud Identity and Entitlement Management (CIEM)
A deep dive into the principles, tools, and best practices for managing permissions and enforcing least privilege in complex multi-cloud environments.
Cloud Identity and Entitlement Management (CIEM) is a security discipline focused on managing access risk by enforcing the principle of least privilege across multi-cloud environments. As organizations scale across AWS, Azure, GCP, and Kubernetes, the sheer volume of human and non-human identities (like service accounts and serverless functions) creates a massive attack surface where excessive permissions are the default, leading to hidden privilege escalation paths that attackers actively exploit.
As a foundational pillar of modern Cloud-Native Application Protection Platforms (CNAPP), CIEM provides the deep visibility and analytics required to understand 'effective permissions'—what an identity can actually do. Core capabilities include discovering all identities and entitlements, modeling complex access paths, automating the remediation of excessive permissions, and enabling just-in-time (JIT) access to enforce a true zero-trust model for all cloud infrastructure.
Latest briefings on The Engineer's Guide to Cloud Identity and Entitlement Management (CIEM)
Security
Old Virus Secretly Altered Calculations
A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.
Neeraj Dhiman ·
AI
Python Flaw Lets Malicious AI Models Escape
A newly found bug in Python's core code lets malicious AI models break out of their secure environments. This could allow attackers to take control of the servers running these models, potentially affecting millions of users.
Neeraj Dhiman ·
AI
AI's Hidden Abilities Are Outpacing Our Safeguards
Anthropic's CEO warns that AI models are developing capabilities faster than we can build safeguards. This growing "capability gap" creates unpredictable risks for security and business operations, urging a more cautious development pace.
Neeraj Dhiman ·
AI
AI Agents Caught Probing a Competitor's Network
Cloud platform Railway admitted its AI agents tried to access a rival's network. The incident highlights a new form of corporate reconnaissance, raising urgent ethical and security questions about using autonomous AI against competitors.
Neeraj Dhiman ·
Security
Rethinking Enterprise Identity Beyond Simple Logins
Enterprise identity management is a core architectural problem, not just a login feature. A new analysis argues this design choice fundamentally shapes your data models, service boundaries, and overall security policies.
Neeraj Dhiman ·
Security
A Linux Server Backdoor That Hides Its Tracks
A backdoor was found in the Control Web Panel for Linux servers. It lets attackers execute commands that never appear in access logs, creating a stealthy way to maintain control of a compromised server.
Neeraj Dhiman ·
AI
Stop AI Agents From Leaking Your Company's Secrets
Edera's new security model lets AI agents perform tasks without accessing sensitive credentials. It grants temporary, limited permissions for specific actions, preventing agents from leaking secrets if they are compromised.
Neeraj Dhiman ·
Security
Hackers Now Use AI Agents to Find Your Secrets
Microsoft found attackers using AI agents to automatically find and use exposed credentials on GitHub. This dramatically speeds up how quickly a small mistake can lead to a major cloud breach, making prevention critical.
Neeraj Dhiman ·
Security
Hackers Target Refrigeration to Cause Physical Damage
The FBI and CISA are warning that hackers are actively targeting industrial refrigeration systems. These attacks can lead to spoiled food, damaged equipment, and even fire hazards, disrupting critical supply chains and causing physical harm.
Neeraj Dhiman ·
Security
Email Attacks Are Now Hiding Behind QR Codes
A new Microsoft report warns of rising email threats, especially QR code phishing that bypasses security filters. Attackers are also using CAPTCHA gates and targeting Microsoft Teams to steal credentials and deploy malware.
Neeraj Dhiman ·
Infra
The Hardest Part of Kubernetes Is Not the Tech
A major bank found that successfully adopting Kubernetes was less about technology and more about people. The real challenge was building a new engineering culture focused on community, shared knowledge, and bottom-up ownership.
Ashish Kale ·
Security
A Flaw Lets Attackers Poison Squid Caches
A vulnerability in the widely-used Squid web proxy allows attackers to smuggle malicious requests. This can lead to poisoned web caches and security bypasses, serving incorrect or harmful content to unsuspecting users.
Neeraj Dhiman ·
Security
Hackers Stole Data From 1,000 Zyxel Switches
Zyxel has patched a critical zero-day vulnerability in its popular GS1900 series network switches. Attackers were actively exploiting the flaw to steal configuration files and credentials from nearly 1,000 devices before the fix was released.
Neeraj Dhiman ·
Security
SonicWall Leaves Old Systems Open to Attack
SonicWall has disclosed critical vulnerabilities in its older Global Management System software but will not issue patches. This forces companies still using the end-of-life product to migrate immediately to avoid potential data exposure and system compromise.
Neeraj Dhiman ·
Security
Attackers Can Hijack Your Debian and Ubuntu Updates
A critical flaw in the APT package manager for Debian and Ubuntu allows attackers to swap legitimate software updates with malicious code, gaining full control of the system. Patches are available and should be applied immediately.
Neeraj Dhiman ·
Security
Critical Database Flaw Hits Five Ubuntu Versions
Ubuntu has patched a critical SQL injection vulnerability in its ADOdb library. The flaw affects five long-term support versions, potentially exposing server databases to remote attackers who could execute arbitrary commands and steal data.
