Cloud environments were built for seamless access — and that's precisely what makes them a prime target. This episode of Cybersecurity examines the specific techniques attackers use to steal data from cloud infrastructure while evading the security tools most organizations rely on, drawing on this in-depth analysis of cloud data exfiltration tactics and defenses. The conversation cuts through vendor-speak to explain why perimeter-based thinking consistently fails in distributed cloud ecosystems — and what a more effective posture actually looks like.

The episode covers a wide range of attack vectors and defensive gaps, including:

• Credential abuse and session hijacking — Attackers rarely "break in"; they log in using stolen credentials, phished tokens, or OAuth refresh tokens that persist long after initial compromise, blending into normal traffic that traditional tools can't distinguish from legitimate use.
• API and OAuth vulnerabilities — Over-permissioned APIs, weak input validation, and long-lived refresh tokens give patient attackers persistent, low-noise access that most SIEMs under-log or miss entirely.
• The dissolved perimeter — With ephemeral workloads and microservices communicating across namespaces, there is no meaningful network edge left to guard; data exits through allowed pathways that look indistinguishable from normal business traffic.
• Misconfiguration and shadow IT — Exposed storage buckets and employee-provisioned, security-team-invisible cloud tools remain alarmingly common, each representing an unmonitored pathway into (and out of) the environment.
• Serverless and container risks — Ephemeral serverless functions can execute a full data-extraction routine and vanish before logging captures them; Kubernetes misconfigurations — public dashboards, over-permissive service accounts — let attackers pivot across namespaces and erase their tracks.
• Zero Trust and cloud-native detection — Genuinely implemented identity-based access control, continuous authentication, runtime behavioral analysis, and anomaly detection across cloud security workloads are positioned not as optional upgrades but as minimum requirements for catching exfiltration in progress.

A recurring theme throughout the episode is the danger of retrofitting legacy on-premises security tools onto cloud-native architectures. Static DLP rules, fixed heuristics, and perimeter firewalls were designed for a world that no longer exists — and attackers are fully aware of those blind spots. The shared responsibility model means cloud providers secure the infrastructure; everything above that layer is the organization's problem to solve. Robust attack surface monitoring that extends into APIs, serverless functions, container environments, and shadow IT infrastructure is what separates organizations that detect exfiltration early from those that discover it in a breach notification.

For more on related supply-chain and pipeline risks, check out the episode CI/CD Pipeline Hijacking: How Attackers Get In and How to Stop Them. Additional resources are available on the RMA blog.

RMA.ai

Modern software delivery pipelines are fast, automated, and increasingly in attackers' crosshairs. This episode of Cybersecurity examines CI/CD pipeline hijacking — an attack vector that lets adversaries ride trusted automation all the way to production, often without triggering a single traditional security alert. Drawing from this in-depth RMA.ai breakdown on pipeline hijacking detection and prevention, the episode offers a stage-by-stage look at where pipelines break down and how defenders can close those gaps systematically.

Here's what the episode covers:

• Why pipelines are high-value targets: Modern CI/CD environments hold API tokens, cloud credentials, signing certificates, and environment secrets — all connected directly to source code and production infrastructure. A single compromised link can hand an attacker a trusted, signed path to end users.
• Where the vulnerabilities actually live: The episode maps four critical stages — source code management, build and test environments, artifact storage and dependency management, and the deployment layer — explaining how each can be exploited and why build systems are often far less instrumented than customer-facing assets.
• Early detection signals to watch for: From unexpected OAuth app authorizations and off-hours SSH key additions in source control, to runners spawning interactive shells and large outbound transfers from build servers, the episode details concrete behavioral indicators that something has gone wrong — and when each signal should trigger immediate investigation.
• Hardening controls at every pipeline stage: The episode walks through practical defenses including hardware-based MFA and signed commits at the source layer; ephemeral sandboxed build nodes and runtime secret injection for build infrastructure; SLSA provenance requirements and software bill of materials tooling for artifact management; and policy-as-code admission controllers plus eBPF-based sensors at deployment. Tools like Kyverno, OPA Gatekeeper, and Sigstore's cosign all get called out specifically.
• The role of cloud security posture: Detecting drift between declared Infrastructure-as-Code state and what's actually running in cloud environments is highlighted as one of the most reliable signals that something changed without authorization — making continuous cloud security monitoring a natural complement to pipeline defenses.
• Culture as a control: Technical measures alone aren't enough. The episode argues for a Secure DevOps mindset where developers threat-model pipeline features, security teams collaborate on post-mortems, and pipeline audit dashboards give every team visibility into who merged what and how it was built.

The central argument is simple and hard to argue with: a CI/CD pipeline is a security perimeter, and it deserves the same layered, rigorously monitored attention as a network edge or endpoint environment. The episode closes with a clear call to action — identify your highest-risk pipeline junctures, instrument what you currently can't see, and build the cross-functional culture that keeps pipeline security from falling through the cracks.

For more from the show, check out BIOS and UEFI Rootkits: What Infrastructure Teams Need to Know, which explores another deeply embedded and often overlooked attack surface. You can also find additional cybersecurity research and analysis on the RMA blog.

RMA.ai

Firmware is the first software to run on every machine in your fleet — and one of the last places most security programs look. This episode of Cybersecurity tackles one of the most technically daunting threats facing infrastructure teams today: BIOS and UEFI rootkits. Drawing on the RMA.ai infrastructure-focused firmware rootkit primer, the episode translates low-level firmware concepts into actionable guidance for engineering managers, SREs, and security leaders — no chip-design expertise required.

The episode walks through why firmware-layer threats are categorically different from conventional malware, how modern UEFI architecture creates both protections and attack surface, and what a realistic defense and response program actually looks like. Key areas covered include:

• Why firmware rootkits are so dangerous: Unlike OS-layer malware, they survive disk wipes, OS reinstalls, and reimaging — and can silently reinfect a clean operating system before security tools even start.
• How attackers gain a foothold: Three primary vectors — supply chain and update abuse, exploitation of firmware interfaces such as System Management Mode and option ROM handlers, and physical access to hardware debug ports or configuration jumpers.
• What implants do once installed: UEFI implants hook early boot services, patch kernel loaders in memory, target SMM for maximum privilege, or manipulate NVRAM variables — all while bypassing or disabling the security controls that come to life later in the boot sequence.
• Detection through attestation: Capturing golden measurements on clean systems, using TPM-based Measured Boot, and continuously comparing hashes through remote attestation — rather than trusting a potentially compromised OS to self-report.
• Hardening priorities: Properly configuring Secure Boot with current keys and no unnecessary fallback paths, enabling SPI flash write protections and Boot Guard, enforcing BIOS/UEFI admin passwords, and patching firmware from authenticated sources with staged validation in lab environments. Endpoint monitoring that extends into the firmware layer is essential to catching drift before it becomes a crisis.
• Incident response sequence: Isolating the host, capturing firmware images via trusted external methods, comparing against golden measurements before taking any remediation action, and — if trust cannot be restored — retiring the hardware entirely. Teams managing complex environments can benefit from a structured incident response workflow that accounts for firmware-layer scenarios.

The episode closes with an organizational lens: tracking firmware versions as first-class inventory data, building procurement criteria around vendor transparency on boot protections, maintaining a small hardware lab capable of controlled flash extraction, and planning proactively for end-of-life devices that can quietly become persistent liabilities.

For more on supply chain and boot-integrity topics, check out the episode Binary Provenance and SBOM Verification in Practice. The full written guide this episode is based on is available on the RMA blog.

RMA.ai