security made simple
Yesterday I wrote about moving autonomous-agent secrets out of a flat .env file. Why I kept Vaultwarden for people and recovery, added HashiCorp Vault for workloads, and treated identity, audit, PKI, and tested recovery as part of the deployment rather than follow-up work.
For a long time, my autonomous agent found credentials the same way many applications do. Why I replaced a flat environment file with scoped Vaultwarden access, short-lived agent sessions, and a verified audit trail that now reaches Graylog and Wazuh.
Most of the storage I have bought across my career came from a few of the usual vendors, and most of it worked. It also came with things I could not source elsewhere, firmware that refused drives and software layer I paid for every year whether I used it or not. The Pro15 is a different animal...
After years of working, teaching, writing in this field, the pattern I see most in newcomers is not lack of ability. It is freezing...
I spend my working hours telling teams how to do security well. Segment the network. Write the change down. Model the threat before you build the control. Then I go home, and if I am honest with myself, the temptation is to cut every one of those corners because it is "just the lab."
Yesterday I wrote about moving autonomous-agent secrets out of a flat .env file. Why I kept Vaultwarden for people and recovery, added HashiCorp Vault for workloads, and treated identity, audit, PKI, and tested recovery as part of the deployment rather than follow-up work.
For a long time, my autonomous agent found credentials the same way many applications do. Why I replaced a flat environment file with scoped Vaultwarden access, short-lived agent sessions, and a verified audit trail that now reaches Graylog and Wazuh.
Most of the storage I have bought across my career came from a few of the usual vendors, and most of it worked. It also came with things I could not source elsewhere, firmware that refused drives and software layer I paid for every year whether I used it or not. The Pro15 is a different animal...
After years of working, teaching, writing in this field, the pattern I see most in newcomers is not lack of ability. It is freezing...
I spend my working hours telling teams how to do security well. Segment the network. Write the change down. Model the threat before you build the control. Then I go home, and if I am honest with myself, the temptation is to cut every one of those corners because it is "just the lab."
I have taught this material before as two sessions, and I usually open each session the same way: this is not a tool class. Tools get named below, plenty of them, but every one is an implementation of the same pipeline, and the pipeline is what transfers to whatever product your employer bought...
I work two support queues. In one, readers email when a lab created output or did not match the screenshots within the book, the other, my extended family calls because the smart doorbell logs visitors an hour before they arrive, or the Wi-Fi is "broken" while every light on the router looks fine...
A tool's failure is advisory because a human still reviews the output before anything happens. An agent's failure is operational because the bad output is the action...
Welcome back to the Basics Series. In Basics Series - #3 we compared the firewall market, picked OPNsense for the lab, and installed it as a VM. In Basics Series - #4 we worked through the traditional vs. transparent-bridged decision and I promised a configuration walkthrough. This is that post...
This installment goes in a different direction. Where the last post zoomed all the way in — past the running host, past the alert, down to a single line of source...stepping away from individual controls entirely and asks about the distributed, multi-platform enterprise the cloud produced.
We've climbed through the rings of the architecture... This installment goes further upstream than any of them. It steps back to the code itself — and asks how you find the flaw while it's still cheap to fix and it hasn't shipped yet. That's the domain at the heart of Application Security Testing.
This installment does something different. Every domain we've covered so far — even the unglamorous hygiene loop — was, at bottom, an attempt to keep the bad day from arriving. This one starts the morning after it did...
