Avoiding a Leaky Kubernetes Audit Policy: Real-World Configuration Breakdown
Kubernetes Audit Policy is one of those artifacts that gets written once during initial cluster setup and then lives unchanged for years, gradually accumulating exceptions for new components and rarely undergoing a complete review.
In practice this turns the policy from a security control into an archaeological layer filled with comments such as "# temporary, TODO remove" that are three years old or older.
Recently the author re-examined their own configuration file, which had grown to approximately 580 lines. The policy was assembled from several sources, with the Kubernetes Threat Matrix serving as the main reference.
This origin explains why many rules are not limited to noise reduction but are specifically aimed at catching security-significant actions, including changes to RBAC objects and deletion of events.
The article stresses that without periodic holistic reviews, audit policies lose their effectiveness and fail to provide meaningful detection against targeted threats.
Related articles
CryptoPro Develops CryptoPro-Browser with Russian Cryptography for FSB Compliance
CryptoPro is creating its own browser called CryptoPro-Browser as part of the CryptoPro CSP 6.0 cryptographic information protection system. The product will include built-in cryptographic tools, support for the company's plugin, and TLS connections using Russian cryptographic algorithms. The development follows Google's removal of the CryptoPro extension from the Chrome Web Store in February 2025, which left new users without an easy installation method. The project has been coordinated with the FSB of Russia and targets scenarios requiring compliance with Russian information security regulations. CryptoPro plans to incorporate experience from its earlier Chromium-Gost project started in 2017, while also recommending Yandex Browser as an alternative. Analysts estimate the development cost at several tens of millions of rubles, with the main focus on corporate customers needing certificate management and specialized support.
Yandex 360 Email Archive Documentation Shows Search Snapshots and Former Employee Log Filters
The Yandex 360 administrator guide describes the email archive as a tool that stores copies of all messages sent and received by employees on the organization's domain. Two specific statements in the documentation indicate that each saved search returns a static snapshot that does not update automatically when new mail arrives, requiring manual cloning or recreation of the search to obtain current results. The same documentation states that the action log records every operation performed in the archive, yet the employee filter in the log interface only displays currently active accounts, making it impossible to select a former administrator by name. API 360 currently provides no documented endpoints for creating, executing, or retrieving archive searches, leaving all operations dependent on the web console. Additional notes clarify that messages remain available after an account is blocked but disappear once the account is deleted, and that messages removed before the archive was enabled cannot be recovered. These documented behaviors directly affect incident response and offboarding procedures that rely on historical email retrieval and audit trails.
Global AI Regulation: From Strict School Bans to Unregulated AI Havens
Countries are adopting sharply different approaches to AI oversight, ranging from comprehensive risk-based frameworks to outright prohibitions on generative tools in education. The United States relies on a patchwork of state laws and presidential actions, including Texas TRAIGA restrictions on high-risk AI systems and New York’s moratorium on generative AI in grades 2–8. The European Union enforces the AI Act with four risk categories, while Italy adds criminal liability and human oversight requirements in critical sectors. Norway and China have implemented some of the strictest classroom and content-authenticity rules, and Russia introduced its first baseline AI law defining sovereign models effective September 2026. Several nations have also blocked popular chatbots such as ChatGPT, DeepSeek, and Grok. Meanwhile, commercial platforms like FinamX continue integrating multiple AI models into financial workflows despite the regulatory tightening.
How Russian Companies Can Legally Transfer Personal Data to Contractors Under 152-FZ
The article explains the legal distinction between data processors and independent operators when outsourcing tasks involving personal data. It details that the role of a contractor is determined by who sets the processing purpose, not by the service contract itself. For processors, a detailed data processing instruction under Article 6 of 152-FZ is required, while independent operators need a separate legal basis such as consent or contract performance. Special rules apply to employee data under Article 88 of the Labor Code, mandating written employee consent for transfers to third parties. The guidance also covers sub-processing risks, transparency obligations, and penalties under Article 13.11 of the Code of Administrative Offenses. Practical checklists help organizations classify contractors and prepare the correct documentation.