#Security
9 articles
Designing Secure API Tokens with NIST CSF 2.0: Working Backward from Protect and Detect
Design an API token feature such as Personal Access Tokens (PATs) by working backward from the six NIST CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover). Covers the DB schema, token format, scope checks, anomaly detection, secret scanning, and revocation with code examples.
Prerequisite Knowledge Before Starting a Risk Assessment
A single map of the prerequisite knowledge worth having before you start a risk assessment. Starting from assets, threats, vulnerabilities, and risk, it places NIST SP 800-30, ISO/IEC 27005, OWASP ASVS, NIST SP 800-63B, and CVSS v4.0, through to threat modeling and MITRE ATT&CK.
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
Organizes service-to-service authentication in microservices across three layers: network, token, and identity foundation. Covers mTLS, Token Exchange (RFC 8693), SPIFFE, Zero Trust (NIST SP 800-207), and BeyondProd.
Cryptography Fundamentals: Symmetric, Asymmetric, One-Way Functions, Hashing, and Digital Signatures
From symmetric versus asymmetric encryption to the one-way and trapdoor functions behind RSA and ECC, plus hash functions and digital signatures, this article explains the building blocks of cryptography with primary sources. Part 1 of a three-part series that groups public-key uses into signing, encryption, and key exchange.
Cryptography in Practice: TLS, JWT, and SSH
How everyday protocols such as TLS, JWT/JWS, and SSH combine symmetric keys, public keys, signatures, key exchange, and PKI, viewed through the three uses of a public key and backed by RFCs. The final part of a three-part cryptography series.
Key Exchange and PKI: Diffie-Hellman, Certificates, and Certificate Authorities
How Diffie-Hellman shares a symmetric key safely, how ECDHE adds forward secrecy, and how PKI binds a public key to its owner through certificates, CAs, and a chain of trust. Backed by primary sources such as RFCs. Part 2 of a three-part cryptography series.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
A public key has just three uses: signing, encryption, and key exchange. This article sorts real-world applications such as SSH public-key auth, WebAuthn, mTLS, private_key_jwt, code signing, and container signing into these three, and clarifies how they differ from shared-key schemes such as HMAC, with primary sources.
How to Use Burp Suite with Google Chrome
An article on the various settings needed to use Burp Suite together with Google Chrome, for purposes such as vulnerability assessments. It covers using a proxy-switching extension like ProxySwitchSharp and setting up Burp's CA certificate so that its traffic can be inspected.