Posts tagged Cybersecurity.
SBOMs, SLSA attestations and Sigstore keyless signing give you security only when verification is enforced in the pipeline and at runtime. Generation, transparency and enforcement, tied to the Cyber Resilience Act.
Read moreGDPR, NIS2, DORA and the AI Act ask for largely the same controls but diverge on notification thresholds and deadlines. The hard part is not the requirement list; it is the data model that links them without duplicating them.
Read moreA cloud platform that launches automated scans and pentests on user input must prove, before it touches a host, that whoever starts the scan really controls the target. Technical notes on domain validation and the boundaries of a scan.
Read moreAutonomous software introduces new attack surfaces that traditional security models are not equipped to handle.
Read moreWith the 2.4 series Security Onion collects host data from a single Fleet-managed Elastic Agent, in place of Wazuh, Beats and osquery. Technical notes on architecture, Salt orchestration and licensing.
Read moreOpenSearch 2.4 (15 November 2022) brings the experimental Security Analytics plugin: detectors, field mapping, and 2,000+ pre-packaged Sigma rules translated into queries on top of the alerting engine already present.
Read moreThe full packet capture project started at AOL in 2012 as Moloch became Arkime with the 3.0 release of July 2021. Architecture, the split between on-disk PCAP and session metadata, storage costs and operational limits.
Read moreOn 4 February 2021 the CNCF promoted Open Policy Agent to a graduated project. Technical notes on Rego, the bundle API, decision logs, and where the model starts to show strain.
Read moreOn 29 March 2020 Linux 5.6 brings WireGuard into the mainline kernel: an encrypted tunnel of a few thousand lines, non-negotiable cryptography, and a Noise IKpsk2 handshake. What changes against IPsec and OpenVPN, and what still has to be built around it.
Read moreWhen telework shifts from exception to rule in a matter of days, the VPN concentrator becomes the most exposed part of the infrastructure. Technical notes on patching, authentication and capacity, starting from CISA alert AA20-073A.
Read moreFalco reads the Linux kernel system-call stream and matches it against declarative rules to flag anomalous behaviour in running containers. Architecture, the new Kubernetes audit-event source in 0.13.0, and the limits of the model.
Read moreRFC 8446 cuts the TLS handshake to a single round-trip, makes forward secrecy mandatory and takes legacy cryptography out of the standard. Reading notes on what it means in practice for people running servers.
Read moreWith cert-manager the TLS certificate lifecycle becomes a declarative cluster resource. Project status, the CRD model, and the ACME constraints as of February 2018.
Read moreSigma is a YAML format for detection rules that a compiler translates into the search syntax of whichever SIEM is in use. Technical notes on the format, the sigmac converter, and where it breaks down.
Read moreSince 5 June 2013 the technical community has rewritten its assumptions about the network channel: RFC 7258, forward secrecy as a default, the withdrawal of Dual_EC_DRBG, Let's Encrypt. A review of the measurable changes in protocols.
Read moreOn 12 April 2016 Let's Encrypt reached general availability. Technical notes on ACME, domain validation, 90-day certificates, and the constraint that automatic renewal places on operations.
Read moreKeycloak 1.9 speaks OAuth 2.0, OpenID Connect and SAML 2.0 in a single Apache 2.0 server. Technical notes on SSO, identity brokering, LDAP federation and the limits of delegation.
Read moreRFC 7519 was published in May 2015 and fixes the JSON Web Token format. Technical notes on the structure, the registered claims, and the two classes of bug Tim McLean disclosed in March.
Read moreGraylog 1.0, released 17 February 2015, keeps the search index (Elasticsearch) separate from configuration metadata (MongoDB). Notes on GELF, syslog ingestion, streams, and extractor ordering.
Read moreOn 29 October 2014 Facebook released osquery, which exposes a system's processes, sockets and files as queryable SQL tables. Technical notes on its architecture and limits.
Read moreMISP grew out of Belgium's CyDefSIG in 2013 and is maintained by CIRCL: an event-and-attribute data model, export to Snort/Suricata and OpenIOC, and synchronisation between instances. Notes on the emerging STIX and TAXII formats and on the limits of trust between organisations.
Read moreThe Open Information Security Foundation released Suricata 1.0 in July 2010: an intrusion detection engine rewritten in C with a multi-threaded architecture, port-independent protocol recognition and Snort rule compatibility. Technical notes on what changes against the single-threaded model.
Read moreWireshark 1.0 shipped on 31 March 2008. The architecture weighs more than the version number: over a thousand protocol parsers reading hostile input, and the privilege separation that contains the damage.
Read moreCentralising authentication on OpenLDAP does not remove the credential problem: it moves it from the local password to the channel and the directory's configuration. A technical note on slapd, syncrepl, SASL/TLS and the places where security is actually decided.
Read moreWhat it takes to connect a Python application to a card payment gateway that ships SDKs only for ASP, PHP and Java: a server-side encrypted handshake, a shared secret, HTTP GET transport, and the card number that never touches the shop.
Read more
