All 19 articles, sorted alphabetically
TLS certificate pinning architecture
Deep-dive on TLS certificate and public-key pinning: the client rejects any certificate whose key is not on a pre-shipped pinset, even one a trusted C…
Read article →Content Security Policy architecture
Deep-dive on CSP: directive model and browser enforcement, why nonce/hash-based script-src with strict-dynamic beats host allowlists, frame-ancestors …
Read article →CSRF defense architecture
Deep-dive on Cross-Site Request Forgery defense: ambient authority and the identity-vs-intent gap, SameSite cookies, synchronizer and signed double-su…
Read article →Data loss prevention architecture
Deep-dive on DLP architecture: inspecting content with regex/validators, ML classifiers, and exact-data fingerprinting; classifying by data type, sens…
Read article →JWT validation
Deep-dive on validating JSON Web Tokens correctly, built on the crucial distinction that decoding a JWT is not validating it: the header and payload a…
Read article →KMS envelope encryption architecture
Deep-dive on envelope encryption: a KMS/HSM-held customer master key that wraps per-object data keys, GenerateDataKey and the wrap/unwrap flow, local …
Read article →mTLS -- both sides prove who they are
Deep-dive on mutual TLS (mTLS): the service-to-service authentication problem, mutual authentication (both sides present and validate certs) vs regula…
Read article →OAuth 2.0 authorization code + PKCE architecture
Deep-dive on the OAuth 2.0 authorization code flow with PKCE: code_verifier/code_challenge generation and the S256 method, the front-channel authoriza…
Read article →Privileged access management architecture
Deep-dive on privileged access management (PAM): eliminating standing admin access with just-in-time, time-boxed grants; the request and approval work…
Read article →RBAC vs ABAC architecture
Deep-dive on authorization architecture: RBAC roles and hierarchies versus ABAC attribute policies, subject/resource/action/environment context, the P…
Read article →SAML federation architecture
Deep-dive on SAML SSO: the browser as transport, assertion structure and conditions, metadata-driven certificate trust, XML signature wrapping, audien…
Read article →SAST and DAST
Deep-dive on SAST and DAST: static code analysis vs dynamic runtime testing, IAST and SCA, CI/CD shift-left integration, complementary coverage, the f…
Read article →Session management architecture
Deep-dive on web session management: server-side sessions vs stateless tokens, cookie hardening (HttpOnly/Secure/SameSite/__Host-), per-request valida…
Read article →SIEM detection pipeline architecture
Deep-dive on SIEM architecture: delivery-guaranteed collection tiers, ECS/OCSF normalization, ingest-time enrichment, streaming rules vs windowed corr…
Read article →Software Supply Chain Security Architecture in Depth
A 2500-word walkthrough of supply chain security: signed source, pinned deps, hermetic build, SLSA attestation, SBOM, signing, registry, admission, sc…
Read article →Threat modeling architecture
Deep-dive on threat modeling as a practice: data-flow diagrams and trust boundaries, STRIDE elicitation and attack trees, likelihood-impact ranking, m…
Read article →Web Application Firewall -- filtering malicious HTTP traffic
Deep-dive on Web Application Firewalls: the inspect-and-filter role, rule types (signature/anomaly/custom), OWASP coverage, positive vs negative secur…
Read article →WebAuthn and passkeys architecture
Deep-dive on WebAuthn/passkeys: authenticators and CTAP2, origin-bound challenge-response, registration and authentication ceremonies, attestation, sy…
Read article →Zero Trust Architecture in Depth
A 2500-word walkthrough of zero trust security: identity, device trust, trust broker, access proxy, microsegmentation, data classification, continuous…
Read article →