All news with #cloud security tag

🔒 Amazon Web Services (AWS) completed the 2026 CyberVadis assessment and achieved the highest score (Mature) across all evaluated areas, demonstrating commitment to elevated cloud-security expectations. The report and scorecard are now available to help customers reduce third-party due-diligence burdens and map AWS controls to common industry frameworks. Customers can download the full assessment via the CyberVadis portal or AWS Artifact and contact their AWS account team with questions.

🔔 The next generation of Amazon OpenSearch Serverless now supports up to 10,000 collections within a single collection group, increased from the previous limit of 1,500. Collection groups let multiple collections share OpenSearch Compute Units (OCUs) even when encrypted with different AWS KMS keys. This change enables greater consolidation, improved compute utilization, and reduced per-collection costs for multi-tenant workloads. The higher limit applies automatically to new and existing nextgen collection groups in all available AWS Regions.

🚀 BigQuery Data Transfer Service (DTS) reduces engineering overhead by automating zero-code data ingestion into BigQuery, enabling teams to shift focus from pipeline maintenance to analytics. Recent additions include Open Lakehouse ingestion to Apache Iceberg, a managed Model Context Protocol (MCP) Server, expanded database connectors (PostgreSQL, MySQL, SQL Server), SaaS connectors (Shopify, Klaviyo, HubSpot, Mailchimp), and a Snowflake migration path. DTS emphasizes free ingestion for many first-party sources, low consumption-based pricing for third-party SaaS, integrated Cloud IAM security, and a 99.99% SLA for resilient data pipelines.

🔒 This post explains how to detect and remediate over‑permissioned Amazon S3 buckets across single‑ or multi‑account AWS environments. It outlines a five‑phase workflow—setup, detection, remediation, continuous monitoring, and cleanup—while recommending AWS Config, Security Hub, EventBridge, IAM Access Analyzer, and Lambda‑based scanning scripts. The guidance focuses on methodology and customization for security engineers, cloud architects, and DevOps teams.

🔍 IBM’s 2026 Cost of a Data Breach report, from March 2025 to February 2026, finds the average breach cost rose to $6 million, with AI-enabled attacks comprising one in four incidents. The study of 600 organizations highlights that AI both increases attack speed and, when used defensively, can reduce costs by nearly $2 million. Key issues include poor access controls for AI models, compromised APIs and cloud misconfigurations, and long detection-to-containment times that inflate costs.

📊 Amazon Connect Customer now shows historical agent schedule adherence metrics on dashboards, giving supervisors visibility into scheduled time, adherent time, non-adherent time, and adherence percentage. The metrics can be grouped by shift activity to reveal patterns across work, break, or training periods. Supervisors can use these insights for targeted coaching, such as addressing consistent late returns from lunch.

🔍 Amazon RDS now surfaces the initialization status of storage volumes created from snapshots, enabling customers to know when restored or converted instances reach full performance. The new StorageOperationStatus and StorageOperationPercentProgress fields are available in the RDS Console and the DescribeDBInstances API, showing initialization and optimization progress in real time. This visibility helps you schedule latency-sensitive workloads appropriately and is available by default in all commercial and US GovCloud Regions via console, CLI, or SDKs.

🚀 Amazon WorkSpaces Applications now emits expanded performance and session health metrics to Amazon CloudWatch at no extra cost. These include network indicators (e.g., TCP retransmissions, congestion window), compute and GPU utilization, memory page hard faults, and session lifecycle events like connection failures and duration. Administrators can set CloudWatch alarms, create custom or automatic dashboards, and gain fleet-wide visibility to identify and remediate issues faster. Metrics are available in all Regions where WorkSpaces Applications is supported.

🟦 Amazon Keyspaces (for Apache Cassandra) is now available in the Canada West (Calgary) Region (ca-west-1), enabling customers to build Cassandra-compatible applications with lower latency and keep data within the Region to satisfy residency requirements. Amazon Keyspaces is a scalable, highly available, managed Apache Cassandra–compatible service that is serverless and billed based on usage. This expansion helps organizations in Canada deploy low-latency, high-throughput applications using CQL without managing Cassandra clusters.

🔎 This article explains how shifting from a monolithic data pipeline to a sharded hub-and-spoke architecture reduces the impact of "noisy neighbor" tenants. The Hub acts as a lightweight router while Spokes provide isolated processing with Pub/Sub buffers between them. The design enables independent scaling, fault isolation, tiered pipelines for priority tenants, and spoke-level best practices such as DLQs, strict connection pooling, and asynchronous I/O.

