Security Practice

100 posts

Long-form

Security Design Never Scaled40 min readSecurity Practice AI
Two services, one bug, every instrument calling them identical. We scaled security’s answers but never the reasoning behind them, and machine reasoning may finally change that.
Containing the Optimizer60 min readSecurity Practice AI
A field guide to what containers, VMs, confidential VMs, and enclaves actually protect, and what it costs when each one fails.

Posts

The WebPKI's Unmanaged Software Supply ChainOctober 22, 202618 min readPKI & Certificates Security Practice
Trusted Everywhere, Impact EverywhereOctober 22, 202619 min readPKI & Certificates Security Practice
The Private Key Was FourOctober 22, 202634 min readPKI & Certificates Security Practice
The Status Quo Outlived Its StatusJuly 17, 20266 min readSecurity Practice
The Breaker, the Priest, and the PhilosopherJune 18, 20268 min readSecurity Practice Leadership & Product
The First AI-Built Zero-Day Is Not the Interesting PartMay 11, 20265 min readAI Security Practice
Smaller, Provable, and on Hardware You Own and OperateMay 8, 202616 min readSecurity Practice AI
Confidential Computing's Inconvenient TruthApril 3, 202623 min readCryptography & Keys Security Practice AI
What Is Confidential Computing, What It Isn't, and How to Think About ItApril 3, 20267 min readCryptography & Keys Security Practice
Why Nobody Can Verify What Booted Your ServerApril 3, 202610 min readCryptography & Keys Security Practice
Attestation, What It Really Proves and Why Everyone Is About to CareDecember 2, 20258 min readCryptography & Keys Security Practice
How Microsoft Code Signing Became Part of a Trust Subversion ToolchainAugust 21, 202514 min readPKI & Certificates Security Practice
Talent Isn't a Security StrategyAugust 9, 20256 min readSecurity Practice Leadership & Product AI
From Mandate to Maybe: The Quiet Unwinding of Federal Cybersecurity PolicyJune 10, 20256 min readPublic Policy Security Practice
The Rise of the Accidental Insider and the AI AttackerMay 12, 20256 min readAI Security Practice
Understanding Enterprise Security Buyer DynamicsMarch 14, 20254 min readSecurity Practice Leadership & Product
TPMs, TEEs, and Everything In Between: What You Actually Need to KnowMarch 9, 20252 min readCryptography & Keys Security Practice
From Perimeter to Patterns: Envisioning Security a Decade from NowFebruary 18, 20253 min readSecurity Practice AI
The Fallacy of Alignment: Why AI Safety Needs Structure, Not HopeFebruary 16, 20253 min readAI Security Practice
Educating the Champion, the Buyer, and the MarketFebruary 11, 20259 min readSecurity Practice Leadership & Product
From the Morris Worm to Modern Agentic AI ThreatsFebruary 8, 20252 min readAI Security Practice
AI Agent Security Needs Accountability and ControlFebruary 3, 20255 min readAI Identity & Authentication Security Practice
The Laws of Stupidity and the Gaps in Your Security PostureJanuary 19, 20254 min readSecurity Practice
Proactive Security: Engineering Resilience from the Ground UpNovember 28, 20244 min readSecurity Practice
Rethinking Authentication: “Something You Have,” “Something You Know,” and “Something You Are” for Workloads and MachinesNovember 26, 20243 min readIdentity & Authentication Security Practice
Beyond the Facade: Evaluating Long-Term Impacts of Enterprise Software ArchitecturesAugust 21, 20243 min readSecurity Practice Engineering & Code
When Words Mislead: Cybersecurity’s Terminology ProblemAugust 21, 20242 min readSecurity Practice Leadership & Product
The True Essence of Secure by DesignAugust 4, 20246 min readSecurity Practice Engineering & Code
HSMs Largely Protect Keys from Theft Rather Than AbuseJuly 26, 20246 min readCryptography & Keys Security Practice
