// Topics / Security

Security

46 entries tagged “Security”

    Your Coding Agent Inherits the Engineer · 4 min A coding agent inherits every credential the engineer holds and none of the judgment behind them. Close that gap with a runtime boundary, not a ban. security ai operations MCP Grew Up. Your Integration Debt Has a Clock. · 4 min The July MCP revision started a 12-month deprecation clock. Use it to find every agent-to-tool boundary, give each an owner, and test it. ai architecture platform-engineering The Eval Inversion · 5 min Two frontier labs lost containment this summer, in eval environments. The more adversarial the workload, the weaker the walls around it. Invert that. ai security reliability Shadow AI Is an Operating Problem, Not a Ban · 4 min Banning AI tools removes your visibility, not the tools. Make the governed path the fast path and pull usage into the control plane. governance ai security Agent Identity Is the New Control Plane · 4 min AI agents need workload identity, not shared API keys: SPIFFE SVIDs, RFC 8693 token exchange, and Vault leases make access scoped, attributable, revocable. ai reliability security Sovereignty-by-Design for AI: How to Win Regulated Enterprise Deals · 4 min AI data sovereignty an auditor can test: BYOK, in-region decryption, and which copies key revocation kills versus which need signed delete receipts. ai privacy governance AI Governance Without Bureaucracy · 2 min AI governance that works: tighter defaults, named owners, fast escalation, and a small control stack engineers can follow at 2 a.m. No new committees. governance ai security Data Sovereignty by Design: Privacy as Architecture · 6 min Data privacy and residency are architecture constraints. Four minimum controls, zero-trust data access, and multi-region tradeoffs to build in early. privacy security compliance Why AI Agents Fail on Legacy Network Infrastructure · 7 min Many AI agent failures trace to the network: stale DNS, flat trust, retry storms, shallow queues. Zero-trust identity and per-step reliability fix them. agents infrastructure security AI Security in 2026: Prompt Injection, Agents, and Defenses · 6 min Multi-step prompt injection and tool-based exfiltration target AI agents in 2026. The layered defenses, monitoring, and security review I use. security ai production AI Data Privacy Is a Plumbing Problem · 5 min AI privacy fails in the details: what gets logged, who can replay prompts, how long artifacts linger. Treat it as infrastructure, not a checkbox. privacy ai data AI Security: Prompt Injection and the New Attack Surface · 5 min AI systems are exposed APIs with real blast radius. The threats are injection, leakage, and tool misuse. The defenses are the ones we've always needed. security ai production AI Safety in Production Is Defense in Depth · 5 min Production AI safety works like cyber defense: assume breach, layer input, output, and system controls, and watch every boundary with real monitoring. ai governance production Enterprise AI Compliance Without the Theater · 5 min Enterprise AI compliance as architecture: a data inventory, model registry, audit logging, and risk tiers that let low-risk use cases ship in days. ai compliance business LLM Security: A Field Guide for People Who Ship Things · 6 min LLMs bring security failure modes most teams aren't defending against. Prompt injection, data leakage, tool abuse, and cost attacks are exploitable today. security llm ai Responsible AI Is Operational Risk Management · 3 min Responsible AI fails as a committee and works as risk management: know the blast radius, test the failures you fear, disclose AI use, name an owner. ai security governance AI Safety Is Just Security Engineering With Extra Steps · 4 min For engineers shipping LLM features, AI safety is reliability, security, and accountability. A threat model and defenses from a security background. ai governance security Container Image Scanning Without the Security Theater · 3 min Most container scanning setups produce hundreds of unread findings. Scan in CI, rescan the registry, gate admission, and triage by exploitability. containers security ci-cd OAuth Token Security After the Heroku and Travis CI Breach · 7 min Stolen Heroku and Travis CI OAuth tokens exposed private GitHub repos. Short lifetimes, tight scopes, encrypted storage, and monitoring limit the damage. security cost incident-management Kubernetes Security Hardening: Pods, RBAC, Network, Secrets · 7 min Kubernetes defaults favor convenience over security. A layered hardening guide covering pods, RBAC, network policies, secrets, and the control plane. kubernetes security devops After Log4Shell: Dependency Visibility and Patch Speed · 5 min Most teams lost days to Log4j just finding where it ran. What to fix before the next one: SBOMs, owned CI scanning, vendor SLAs, and fast deploys. security technical-debt incident-management 2021 in Review: The Year Everything We Ignored Caught Fire · 5 min 2021 in review: a job change, cleanup work, Log4j and the us-east-1 outage as inventory tests, OpenTelemetry going real, and what I got wrong. year-in-review security reflection Log4j CVE-2021-44228 Response: What to Do Right Now · 5 min Log4Shell (CVE-2021-44228) response playbook: inventory every Java dependency, patch or mitigate exposed services, chase vendors, and keep communicating. security engineering incident-management Zero Trust Architecture: Identity First, Then Segmentation · 6 min Zero trust from