After a wave of credential stuffing against our login endpoint arrived mostly through Tor and anonymising proxies, we added IP reputation controls in AWS WAF. When blocking Tor is reasonable and when it is not, which managed rule groups to use, why we started in count mode, and how we handled false positives.
Zero trust and threat modeling are often presented as frameworks for large organisations. Both are simple ideas for any team: never trust the network, verify every request, and find threats on a whiteboard before production. With a STRIDE threat model of a real file upload feature.
Most DevSecOps advice starts at the pipeline: scanners, gates, signatures. The cheapest security fixes happen earlier, while a feature is still a ticket. How we add security requirements, abuse cases, a lightweight design review and security acceptance criteria to everyday planning without slowing teams down.
During an investigation we needed to know who changed a security group in one of 14 AWS accounts three months earlier, and the logs were gone. How we set up one organization trail into a protected log archive account, an Athena table with partition projection, and the queries we use most.
A developer role was meant to allow everything except IAM changes. Its policy used Allow with NotAction, yet a review found it could create access keys for other users and assume an admin role. How we found it with the policy simulator and Access Analyzer, and rewrote it safely.
Most API vulnerabilities we find in reviews are missing defaults, not clever exploits: no body limits, validation on some routes, authorization in some handlers, stack traces in errors. The template we give teams starting a Node.js API, with the reasoning behind each default and code you can copy.
Many runbooks still say to run shred on sensitive files before deleting them. On SSDs, copy-on-write filesystems and cloud volumes, overwriting in place often leaves the old data elsewhere. Why, and the methods that work: encryption, crypto-erase and device sanitize commands.