Application security
Everything I've written on application security, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
How Do You Verify a Container Image's Build Attestation?
Verify the image digest, signer, builder, source and build parameters, then bind the result to the exact deployment and current release policy.
-
How to Revoke a Leaked Secret Without Breaking Services
Map every consumer of a leaked credential, revoke its effective authority, test the replacement, and investigate tokens or access it may have created.
-
API authorization
I would not begin API authorization by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Authentication design
I would not begin authentication design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Code review
I would not begin code review by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...
-
Dependency vulnerabilities
I would not begin dependency vulnerabilities by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Release engineering
I would not begin release engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Secrets in repositories
I would not begin secrets in repositories by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Secure SDLC
I would not begin secure SDLC by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...
-
Security testing
I would not begin security testing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Software supply chain
I would not begin software supply chain by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Threat modeling
I would not begin threat modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
Nothing matches. Try another word, or ask me directly.