AI / LLM Application Software Security: Part 1
This is the first post in my “AI / LLM Software Security Series”.
Read article: AI / LLM Application Software Security: Part 1IyaSec Blog
Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
Network Segmentation: Macro, Micro, and the Building Blocks
I’ve talked about network segmentation in many blog posts, but I’ve never had a blog post dedicated specifically to that topic. So, here we go.
Read article: Network Segmentation: Macro, Micro, and the Building Blocks
Multi-Factor Authentication (MFA): Don’t Let Your CyberSecurity Insurance Claim Get Denied On…
Multi-Factor Authentication (MFA) is the security control that can make, or break, your business. If there’s one cybersecurity control that consistently separates organizations that get breached from those that don’t, it’s Multi-Factor Authentication (or, to be precise, MFA, done correctly).
Read article: Multi-Factor Authentication (MFA): Don’t Let Your CyberSecurity Insurance Claim Get Denied On…
Dangers of a Cashless Society
IntroductionWhat Does Cashless Mean?Countries Embracing Going CashlessWhy Cashless Advocates Dislike Cash
Read article: Dangers of a Cashless Society
Application Security Best Practices
A starting point for application security.
Read article: Application Security Best Practices
Defense In Depth
“Defense in Depth” is the idea that no single security control is trusted to stop an attack. Instead, you stack multiple, independent layers so that if one fails, others still stand in the way.
Read article: Defense In Depth
Zero Trust Architecture
Zero Trust Architecture (ZT or ZTA) is a security model / framework based on one simple idea: Never trust, always verify. From NIST, we have, the “… ZT approach is primarily focused on data and service protection but can and should be expanded to include all enterprise assets (devices,…
Read article: Zero Trust Architecture
Don’t Use Source IP Addresses As The Primary Authentication Mechanism
In certain US industries, usually legacy businesses with low margins and heavily regulated, it is still quite common to use source IP address as an authentication mechanism on the public internet. Now, never mind that in the age of cloud computing and SaaS applications, it is rare for cloud…
Read article: Don’t Use Source IP Addresses As The Primary Authentication Mechanism
Core Security Precept: Principle of Least Privilege
The word “rule” is overused; so, I went with “precept” — a rule or principle that defines how one should think or act.
Read article: Core Security Precept: Principle of Least Privilege
A Vendor DMZ Pattern
A long time ago, I was doing integration architecture work in the land of Enterprise Service Buses (ESBs) and API Gateways. Think IBM WebSphere DataPower and Apigee — I like to remember Apigee the way it was before it was integrated into GCP. After we had designed and built the ESB, we moved on to…
Read article: A Vendor DMZ PatternLooking for something specific? Browse all 124 topics.