Results for “least-privilege”

Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.

AL permission set design for Business Central. Use when creating PermissionSets, implementing least-privilege access, or designing security models for extensions.

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles.

Finds the minimal Azure role that meets desired permissions and generates CLI commands or Bicep code to assign it.

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.

Audit, create, and monitor GCP VPC firewall rules to enforce network segmentation and least-privilege access.

Elevate from a low-privilege user account to root access on a compromised Linux system by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions.

Security Craft

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.

Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.

Map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads using Akamai Guardicore Segmentation.

Identify and test IAM misconfigurations that allow privilege escalation in AWS environments using Pacu, CloudFox, Principal Mapper, and manual analysis.

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

Mine a codebase or product for underexploited assets — capabilities, infrastructure, data, integrations, and workflows built for one narrow purpose that could produce far more value. Finds platform primitives hiding inside features, internal tooling that could serve customers, and data accumulated but never leveraged. Produces an evidence-gated report (max 5 opportunities, mandatory kill list, one forced answer) plus a wwbd_packet JSON. Use whenever the user says "WWBD", "what would Bezos do", "what are we sitting on", "what did we accidentally build", "what could this become", "find opportunities in this repo", "what are we underexploiting", "is there a product hiding in here", or wants to know if existing infrastructure has a bigger economic surface than it currently serves. Trigger on casual phrasings too ("anything valuable buried in this codebase?"). Analyzes what EXISTS — missing features go to gap-scan, broken code to code-audit, confusing flows to ux-audit, weak persuasion to conversion-audit.

API Security (Minimal)

Manage AWS Identity and Access Management for users, roles, policies, and permissions. Create IAM policies, configure cross-account access, set up service roles, troubleshoot permission errors, and enforce least-privilege security.

Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions) by enforcing least privilege IAM roles, eliminating hardcoded secrets, scanning dependencies for vulnerabilities, validating input, securing function URLs, and enabling runtime monitoring.