CybersecurityArchitecture
Latest
Inspect Both Sides of the LLM Conversation
A practical policy and configuration guide for detecting prompt injection and jailbreak attempts before inference, then blocking unsafe content and sensitive-data disclosure before model output reaches a user, tool, or application.
Do AI Firewall Sidecars Make Sense with Vendor-Hosted LLMs?
A reader of the Cybersecurity Architect's Handbook Second Edition recently asked whether the Kubernetes sidecar pattern discussed in Chapter 13 applies only when an organization hosts its own large language model. The short answer is no.
Seeing Cybersecurity Architect’s Handbook in the Wild Never Gets Old
Seeing a well-read copy of Cybersecurity Architect’s Handbook, Second Edition out in the wild never gets old.
Vaultwarden and HashiCorp Vault: Different Jobs in the Same Secrets Architecture
Yesterday I wrote about moving autonomous-agent secrets out of a flat .env file. Why I kept Vaultwarden for people and recovery, added HashiCorp Vault for workloads, and treated identity, audit, PKI, and tested recovery as part of the deployment rather than follow-up work.
Moving Autonomous Agent Secrets Out of .env
For a long time, my autonomous agent found credentials the same way many applications do. Why I replaced a flat environment file with scoped Vaultwarden access, short-lived agent sessions, and a verified audit trail that now reaches Graylog and Wazuh.
Practice at Home the Way You Preach at Work
I spend my working hours telling teams how to do security well. Segment the network. Write the change down. Model the threat before you build the control. Then I go home, and if I am honest with myself, the temptation is to cut every one of those corners because it is "just the lab."
SOC
·
From Log to Incident, and the Budget That Decides What You See
I have taught this material before as two sessions, and I usually open each session the same way: this is not a tool class. Tools get named below, plenty of them, but every one is an implementation of the same pipeline, and the pipeline is what transfers to whatever product your employer bought...
ATT&CK
·
Basics Series - #5 Firewall Configuration (OPNsense VM Configuration) Part 3
Welcome back to the Basics Series. In Basics Series - #3 we compared the firewall market, picked OPNsense for the lab, and installed it as a VM. In Basics Series - #4 we worked through the traditional vs. transparent-bridged decision and I promised a configuration walkthrough. This is that post...
Amazon
·
The Outermost Ring: Enterprise and Cloud Security — and the End of the Series
This installment goes in a different direction. Where the last post zoomed all the way in — past the running host, past the alert, down to a single line of source...stepping away from individual controls entirely and asks about the distributed, multi-platform enterprise the cloud produced.
Book
·
Four Tools, One Target: The Application Security Testing Labs in the Cybersecurity Architect's Handbook, Second Edition
We've climbed through the rings of the architecture... This installment goes further upstream than any of them. It steps back to the code itself — and asks how you find the flaw while it's still cheap to fix and it hasn't shipped yet. That's the domain at the heart of Application Security Testing.