18 matching entries across Articles, TIL and Projects.
Long-form writing tagged Security.
A design review measured this site's homepage at 18.1KB. Re-measured cold two weeks later, it was 42KB — partly from changes to the page, and partly from the largest single item on the page, an analytics script that in-page measurement reports as zero bytes.
Most of what I learn professionally cannot be published as it stands. The method I use to separate the transferable lesson from the confidential artifact, why redaction is the wrong tool, and the checklist that enforces it.
Building an Ubuntu engineering laptop where the disk encryption, credential storage and boot behaviour are decisions rather than defaults: TPM2-backed LUKS unlock, a separate encrypted work volume, and an honest account of what each choice does and does not protect.
How I used a Cloudflare Worker to enrich Gateway blocks with policy, device, user, category and Cloudflare One Client context while keeping the page resilient and secure.
A practical implementation sequence for SAML SSO in Microsoft Entra ID, including claims, assignments, certificate lifecycle, testing and rollback.
A practical DevSecOps pipeline for infrastructure changes: validate early, protect credentials, inspect plans, approve risk and retain deployment evidence.
Enterprise browsers move enforcement into the user session. Network-centric Zero Trust still owns critical controls such as DNS, routing and non-browser traffic. The interesting architecture is often the combination.
Zero Trust is not resilient just because it is cloud-hosted. Identity, posture, policy, tunnels, DNS and SaaS authentication all create failure domains that need deliberate recovery paths.
The study approach I used for CISSP and CCSP: ISC2 official material, instructor-led training, practice questions, Pete Zerger's Last Mile resources, and more than 20 years of practical experience.
Short notes and fixes tagged Security.
Uncommenting the stock localnet ACL so a lab network can reach a proxy also admits every other private range, including the wifi the laptop happens to be sitting on.
For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.
For dynamically generated security pages, I use a per-response nonce so required inline script/style can run without falling back to a broad unsafe-inline CSP.
A CF-Ray header alone does not prove a request came from Gateway, so my Worker requires Gateway-specific query context before rendering diagnostic output.
A simple pre-push check for seeing changed, unstaged and staged content before it reaches a public repository.
When a local script is blocked by execution policy, Process scope can be useful for a temporary session without changing the machine-wide setting.
Before creating an emergency bypass, work out whether the failure is identity, posture, policy, DNS, tunnel or origin.
Projects and implementation patterns tagged Security.
Four scheduled agent runs that read a calendar, mailbox, chat workspace and ticket system and write structured sections into two Obsidian vaults — governed by one rules file, a read-only tool allowlist, and capture routes from laptop, phone and paper.
A Cloudflare Worker that enriches Gateway blocks with rule names, request category, user, device, Cloudflare One Client addresses and support correlation data.
