Showing 25–36 of 121 articles
Page 3 of 11
What to do with a software bill of materials
A software bill of materials lists components in a product or release. Its value comes from matching that inventory to deployed systems, relevant advisories, owners, and update decisions.
Read the visual guide
Backups that ransomware cannot rewrite
A backup is vulnerable if an attacker can erase or rewrite it using the same authority that controls production. Review the backup’s administrative path as well as its storage features.
Read the visual guide
How to use certificate transparency logs
Certificate Transparency records can help you notice unexpected certificate issuance. They are useful clues to investigate, not proof that the named service is live or that it was compromised.
Read the visual guide
Where SAML and OpenID Connect sign-in usually fail
A signed identity message still needs the correct issuer, audience, destination, and request context. Review the integration as a complete sign-in and account lifecycle.
Read the visual guide
When your system acts with the wrong person’s authority
A service may have more access than the person asking it to act. It must check the caller’s authority before using its own powerful identity on that person’s behalf.
Read the visual guide
How to threat-model a small product in one sitting
Start with one important journey through your product. Follow the data, identities, and trust boundaries, then ask what misuse could cause a meaningful consequence.
Read the visual guide
Home routers used for work
A home router connects work systems to personal devices and internet services. Review its support status, administration, Wi-Fi configuration, and any unnecessary remote access.
Read the visual guide
How a small organisation should give volunteers access
Volunteers need access that fits their actual work, including a clear owner and a defined review point. Shared accounts and indefinite permissions make changes harder to control.
Read the visual guide
How to write a privacy notice people can finish reading
A readable privacy notice starts with the real processing, not a template. Explain who handles information, why, with whom it is shared, how long it is kept, and how people can make requests.
Read the visual guide
What to keep after a security incident
Useful evidence includes the original record, its source, the collection method, and the limits of what it shows. Keep investigation copies separate from originals and control access to both.
Read the visual guide
Account recovery that can walk around the second check
Strong sign-in protection can be undermined by a weaker recovery process. Review every way to regain access, including support-assisted changes and replacement recovery details.
Read the visual guide
Why log times have to agree before you can trust the order
The order shown by two log systems may reflect clock settings, time zones, or ingestion delay rather than the true event sequence. Preserve those distinctions while building a timeline.
Read the visual guide