cyber-defense exercises and a large telecom: identity first, default-deny segmentation, device posture, and common mistakes. security architecture infrastructure Remote Work for Engineering Teams: Benefits and Dangers · 6 min Years of running distributed engineering teams: what remote work gives you, where it hurts (isolation, blurred boundaries, eroding trust), and what works. remote-work leadership teams DevSecOps in Practice: The Pipeline Controls I Implement · 7 min Pre-commit hooks, CI security stages, OPA Gatekeeper policies, and a triage system: the DevSecOps controls I set up so developers don't route around them. security devops ci-cd Supply Chain Security After SolarWinds: Where to Start · 8 min After SolarWinds: how I map build paths, harden CI, pin and proxy dependencies, sign artifacts, and watch for tampering in enterprise pipelines. security ci-cd SolarWinds Supply-Chain Attack: Lessons for Build Pipelines · 5 min The SolarWinds supply-chain compromise is the wake-up call every software team needed. What happened, why it matters, and what you should do right now. security incident-management Container Runtime Security: Seccomp, Network Policy, Falco · 8 min Image scanning tells you what's in the box; runtime security tells you what it's doing. How we lock down containers with seccomp, network policy, Falco. containers security kubernetes Zero Trust vs VPN: How to Migrate Off the Perimeter · 6 min VPNs trust the network; zero trust checks every request. Lessons from cyber-defense exercises and my infrastructure startup, plus a six-step migration path off the VPN. security infrastructure VPN Overload in 2020: Why Scaling the VPN Is the Wrong Fix · 4 min COVID broke everyone's VPN. More licenses stop the bleeding and split tunneling buys time. The real fix is moving apps behind identity-based access. infrastructure security remote-work AWS Security While Scaling Fast: Make Secure the Default · 7 min Scaling AWS overnight? Manual security review collapses under that pressure. Secure defaults hold: IAM boundaries, private Terraform modules, GuardDuty. security cloud infrastructure Security Incident Response: Drills Beat Written Plans · 7 min Most incident response plans are shelf-ware. What matters in a breach: simple severity levels, the first 30 minutes, four roles, evidence, and drills. security incident-management devops Kubernetes Security Hardening: Fixing Insecure Defaults · 5 min Kubernetes defaults optimize for fast adoption, not safety. A hardening checklist from running production clusters at three startups. kubernetes security infrastructure Container Security in 2018: PSP, Distroless, Image Signing · 3 min Eight months after my first container security post: PodSecurityPolicy, distroless images, image signing, and Vault at a fintech startup. security containers kubernetes Microservices Security: Identity, mTLS, and Secrets · 6 min Split the monolith and every internal call becomes attack surface. Service identity, mTLS, authorization patterns, and secrets management in practice. security microservices architecture Zero Trust Architecture: Building It at a Fintech Startup · 5 min How I replaced castle-and-moat security at a fintech startup with zero trust: identity-first access, an access proxy, and micro-segmentation. security architecture infrastructure Spectre and Meltdown: What We Patched in the First Five Days · 4 min Five days after the Spectre and Meltdown disclosure: what we patched at a fintech startup, what KPTI costs, and what it means for shared infrastructure. security infrastructure Container Security Beyond the Basics: What We Hardened · 5 min Containers share the host kernel, so they aren't a security boundary. How we hardened images, runtimes, network policies, and RBAC at a fintech startup. containers kubernetes security Security Champions: Startup Security Without a Security Team · 5 min No budget for a security team? Turn one motivated engineer per team into a security champion. How we run it at an eight-engineer fintech startup. security startups engineering Security Automation in CI: Stop Reviewing by Hand · 4 min Manual security review can't keep up with continuous delivery. How I moved secret scanning, dependency audits, SAST, and DAST into a fintech CI pipeline. security devops ci-cd WannaCry Postmortem: Unpatched SMB and Flat Networks · 4 min WannaCry used an SMB exploit Microsoft patched two months earlier (MS17-010). The failures were patching, segmentation, and exposure, all fixable today. security incident-management GDPR Is an Engineering Problem: A Technical Checklist · 6 min GDPR enforcement starts May 2018. The engineering checklist I'm working through at a fintech startup: data inventory, consent, access, deletion, retention. compliance privacy security Securing APIs: Authentication and Authorization Patterns · 6 min How we secured a tiered data API: short-lived RS256 JWTs, OAuth2 scopes mapped to tiers, fail-closed authorization middleware, safe token storage. security api Building a Security-First Engineering Culture · 5 min Security culture is habits leadership enforces: no secrets in code, a security question on every PR, least privilege, patch deadlines, and champions. security engineering teams Security Incident Response Playbook for Startups · 8 min An incident response playbook for small teams, learned the hard way: define incidents, name owners, contain carefully, and communicate clearly. security incident-management startups
All topics →