Blog
Articles, tutorials, and field notes on identity, integration, API management, and application security — spanning nearly two decades of hands-on work.
Of Daffy Bastards And Goofy F*cks In The Land Of The Lost: Integration Anti-Patterns From The Dark Side
Some organizations keep following the same legacy, bad practices even though they know better. They keep doing it right up until the unfortunate happens.
What Is Digital Privacy?
Privacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.
Data Privacy Laws / Regulations Around The World
Disclosures: AI (ChatGPT) assisted with summarizing this information.
My NAS Appliance Just Turned Ten Years Old
I’ve been waiting a couple of years to write this post. In November, 2015, I bought a Synology RS815 NAS appliance to replace the DIY solution that I had been using for years before that. A month ago, that NAS appliance turned ten years old. It’s been in daily use for the past decade. At the six…
Using Curl With SPNEGO
Recently, I had to setup a SPNEGO example to demonstrate a Kerberos identity integration. The details aren’t important, but I spent a bit of time figuring out how to use curl’s SPENGO support. So, we have the next blog post topic.
SOFTWARE SUPPLY CHAIN SECURITY: CI/CD/CT PIPELINES AND SECURITY TOOLS — PART 2
This is part two of a two part blog post on Software Supply Chain Security. If you haven’t read Part 1 yet, starting there is recommended.
SOFTWARE SUPPLY CHAIN SECURITY: CI/CD/CT PIPELINES AND SECURITY TOOLS — PART 1
The DevOps movement of the last decade more-or-less led to the DevSecOps movement of this decade. This focus on automation to create efficient, end-to-end software publishing pipelines combined with incidents like the SolarWinds Hack in 2020 and the recent ‘S1ngularity’ attack on the NPM ecosystem…
Practical Business Continuity For The Small Organization
For the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…
Practical Business Continuity
For the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…
Static Credentials Must Not Be Used In The Browser
Authentication is described in this post.
Datastore Security Requirements
This post will introduce a generic set of database / datastore security requirements that be used as a starting point when developing a database security strategy.
Application Front-Ends Must Not Make Authorization Decisions
First, let’s get the usual introductions out of the way. For an in-depth discussion of what Authorization is, check out this post. For a complete introduction to Authorization concepts see my Authorization Series. This post continues my long-running Authorization Series. In this post, we’re going…