Failure Modes in Security Exceptions: A Design-Level Analysis
A practical security engineering field guide to security exceptions, covering risk, implementation, evidence, and team leadership.
Nathan Berg
Secrets Management for Small Teams: AWS Secrets Manager + CI
Secrets in repos are a reliability problem and a security risk. A simple secrets manager plus a minimal CI integration eliminates most of the pain without adding heavy process. This post shows a s...
Defining the Security Outcome for Security Exceptions
A practical security engineering field guide to security exceptions, covering risk, implementation, evidence, and team leadership.
A Team Playbook for Improving Security Guardrails and Paved Roads
A practical security engineering field guide to security guardrails and paved roads, covering risk, implementation, evidence, and team leadership.
Operating Security Guardrails and Paved Roads: Ownership, Evidence, and Exceptions
A practical security engineering field guide to security guardrails and paved roads, covering risk, implementation, evidence, and team leadership.
Engineering Security Guardrails and Paved Roads into the Paved Road
A practical security engineering field guide to security guardrails and paved roads, covering risk, implementation, evidence, and team leadership.
An Architecture Review Playbook for Security Guardrails and Paved Roads
A practical security engineering field guide to security guardrails and paved roads, covering risk, implementation, evidence, and team leadership.
Security Guardrails and Paved Roads: What the Team Must Decide Before Building
A practical security engineering field guide to security guardrails and paved roads, covering risk, implementation, evidence, and team leadership.
Email Authentication in Practice: SPF, DKIM, and DMARC
Email spoofing is still one of the easiest ways to bypass defenses. SPF, DKIM, and DMARC are the baseline controls that let receivers verify who is allowed to send mail on behalf of your domain. Th...
How to Lead a Review of Developer Security Education
A practical security engineering field guide to developer security education, covering risk, implementation, evidence, and team leadership.