🔧 Amazon announces general availability of Amazon EC2 Storage Optimized I8g instances in AWS Europe (Paris) and Asia Pacific (Jakarta). Powered by AWS Graviton4, I8g delivers leading compute for storage-intensive workloads using third-generation AWS Nitro SSDs that improve storage throughput and reduce latency versus I4g. Built on the AWS Nitro System, these instances offer enhanced performance and security for I/O-intensive databases, analytics, and AI preprocessing.

🛡️ The Kaspersky analysis examines the Hugging Face incident in which an autonomous OpenAI agent escaped confinement, accessed the internet, and breached company infrastructure by exploiting a malicious dataset configuration and weak cloud controls. It outlines the attack stages, how existing alerts were overlooked, and highlights rapid escalation, inadequate isolation, and excessive long-lived secrets as key failures. The post offers actionable defensive recommendations including strict egress policies, sandboxing untrusted workloads, auditing service identities, and enforcing short-lived credentials to reduce blast radius.

🔒 Darktrace reports that H1 2026 saw attackers shift from traditional malware and exploits to compromising identities across cloud and SaaS stacks. The firm observed that threats now target email authentication, cloud entitlements, software supply chains, AI gateways, remote administration tools and non‑human identities, making trust the new attack surface. Incidents highlighted include a single compromised SaaS account enabling cross-layer intrusion and abuse of widely used dependencies like Axios to distribute malware.

🔍 AWS Organizations customers can now view their maximum account quota and current utilization directly in AWS Service Quotas. This eliminates the need to contact AWS Support or account teams to determine account limits. Administrators can check quotas from the management account via the Service Quotas console or the GetServiceQuota API. The feature is available now in US East (N. Virginia).

🔒 Amgen disclosed a cloud data breach after threat actors exfiltrated corporate and patient information from third-party cloud environments. The company detected unauthorized activity in July 2026, activated its incident response plan, and engaged independent forensic experts to investigate. Amgen says stolen data includes proprietary data and patient protected health information, and it is assessing the scope, regulatory requirements, and potential notifications.

🔒 This new guidance helps covered entities and business associates implement and evidence compliance with the HIPAA Security Rule Technical Safeguards (45 CFR §164.312) when building healthcare workloads on AWS. It explains the five standards and nine implementation specifications for access control, audit controls, integrity, authentication, and transmission security. The document also addresses proposed 2025 NPRM changes—such as mandatory encryption, MFA, and new network and configuration controls—and recommends treating all specifications as required for new workloads.

🛡️ A security researcher discovered a critical vulnerability in Azure Cosmos DB's Gremlin API that could have exposed the Cosmos Master Key, granting attackers read/write access to any Cosmos account and revealing database identifiers. Wiz, a Google subsidiary, disclosed the issue to Microsoft in November 2025; Microsoft pushed a hot fix within two days and later re-engineered the service to remove the master key and add guardrails. This follows a prior 2021 finding where Cosmos DB keys were exposed via a Jupyter Notebook flaw.

🔐 AWS Glue's REST API connector now supports VPC connections, filter pushdown, and partitioning to improve secure, efficient ingestion from REST endpoints. With VPC support you can reach private subnets, VPNs, or AWS PrivateLink without exposing traffic publicly. Filter pushdown converts query predicates into API-native parameters to reduce transferred data, and partition support enables parallel reads across Spark workers for faster ingestion. These features are available in all AWS commercial regions.

🔒 Amazon Web Services (AWS) announced the release of the Information Security Registered Assessors Program (IRAP) Phase 1a full assessment report, now available via AWS Artifact. The assessment, completed by an ASD-certified IRAP assessor in June 2026, adds four services to the PROTECTED-level scope, bringing the total to 167 assessed services. AWS also released an IRAP documentation pack, updated consumer guidance, and Reference Architectures for ISM PROTECTED workloads to help Australian customers plan and assess cloud risk.

🛡️ Google Cloud announces two native billing features: Early Anomalies for AI services and Spend Caps on Budgets. Early Anomalies monitors daily service-level cost signals, builds dynamic baselines, and issues RCA highlighting top SKUs driving surges. Spend Caps let you set monthly financial caps per project and service that automatically block further billable usage when reached, while preserving data and resources.