We enabled KMS encryption for Session Manager to meet an audit requirement and every session to our EC2 fleet failed. The instance role could not use the key, the key policy did not allow it, and private instances could not reach KMS at all. The full fix and checks.
The incident response lifecycle turned into a runbook a small team can follow under pressure: preparation, detection and analysis, containment, eradication, recovery and the post-incident review, with roles, evidence handling and communication templates.
A SIEM is only as good as the logs you feed it and the alerts someone answers. How to build a security monitoring pipeline step by step, which log sources come first, ten detections worth writing on day one, and how to keep alert fatigue away.
Scanners produce thousands of findings and teams drown. A vulnerability management lifecycle that works for a small security function: asset discovery, scanning, prioritisation with CVSS, EPSS and the KEV catalog, remediation SLAs and verification.
Phishing, spear phishing, whaling and business email compromise explained by how they reach people, then the technical controls and the one process change, out-of-band payment verification, that stops the most expensive email fraud.
Laptops and servers are where most attacks land. A practical, layered endpoint security programme for a small company: inventory, patching, hardening baselines, EDR, disk encryption, application control and what to do when a device is lost.
A researcher reported that CSV exports with customer emails were downloadable from an S3 bucket. The cause was a bucket policy granting public read, added years earlier for a static site. How we contained it, proved who accessed what, and locked down every bucket.
Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.