Changelog — 9 articles
Download the archive
No articles in OWASP & Web Application Security yet. View all articles.
OWASP & Web Application Security (9)
- De-identification Isn't Anonymization, and Neither Is a Weak Hash
- Database Security by Design: What Normalization Buys You Beyond Tidy Tables
- Secure Coding: Passwords, Errors, and Signed Code
- Hardening an Application: The Boring Controls That Actually Hold
- Code Execution, Privilege Escalation, and the Memory Underneath
- Cookie and Session Attacks: Stealing the Thing That Says You Are You
- XSS, CSRF, SSRF: Three Ways to Make Something Else Do the Asking
- Broken Access Control and Injection: When the Backend Believes You
- The OWASP Top 10, and What a List Like This Is Actually For
Secure Software Development (3)
Employee Safety & Emergency Planning (2)
Incident Response (5)
Security Principles & Privileged Access (2)
Cybersecurity Investigations & Forensics (5)
Security Program Assessment (5)
- Control Testing, Exceptions, and Compensating Controls
- Audits vs. Assessments: Who's Asking, and How Formal It Gets
- KPIs vs. KRIs: Measuring the Program You Have and the Risk You're Taking
- Watching the Watchers: Management Reviews and Privileged Access
- Security Data and Documentation: If It Isn't Recorded, It Didn't Happen
Disaster Recovery (3)
Code Testing & Secure Development (5)
- Building Security In: The Secure SDLC and Test Coverage
- Code Repositories and Third-Party Code: Where Your Risk Actually Lives
- Fuzzing and Misuse Cases: Testing Like Someone Who Wants It to Break
- SAST, DAST, IAST: Three Ways to Test Code, and Why You Need All of Them
- Code Review, Done Formally: The Fagan Inspection
Log Reviews & Monitoring (5)
Penetration Testing (5)
- Red, Blue, and Purple Teams: Running the Fight on Purpose
- Bug Bounty Programs: Paying Attackers to Be on Your Side
- Zero-Days and Responsible Disclosure: The Window Nobody Can Patch Yet
- How a Pen Test Actually Runs: Discovery, Attack, and Leaving No Trace
- Vulnerability Testing vs. Penetration Testing (and Why the ROE Comes First)
Vulnerability Management (3)
Social Engineering & Access Control Attacks (3)
Kerberos, NTLM & Authorization (4)
Accountability & Account Management (5)
Identification & Authentication (8)
- Catching Auth Attacks: Brute Force, Credential Stuffing, MFA Fatigue
- Sessions vs. Tokens: Cookies, JWTs, and Where Each One Bites
- OAuth 2.0 and OIDC, Explained by Wiring Up My Own Admin Login
- Why Passwords Keep Losing: MFA, Passkeys, and Account Takeover
- Onboarding an Identity: Registration and Identity Proofing
- Biometrics: When You Are the Credential
- Proving Identity, Part 1: Usernames and Access Cards
- Identification, Authentication, Authorization — and the Accounting Nobody Talks About
Home Lab & Infrastructure (8)
- Hacking with AI: What Security Engineers Get Wrong (and What Moltbot Proved)
- Building a Forensic Evidence Pipeline: Workstation to Evidence Locker
- Why I Use CSI Linux as My Digital Forensics Workstation
- Ansible Alternative: Why I Use Action1 for Windows Management
- Ansible & Ludus: Automating a Home Lab with Infrastructure as Code
- Building a Home Lab SIEM: Wazuh Deployment with Custom Detection Rules
- Infrastructure Security Hardening: Firewall Audit, IDS Tuning, and SIEM Alert Management
- Stop Feeding Your Secrets to ChatGPT 🔀