Onboarding a new table into row-level security should be four lines of metadata. Not two new objects, a code review, and a platform-team ticket. This post describes a tag-driven attribute-based access control (ABAC) pattern built on Databricks Unity Catalog primitives…
Category: DZone Security Zone
Security Is a Platform Property, Not a Pipeline Step
A few weeks ago, I disabled key authentication on an Azure storage account we used for Terraform state management. It was one of the key security recommendations in Microsoft Defender for Cloud. It made sense to use RBAC-only permissions, enforce…
Fix Circular Dependencies in PostgreSQL Row-Level Security With SECURITY DEFINER Functions
Row-level security in PostgreSQL is one of the more useful features for multi-tenant applications. The idea is straightforward: define a policy on a table that tells PostgreSQL which rows a given user is allowed to see or modify, and the…
The Agent Security Split: Tool Layer vs Sandbox Layer
When an enterprise asks, “Is your agent platform secure?”, the question is almost always a bundle of two distinct architectural concerns: Tool layer: Can the agent only call the tools we approved? Are the tool inputs and outputs validated? Are…
Every SOC Today Is Answering the Wrong Question
Ask most detection engineers what a SOC does, and they’ll say: it finds compromised machines. That’s the wrong question. Attackers stopped compromising machines as the primary objective years ago — machines are just where identities and trust relationships happen to…
Your Agent Trusts That Wiki. Should It?
We were building a DevOps agent to help with on-call remediation. The idea was straightforward: when an incident fires, the agent reads the relevant runbook from our internal wiki, assesses the situation, and executes the appropriate remediation steps. No waiting…
12 Factor Framework for Building Secure and Compliant Cloud Applications
It began with a late-night alert. A critical cloud application, serving thousands of users, had just been flagged for a security violation. No “hack” had occurred; nothing obviously was broken. What appeared to be a minor misconfiguration had quietly exposed…
Implementing Zero-Trust Networking and Identity for Microsoft Foundry Agents
Once your multi-agent system (Parts 6-8) is functionally solid, the question that comes up in every enterprise security review is the same: how do you know an agent is only doing what it’s authorized to do, over a network path…
Machine Identity Debt: Why Human Identity Is No Longer Cloud Security’s Primary Boundary
Cloud-native systems now create far more machine identities than human ones. Security strategies built around workforce identity are no longer sufficient. Here’s what engineering leaders should build instead. The Breach That Didn’t Need a Password On August 8, 2025, a…
Goodbye, Skeleton Keys: Why Machine Identity Broke IAM, and What SPIFFE Is Doing About It
Cloudflare published its own forensic timeline of the Salesloft Drift breach down to the minute, and it’s worth sitting with the detail for a second. At 11:51 on August 9, 2025, an actor researchers track as GRUB1 tried to validate…
AI Can’t Defend What It Can’t See
Most of what AI promises in security rides on something duller than the model itself: whether it can see the environment it’s defending. When it can’t, a stronger model doesn’t help. It makes the gaps harder to spot, and it…
Prompt Injection Attacks and Hidden Security Risks in LLM Applications
Where the Problem Sits Everyone talks about model safety. Not enough people talk about what happens when the input itself is the weapon. Prompt injection is not a niche edge case. It is the most direct way to compromise an…
Identity Was Never the Real Problem. Intent Is — and Almost Nobody Is Building For It Yet
Go back through every machine-identity breach from the past eighteen months and look for the one thing they all have in common. Not the attacker. Not the industry. Not even the dollar figure. Look for what happened at the authentication…
One Stolen Key, One Stolen Token: Why Machine Identity Is Cloud-Native’s Quietest Crisis — and the Only Fix That Actually Holds
On December 2, 2024, a security vendor called BeyondTrust noticed something wrong inside its own AWS account. By the time the investigation closed, the story that emerged was almost absurdly simple for something with this much fallout: an attacker —…
Can Rust Have Zero-Cost Dependency Injection?
Overview This article explores whether dependency injection (DI) can exist in Rust without sacrificing the language’s core philosophy of zero-cost abstractions. We will approach the question from three angles: This article has been indexed from DZone Security Zone Read the…
An Ingredient List Doesn’t Stop the Worm: What SBOMs Can and Can’t Do
On March 28, 2024, a Microsoft engineer named Andres Freund noticed something almost nobody would have bothered chasing: SSH logins on a system he was benchmarking were taking 500 milliseconds instead of the usual 100. He ran a memory profiler…
The New Insider Threat Isn’t Human: Securing AI Agents Before They Secure Themselves
In mid-September 2025, engineers inside Anthropic’s threat intelligence team noticed something that didn’t fit the usual pattern of automated probing on their platform. Ten days of digging later, they had a name for it: GTG-1002, a Chinese state-sponsored group that…
Two Clocks Are Running Out at Once, and Almost Nobody Is Watching Both
Every CISO I talk to right now is juggling two deadlines that feel unrelated and aren’t. One is the slow-motion arrival of quantum computers capable of breaking the public-key cryptography that underpins basically everything — TLS, SSH, JWTs, code-signing. The…
Sharing SBOMs Securely Without Giving Too Much Away
SBOMs Create Transparency, But Not Without Risk The Software Bill of Materials, or SBOM, has changed meaning in recent years. It used to be seen as a technical tool for internal inventory management. It is now required as evidence due…
Your Biggest Identity Problem Isn’t Your Employees Anymore; It’s Everything Else
I used to open identity audits by asking a CISO how many users were on their network. These days, I ask a different question first: how many non-human identities do you have, and when was the last time anyone counted?…