Systems security, detection, cryptography and defensive infrastructure.
A computer vision system watching a shipyard, in its more advanced configurations, stops the machine. From that moment the integrity and availability of a piece of software become conditions of the physical safety of the people working there. The Triton precedent, requirement 1.1.9 of the Machinery Regulation, and what the data on ransomware-hit hospitals actually shows.
Read moreSBOMs, SLSA attestations and Sigstore keyless signing give you security only when verification is enforced in the pipeline and at runtime. Generation, transparency and enforcement, tied to the Cyber Resilience Act.
Read moreGDPR, NIS2, DORA and the AI Act ask for largely the same controls but diverge on notification thresholds and deadlines. The hard part is not the requirement list; it is the data model that links them without duplicating them.
Read moreA cloud platform that launches automated scans and pentests on user input must prove, before it touches a host, that whoever starts the scan really controls the target. Technical notes on domain validation and the boundaries of a scan.
Read moreAutonomous software introduces new attack surfaces that traditional security models are not equipped to handle.
Read moreWith the 2.4 series Security Onion collects host data from a single Fleet-managed Elastic Agent, in place of Wazuh, Beats and osquery. Technical notes on architecture, Salt orchestration and licensing.
Read moreOpenSearch 2.4 (15 November 2022) brings the experimental Security Analytics plugin: detectors, field mapping, and 2,000+ pre-packaged Sigma rules translated into queries on top of the alerting engine already present.
Read moreThe full packet capture project started at AOL in 2012 as Moloch became Arkime with the 3.0 release of July 2021. Architecture, the split between on-disk PCAP and session metadata, storage costs and operational limits.
Read moreOn 4 February 2021 the CNCF promoted Open Policy Agent to a graduated project. Technical notes on Rego, the bundle API, decision logs, and where the model starts to show strain.
Read moreOn 29 March 2020 Linux 5.6 brings WireGuard into the mainline kernel: an encrypted tunnel of a few thousand lines, non-negotiable cryptography, and a Noise IKpsk2 handshake. What changes against IPsec and OpenVPN, and what still has to be built around it.
Read moreWhen telework shifts from exception to rule in a matter of days, the VPN concentrator becomes the most exposed part of the infrastructure. Technical notes on patching, authentication and capacity, starting from CISA alert AA20-073A.
Read moreFalco reads the Linux kernel system-call stream and matches it against declarative rules to flag anomalous behaviour in running containers. Architecture, the new Kubernetes audit-event source in 0.13.0, and the limits of the model.
Read moreRFC 8446 cuts the TLS handshake to a single round-trip, makes forward secrecy mandatory and takes legacy cryptography out of the standard. Reading notes on what it means in practice for people running servers.
Read moreWith cert-manager the TLS certificate lifecycle becomes a declarative cluster resource. Project status, the CRD model, and the ACME constraints as of February 2018.
Read moreSigma is a YAML format for detection rules that a compiler translates into the search syntax of whichever SIEM is in use. Technical notes on the format, the sigmac converter, and where it breaks down.
Read moreSince 5 June 2013 the technical community has rewritten its assumptions about the network channel: RFC 7258, forward secrecy as a default, the withdrawal of Dual_EC_DRBG, Let's Encrypt. A review of the measurable changes in protocols.
Read moreOn 12 April 2016 Let's Encrypt reached general availability. Technical notes on ACME, domain validation, 90-day certificates, and the constraint that automatic renewal places on operations.
Read moreKeycloak 1.9 speaks OAuth 2.0, OpenID Connect and SAML 2.0 in a single Apache 2.0 server. Technical notes on SSO, identity brokering, LDAP federation and the limits of delegation.
Read moreRFC 7519 was published in May 2015 and fixes the JSON Web Token format. Technical notes on the structure, the registered claims, and the two classes of bug Tim McLean disclosed in March.
Read moreGraylog 1.0, released 17 February 2015, keeps the search index (Elasticsearch) separate from configuration metadata (MongoDB). Notes on GELF, syslog ingestion, streams, and extractor ordering.
Read more
