IAM Engineer: 2026-09-30

7 minutes in total

Beyond source code: A path to the keys to the kingdom
Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Read, 6 min.
Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.
Why it matters for this role: Monitor password reset activity for repeated attempts or resets across many users, because Storm-3068 got into a user account through a self-service password reset.
Cloud SQL for PostgreSQL release notes: September 28, 2026
Google Cloud, 2026-09-28. Read, 1 min.
Google Cloud removed the cloudsql.instances.export permission from the Cloud SQL Viewer, Basic Reader, and Basic Viewer (Legacy) roles to improve security, a change its release notes label breaking. To keep export capability, principals need the Cloud SQL Editor role or a custom role that includes the permission.
Why it matters for this role: Expect export failures from principals that held only Cloud SQL Viewer or the basic roles, and grant Cloud SQL Editor or a custom role with the export permission where the need is real.