Turning Catastrophe into Opportunity: Improving Processes and Vendor AccountabilityJuly 19, 20241 min readSecurity Practice Engineering & Code
Reading the Tea Leaves: What Led to the Largest IT Outage in HistoryJuly 19, 20243 min readSecurity Practice Engineering & Code
Content is King in Phishing and the Role of Publicly Trusted CAsJuly 11, 20248 min readPKI & Certificates Security Practice
Balancing Innovation and Privacy: The Risk of Government Surveillance in the Age of AIJune 26, 202410 min readPrivacy Security Practice
Speeding Up Development and Navigating Security RisksJune 25, 20243 min readEngineering & Code Security Practice
Groundhog Day: Learning from Past Key and Credential CompromisesJune 21, 20245 min readCryptography & Keys Security Practice
Integrating Security: Making Safe Software Development Seamless and ProductiveJune 20, 20247 min readSecurity Practice Engineering & Code
Transitioning from Reactive to ProactiveMay 29, 20242 min readLeadership & Product Security Practice
Rethinking Security in Complex SystemsMay 6, 20244 min readSecurity Practice
Navigating Security and InnovationMay 4, 20249 min readSecurity Practice Leadership & Product
The Rebirth of Network Access Protection with Microsoft's Zero Trust DNSMay 4, 20244 min readSecurity Practice Identity & Authentication
Tenement Farming and Cloud HSMsFebruary 24, 20246 min readCryptography & Keys Security Practice
Evolving Challenges in Software SecurityFebruary 8, 20243 min readSecurity Practice Engineering & Code
Echoes of the Past and Their Impact on Security TodayFebruary 7, 20242 min readSecurity Practice
Rethinking How We Assess Risk in the Software We Rely OnJanuary 14, 20245 min readSecurity Practice Engineering & Code
Raising the Bar: The Urgent Need for Enhanced Firmware Security and TransparencyDecember 1, 20232 min readSecurity Practice
The Scale of Consequence: Storm-0558 vs DigiNotarSeptember 9, 20231 min readSecurity Practice PKI & Certificates
Strengthening Domain Control Verification: The Role of Multiple Perspectives and CollaborationMarch 21, 20232 min readPKI & Certificates Security Practice
The Growing Security Concerns of Modern Firmware and the Need for Change.March 19, 20233 min readSecurity Practice
The Importance of Proper Measurement in Enterprise IT Management: Lessons from Cloud DeploymentsFebruary 9, 20233 min readLeadership & Product Security Practice
The Changing Landscape of Internet ProtectionFebruary 9, 20233 min readSecurity Practice Standards & Governance
The Limitations of Audits: What You Need to KnowFebruary 9, 20232 min readCompliance & Audits Security Practice
Why hasn’t SHAKEN/STIR made a big dent in the volume of robocalls?August 29, 20223 min readIdentity & Authentication Security Practice
How to keep bad actors out in open ecosystemsAugust 22, 20224 min readPKI & Certificates Security Practice
Accountability and Transparency in Modern SystemsMarch 28, 20217 min readCompliance & Audits Security Practice
Information system security and how little things have changedFebruary 16, 20213 min readSecurity Practice
Safes and TransparencyOctober 14, 20193 min readSecurity Practice
Software Supply Chain Risk MitigationMay 14, 20194 min readSecurity Practice Engineering & Code
Risk variance and managing riskMarch 26, 20184 min readSecurity Practice
The Evolution of Security ThinkingMarch 25, 20184 min readSecurity Practice Leadership & Product
Secondary effects when encrypting the webApril 29, 20175 min readPKI & Certificates Security Practice
CAs and SSL and Phishing Oh My!April 1, 20177 min readPKI & Certificates Security Practice
How do you show someone they are important to you?March 17, 20172 min readSecurity Practice
Understanding risks and avoiding FUDJanuary 6, 201612 min readSecurity Practice
The bright side of the dark sideJune 6, 20154 min readSecurity Practice
