Fixed/disclosed vulnerabilities, auth bugs, hardening, CVE write-ups.
After a wave of credential stuffing against our login endpoint arrived mostly through Tor and anonymising proxies, we added IP reputation controls in AWS WAF. When blocking Tor is reasonable and when it is not, which managed rule groups to use, why we started in count mode, and how we handled false positives.
We rolled out a default-deny egress NetworkPolicy to a namespace and every pod immediately failed to resolve names, including other services in the same namespace. Policies select pods, DNS runs in kube-system, and the namespace selector needed the right label. The policy set we use now and how we test it.
A single 40-character form value froze an API worker for minutes. A nested quantifier in a validation regex made Python's backtracking engine try exponentially many paths. We show how we proved it, rewrote the pattern and added RE2 and CI checks.
The index of our security fundamentals and operations series: what to learn first, how the topics depend on each other, a practice plan with legal labs you can run yourself, and links to every part from the CIA triad to zero trust.
We enabled KMS encryption for Session Manager to meet an audit requirement and every session to our EC2 fleet failed. The instance role could not use the key, the key policy did not allow it, and private instances could not reach KMS at all. The full fix and checks.
Zero trust and threat modeling are often presented as frameworks for large organisations. Both are simple ideas for any team: never trust the network, verify every request, and find threats on a whiteboard before production. With a STRIDE threat model of a real file upload feature.
Most DevSecOps advice starts at the pipeline: scanners, gates, signatures. The cheapest security fixes happen earlier, while a feature is still a ticket. How we add security requirements, abuse cases, a lightweight design review and security acceptance criteria to everyday planning without slowing teams down.
Part 7 of the security fundamentals series. Firewalls, intrusion detection and prevention, VPNs and forward and reverse proxies compared by what they can see, what they can stop, where they sit, and the misconfigurations we find most often.
Part 6 of the security fundamentals series. Authentication versus authorization, the MFA factors and which ones resist phishing, and the four access control models with code-level examples, least privilege and access reviews.
A few percent of logins failed with a generic error after we added a Cognito post-authentication trigger that recorded login events in our database. The Lambda ran in a VPC, opened a database connection on cold start, and sometimes exceeded Cognito's 5-second trigger timeout. How we moved the work off the login path.
A security review of a legacy customer portal found the password column was only Base64-encoded. Here is how we confirmed it, why encoding is not encryption, and how we moved 180,000 accounts to Argon2id with rehash-on-login and a targeted reset.
Part 5 of the security fundamentals series. Encoding, encryption, hashing, MACs and digital signatures compared by purpose and reversibility, symmetric versus asymmetric keys, and how TLS combines them all in one connection.
During an investigation we needed to know who changed a security group in one of 14 AWS accounts three months earlier, and the logs were gone. How we set up one organization trail into a protected log archive account, an Athena table with partition projection, and the queries we use most.
Agent skills, plugins and MCP servers extend coding and productivity agents with instructions and scripts. Installing one gives its author influence over what your agent reads, writes and runs. The risks we found reviewing community skills, a review checklist, and the sandboxing and policy controls we use.
Part 4 of the security fundamentals series. Malware families, phishing, denial of service, man-in-the-middle and injection explained by the signs you would notice and the controls that stop them, without any attack instructions.
Part 3 of the security fundamentals series. Threat, vulnerability, exploit, impact and risk defined with one running example, why a CVSS score is not your risk, and a small risk register you can start this week.
A developer role was meant to allow everything except IAM changes. Its policy used Allow with NotAction, yet a review found it could create access keys for other users and assume an admin role. How we found it with the policy simulator and Access Analyzer, and rewrote it safely.
Part 2 of the security fundamentals series. The networking concepts you need to reason about exposure: IP and MAC addresses, ports, TCP versus UDP, common services, and how to see what your own hosts are listening on.
A security review found refresh tokens sitting in plain text in our Flutter app's preferences file. This guide sorts local data into three buckets, explains what shared_preferences, Hive (and its maintained hive_ce fork) and flutter_secure_storage actually do on each platform, and covers the uninstall and backup traps.
Part 1 of the security fundamentals series. What cybersecurity actually covers, how it differs from information security, and how confidentiality, integrity and availability map to the code and systems you build every day.
The incident response lifecycle turned into a runbook a small team can follow under pressure: preparation, detection and analysis, containment, eradication, recovery and the post-incident review, with roles, evidence handling and communication templates.
A SIEM is only as good as the logs you feed it and the alerts someone answers. How to build a security monitoring pipeline step by step, which log sources come first, ten detections worth writing on day one, and how to keep alert fatigue away.
Scanners produce thousands of findings and teams drown. A vulnerability management lifecycle that works for a small security function: asset discovery, scanning, prioritisation with CVSS, EPSS and the KEV catalog, remediation SLAs and verification.
Phishing, spear phishing, whaling and business email compromise explained by how they reach people, then the technical controls and the one process change, out-of-band payment verification, that stops the most expensive email fraud.
Laptops and servers are where most attacks land. A practical, layered endpoint security programme for a small company: inventory, patching, hardening baselines, EDR, disk encryption, application control and what to do when a device is lost.