Topics / Defend Systems
Defend Systems
Protect networks, cloud workloads, identities, and architectures.
Network Security
Design and validate defensible network trust boundaries.
Cloud Security
Manage cloud identity, workload, and configuration risk.
Identity and Access Management
Apply authentication, authorization, lifecycle, and least-privilege principles.
Security Architecture
Design defensible systems and resilience patterns.
Latest published content
Understanding Network Trust Boundaries
How to identify where trust actually changes in a network, place boundaries there instead of at the perimeter alone, and validate that a boundary fails closed — illustrated with a fictional multi-tier architecture.
Segmentation vs Isolation
Segmentation and isolation are two different controls, not two names for the same one. A decision test for choosing between them once a trust boundary exists, the failure patterns that come from conflating them, and how each is validated differently — illustrated with a fictional zone architecture.
DNS as a Security Control and Attack Surface
DNS is both a place to enforce security controls — filtering, monitoring, DNSSEC validation — and a protocol attackers abuse in its own right, through cache poisoning, subdomain takeover, and tunneling used as a covert command-and-control channel. A decision framework for treating DNS as a control point instead of invisible plumbing, illustrated with a fictional resolution and tunneling path.