Writing
Research and field notes
Deep dives, threat analysis, and notes from the work - mostly on AI and agent security, sometimes on whatever is breaking this week.
Latest
Zero Trust Without The Vendor Fog
Follow an employee, contractor, and export job into one reporting application. Then test what grants access and what actually revokes it.
January 17, 20254 min readCybersecurity
Read article
July 2, 20214 min read
TOGAF And Zachman For Security Architecture
Use contractor access expiry to work through the difference between planning an architecture change and finding gaps in its description.
TOGAFZachman FrameworkEnterprise Architecture
June 15, 20214 min read
Using C4 Diagrams In Security Work
Follow a customer attachment from the browser to storage, using C4 to locate the ownership check and the paths that might bypass it.
C4 ModelArchitecture DiagramsCybersecurity
May 20, 20214 min read
4+1 Architecture Views For Security Reviews
A refund times out and two workers may retry it. Follow the same operation through the logical, code, runtime, and deployment views.
4+1 ArchitectureKruchtenSystem Architecture