How to pass the OSCP
A short set of tips for students attempting the Offensive Security Certified Professional (OSCP) certification exam.
Government Identification: BankID and the Australia Card
One of the less fun aspects of moving countries is that you're a walking edge-case for many IT systems. Being an expat also means becoming intimately familiar with all of the differences in how government services verify the identity of their users.
Supermicro, hardware trojans, and BMC security
We need to take two things much more seriously: the security of our supply-chain, and the security of our baseboard management controllers.
Facebook and the trade-off of centralised authentication
Having 50 million accounts breached is bad enough, but the bigger issue is that a huge number of third-party services use Facebook to authenticate their users.
Security gatekeeping in a DevOps world
In a modern DevOps environment, development teams manage the security of their own systems. In an environment where deployments happen several times a day, this model scales far better than the historical practice of security acting as a gatekeeper to production.
Security is always a trade-off
Everything we do in the security industry is a trade-off between convenience and security. The important thing is to be honest about the compromises you are making, and why they are necessary.