Articles, write-ups, and musings concerning the world of cybersecurity and technology.
The BIA and the Disaster Recovery Plan get lumped together, but they answer different questions: one asks what matters most, the other asks how to get it back. NIST SP 800-34, the four site types, and
A few incidents from earlier this year are worth a quick look, less for drama and more because they're useful, concrete examples of how different "something went wrong" actually looks in practice.
What a real cybersecurity policy for a small DoD subcontractor could look like: named roles, specific timelines, and actual NIST SP 800-171 and CUI marking guidance instead of vague boilerplate.
Once you're inside a network, you're basically blind until you enumerate it. Enumeration builds a working picture of the hosts, services, and accounts actually present, so you can plan a next move instead of guessing one.
A CTO wants to bury a breach. A senior VP wants an intern to say "probably." Two hypothetical memos on what to do when someone with more power wants a convenient story, and why honesty wins.
OSINT is big enough that security professionals specialize in it full time. Here are five broad categories of exposure worth knowing about, with concrete steps to mitigate each one.
Can a defense contractor use the cloud? Yes, for the right data. A look at a hybrid design: SaaS for everyday collaboration, an on-prem enclave for CUI, and the compliance layer that ties it together.
Once you've enumerated a target and know what OS and service versions are running, vulnerability research means checking whether what's installed is actually exploitable. Four acronyms—CWE, CVE, NVD, Exploit-DB—sound interchangeable but aren't.
A fictional server still signs certificates with MD5, a hash broken since 2008. A memo to the admin, and the question it raises: should researchers be free to publish code that breaks an algorithm?
Once you have a target IP or domain, nmap can tell you a lot: the operating system, the services running and their versions, and which ports are open. Here's the quick version of how the OS-detection side works.
