Endpoint Security Virtualisation PoV
How Bad Is It Really? A Field Guide to Endpoint Security Severity Summary: Endpoint security findings get mis-rated in both directions - a scary-sounding privilege label …
Writing
Long-form posts on detection engineering, threat intelligence, vulnerability management, offensive security and security architecture.
From duplicates to $$$$ bounties: A bug bounty journey v2.0 that actually happened
A practical, no-BS guide based on real submissions, real rejections, and real lessons - not theory. Who is this for? If you are sitting there thinking “bug bounty is too …
The Data Normalization Problem Nobody Talks About
If you have spent any meaningful time inside a Security Operations Centre - or have been responsible for one - you will know this feeling intimately. Alert fires. You …
Automotive industry threat landscape
Modern cars are not just machines that move you from A to B. They are packed with radios, sensors, SIM cards, Wi-Fi, Bluetooth, cloud backends, and mobile apps …
Advanced Detection Engineering
Introduction I was going through the SANS material on detection engineering from multiple of their courses and I wanted to make a practical ready notes for the same. This …
End-to-End API Security Lifecycle
Introduction In today’s cloud-native world, APIs are the backbone of digital ecosystems connecting microservices, external partners, and end-users alike. But with …
Building a Resilient DNS Infrastructure
Introduction Think of DNS like the Internet’s phone book: it turns names you understand into addresses computers use. In this guide, we’ll walk through four simple views …
STRIDE Threat Modelling - In-Depth Practical
Threat Modeling Isn’t Just for Paranoids: Getting Real with STRIDE Ever pushed code feeling pretty darn good about it, only to have that sinking feeling when a security …
Decision Tree to Identify Potential/Confirmed Abandoned/Unmaintained External Applications
Maintaining a clean and secure application inventory is critical for any organization. Over time, however, many web applications become outdated or downright abandoned. …
Free/Open-Source External ASM Toolkit
Introduction In today’s security landscape, Attack Surface Management (ASM) is a cornerstone of proactive defense. Monitoring internet-facing assets, uncovering shadow …
Threat Intelligence Information Sharing
The Imperative of Cyber Threat Intelligence Sharing In 2021, the Colonial Pipeline ransomware attack paralyzed fuel distribution across the U.S. East Coast, costing $4.4 …
Master XSS Hunting Methodology
Below is a straightforward, step-by-step approach to uncovering Cross-Site Scripting (XSS) vulnerabilities. The focus here is on the methodology rather than specific …
How to Know You are Ready for Full-Time Bug Bounty
If you’ve been flirting with the idea of turning your bug bounty side hustle into a full-time career, it’s important to be aware that there’s far more to the lifestyle …
SIEM Query Knowledgebase Document Template
Why I Created a SIEM Query Template In today’s fast-paced cybersecurity environment, managing SIEM queries effectively is paramount for timely threat detection and …
Navigating the R.O.A.D. from Threat Intelligence to Detection Rules
Overview of R.O.A.D. R.O.A.D. stands for: Raw Intelligence Gathering Organization & Analysis Actionable Detection Deployment & Refinement When combined with the six steps …
JWT Pentest Checklist
Overview In this blog post, I am sharing a detailed JWT Security Testing Checklist document I have created and found immensely valuable for penetration testers, …
Dead Drops: Threat Actor Perspective
Introduction Dead Drops are an interesting mix of art, technology, and espionage-inspired tactics. They started as a public art project but have evolved into a …
Bringing External and Internal Intel Data Together
Effective cyber threat intelligence isn’t just about collecting random feeds or logging bits of data—it’s about having complete coverage. By gathering external intel …
Gap Comparison in Traditional VM/ASM
In today’s rapidly evolving threat landscape, traditional vulnerability management (VM) practices face significant limitations, creating gaps that leave organizations …
Mind Your Vulnerability Gaps: Risk-based VM Approach
Introduction: Why is Vulnerability Management Important? In today’s dynamic cybersecurity landscape, vulnerabilities emerge from various sources, including penetration …
CTI Maturity Model
Introduction In this post, we’ll explore a Cyber Threat Intelligence (CTI) Maturity Model, designed to help organizations systematically enhance their threat intelligence …
How to Build Cyber Threat Intelligence Division For Your Organisation
Establishing a Cyber Threat Intelligence (CTI) division involves a structured approach encompassing planning, designing, and optimizing processes to effectively counter …
VIP Monitoring in Threat Intelligence: What, Why and How
What VIP monitoring is, why executives need it, how to build the program in four steps, and a ready checklist and mind map.