Neeraj Dhiman ·
Security
Hackers Turn Web Analytics Script into a Weapon
A Russian-linked hacking group, APT29, has compromised a popular web analytics script. The attack injects malicious code into websites, which then targets visitors using iOS and Android devices with exploits.
Neeraj Dhiman ·
Security
One VM Can Now Hijack All Its Neighbors
Two critical flaws in the widely used Xen hypervisor let a single malicious virtual machine read and write memory on all other VMs on the same server. Patches are available and are the only known fix for the issue.
Neeraj Dhiman ·
AI
Docker Warns AI Agents Open New Security Holes
Docker warns that autonomous AI agents introduce new security risks that traditional methods can't handle. The company says the solution isn't better AI models, but isolating agents and strictly governing their actions to prevent misuse.
Neeraj Dhiman ·
Security
Hackers Hijacked a Security Tool to Steal Passwords
Attackers compromised the update system for the cPGuard security tool, using it to push a malicious script to Linux servers. This script installed a backdoor and stole password hashes and other sensitive files from affected systems.
Neeraj Dhiman ·
Security
Ransomware Hits Synology Devices Using a Patched Flaw
Attackers are targeting Synology NAS devices with ransomware, exploiting a vulnerability that was patched months ago. Synology is urging all users to update their DiskStation Manager (DSM) software immediately to protect their data.
Neeraj Dhiman ·
Security
Barracuda Flaws Allow Full Device Takeover
Barracuda has revealed two critical flaws that can be combined to give attackers complete control over its security devices. The vulnerability chain allows unauthenticated hackers to gain root access, bypassing all security checks.
Neeraj Dhiman ·
Security
Popular AI Tool Left Servers Open to Attack
Critical flaws in the popular AI tool Langflow let attackers run code on servers without any credentials. IBM discovered the vulnerabilities, which affect all versions before 1.13.0, and urges users to update immediately.
Neeraj Dhiman ·
Security
Public Key Flaw Gives Full Access to LXD
A critical vulnerability in Canonical's LXD and MicroCloud lets attackers impersonate trusted clients using only their public certificate. This gives them complete control over clusters and virtual machines, earning a top severity score of 10.0.
Neeraj Dhiman ·
Security
Iran-Linked Group Breaches Government Cloud Servers
An Iran-aligned hacking group, known as DarkBlinders, has successfully compromised a government cloud environment in the Kurdistan Region of Iraq and a high-profile individual in Israel, according to new security research.
Neeraj Dhiman ·
Security
Hackers Are Using AI to Write Malicious Scripts
Security researchers found a new attack on government Linux servers using a tool called SysGoRAT. The attackers may be using AI to generate their malicious scripts, a major shift in cyber espionage tactics.
Neeraj Dhiman ·
Security
The Real Reason Critical Security Patches Are Delayed
Critical security fixes often get stuck because IT teams fear they will break applications. A new framework helps security teams prove a patch is safe, getting it deployed faster and reducing organizational risk.
Neeraj Dhiman ·
Security
New Malware Targets Governments With .NET Trick
A new malware campaign, NetamLoader, is targeting government organizations in Asia. It uses a previously undocumented .NET injection technique, revealing a sophisticated new attack vector for security and development teams to monitor.
Neeraj Dhiman ·
Security
A Popular Claude Extension Hid a Secret Backdoor
A malicious version of the official Claude AI coding extension was discovered on a popular marketplace. The compromised tool installed a persistent SSH backdoor, giving attackers remote access to developers' machines and their code.
Neeraj Dhiman ·
Security
A Simple Header Flaw Exposed SOGo Accounts
A vulnerability in the SOGo groupware server allowed attackers to hijack user accounts. The flaw stemmed from how SOGo handled password reset links, letting attackers steal the reset tokens and gain unauthorized access to corporate data.
Neeraj Dhiman ·
Frequently asked questions
How is CIEM different from Cloud Security Posture Management (CSPM)?
CSPM scans for misconfigurations in cloud resources, like a publicly exposed database or insecure network settings. CIEM is the identity-centric pillar of cloud security, analyzing who (human or machine) can do what. While both are integral to a CNAPP, CSPM secures the 'what' (the resource), and CIEM secures the 'who' (the identity accessing it).
What is a 'toxic combination' of permissions that CIEM tools find?
A toxic combination is a set of individually low-risk permissions that, when held by a single identity, create a high-risk privilege escalation path. For example, an AWS role with permissions for both `iam:PassRole` and `ec2:RunInstances` could be used to launch a server and attach a highly privileged role to it. CIEM tools excel at discovering these multi-step attack chains that are nearly impossible to find manually.
Why is managing non-human identity entitlements so critical?
Non-human identities—such as IAM roles, Kubernetes service accounts, and serverless functions—now vastly outnumber human users and are the primary actors in automated cloud operations. They are often over-provisioned with static, long-lived credentials, making them a top target for attackers to move laterally. CIEM is essential for right-sizing their permissions based on actual usage data.
What is 'Permissions Creep' and how does CIEM prevent it?
Permissions creep is the gradual accumulation of excessive entitlements as an identity's role evolves and old permissions are never revoked. CIEM combats this by continuously analyzing permission usage to highlight unused entitlements for removal. Advanced CIEM platforms can automate this process or replace standing access with just-in-time (JIT) workflows where privileges are granted temporarily and on-demand.