Cupid and Understanding Your ExposureJune 2, 20142 min readSecurity Practice PKI & Certificates
Beyond Builders, Defenders, and BreakersMay 21, 20141 min readSecurity Practice Leadership & Product
Attacker Mind Map for BitcoinMay 17, 20141 min readBitcoin Security Practice
A Bitcoin Risks Mind MapMay 17, 20141 min readBitcoin Security Practice
Effectiveness of security controls in physical securityMay 13, 20142 min readSecurity Practice
Keeping long-term passwords securedApril 23, 20141 min readIdentity & Authentication Security Practice Bitcoin
Insurance and BitcoinApril 22, 20142 min readBitcoin Security Practice
The weaknesses of fingerprint based authenticationSeptember 11, 20134 min readIdentity & Authentication Security Practice
Strategies for Deploying 2FAJuly 9, 20134 min readIdentity & Authentication Security Practice
DCOM and your FirewallJuly 8, 20131 min readEngineering & Code Security Practice
Deploying SSL – Beyond the certificate and cipher suitesJune 24, 20135 min readPKI & Certificates Security Practice
Deploying SSL – How to get your server configuration rightJune 23, 20135 min readPKI & Certificates Security Practice
How not to collect sensitive informationApril 16, 20131 min readPrivacy Security Practice
Abstract: Using least privileged design principals to improve trust in the online marketplaceFebruary 16, 20131 min readPKI & Certificates Security Practice
Is SSL Broken?February 4, 20133 min readPKI & Certificates Security Practice
SSL 3.0 Usage in the WildDecember 5, 20123 min readPKI & Certificates Security Practice
A revised look at the new Windows Update SSL configurationJune 24, 20121 min readPKI & Certificates Security Practice
A look at the new Windows Update SSL certificatesJune 17, 20127 min readPKI & Certificates Security Practice
Was the Flame WSUS attack caused just because of the use of MD5?June 13, 20122 min readCryptography & Keys Security Practice PKI & Certificates
Flame and Certificate RevocationJune 12, 20122 min readPKI & Certificates Security Practice
Flame was just one use of the Terminal Services Licensing PKIJune 10, 20123 min readPKI & Certificates Security Practice
How did the Terminal Services Licensing PKI effect you?June 8, 20122 min readPKI & Certificates Security Practice
How one typically verifies code comes from MicrosoftJune 7, 20123 min readPKI & Certificates Security Practice
The tale of two (Microsoft) PKIs June 6, 20121 min readPKI & Certificates Security Practice
MSRC 2718704 and the age of the rogue certificatesJune 6, 20123 min readPKI & Certificates Security Practice
MSRC 2718704 and Terminal Services License CertificatesJune 6, 20122 min readPKI & Certificates Security Practice
MSRC 2718704 and Nested EKU enforcementJune 6, 20124 min readPKI & Certificates Security Practice
MSRC 2718704 and the Terminal Services Licensing ProtocolJune 4, 20124 min readPKI & Certificates Security Practice
Always On SSL (AOSSL) Whitepaper PublishedApril 24, 20121 min readPKI & Certificates Security Practice
Least Privilege and Subordinate Certificate AuthoritiesFebruary 24, 20126 min readPKI & Certificates Security Practice
SSL/TLS Deployment Best PracticesFebruary 24, 20121 min readPKI & Certificates Security Practice
How to mitigate the risk of the DigiNotar *.google.com SSL certificateAugust 27, 20113 min readPKI & Certificates Security Practice
The Contrition of a Security PractitionerMay 27, 20103 min readSecurity Practice Leadership & Product
How to tell if a volume is Bitlocker Protected with TPM and PINNovember 12, 20082 min readCryptography & Keys Security Practice
What is a wildcard certificate and why are they a bad idea?August 17, 20073 min readPKI & Certificates Security Practice
ASKING THE DRUNK IF THEY ARE DRUNK April 5, 20074 min readSecurity Practice Identity & Authentication