Posts
-
Setting up secure AWS S3 buckets with CloudFormation
In this post I'll go over a few of the configuration settings that you can use to secure your S3 resources, with a base CloudFormation template at the end that you can play with and extend. -
Diving into the Essential Eight strategies to mitigate security incidents part 2: limiting blast radius and recovering
This is the second part of a deep dive into the Australian Cyber Security Centre’s Essential Eight mitigation strategies, following up on an overview of guides from the Australian Cyber Security Centre (ACSC), and a deep dive into the first four of the Essential Eight.
To recap, the Essential Eight are the ACSC’s top eight recommended strategies for mitigating security incidents. This post will focus on the last four mitigation strategies.
The Essential Eight are:
- Application whitelisting
- Patching applications
- Configuring Microsoft Office macro settings
- Hardening user applications
- Restricting administrative privileges
- Patching operating systems
- Multi-factor authentication
- Daily backups
For each of the highlighted strategies, I’ll review security controls from the Australian Information Security Manual (ISM), incremental steps to achieve them following the Essential Eight Maturity Model, and comments on the overall strategy.
-
Living in Seattle or Vancouver on a budget
One of the most reliable ways to build financial security is to save part of every paycheck as soon as you’re able, so you can both enjoy life in the moment and handle whatever life throws your way.
It’s harder to save today than it was a few decades ago thanks to an inflated cost of living. However, if you’re earning $30k/year or more, there are practical ways to take control of the big things so that even in cities like Seattle and Vancouver, you can live well, build up an emergency fund, and begin saving for the future.
-
Diving into the Essential Eight strategies to mitigate security incidents part 1: preventing delivery and execution of malware
I introduced some of the security guides published by the Australian Cyber Security Centre and their Essential Eight mitigation strategies for businesses in my last post, and I’d like to dive deeper into the first four mitigation strategies for preventing delivery and execution of malware.
The Essential Eight mitigation strategies:
- Application whitelisting
- Patching applications
- Configuring Microsoft Office macro settings
- Hardening user applications
- Restricting administrative privileges
- Patching operating systems
- Multi-factor authentication
- Daily backups
-
Top mitigation strategies from the Australian Cyber Security Centre
The Australian Cyber Security Centre provides a substantial amount of clear and actionable information on how to improve an organization’s security posture, ranging from basic guides for organizations that are just establishing their security teams, to its regularly updated Australian Government Information Security Manual, often referred to as the ISM.
-
JDK distributions, JDK distributions everywhere
Taking a look at the number of JDKs, I'd like to start from a simple set of criteria to pick one to use for a new project, assuming zero budget and a desire for maximum flexibility. -
Financial checklist for moving to the US for work
If you’re moving from Canada to the US for work, there are a few things that are helpful to do before and after moving that will make your short-term finances much, much easier, and I’ve put together a few of them based on conversations I had with a friend who relocated around a year after I did.
-
Diving into information security principles
I'm interested in how information security can be better integrated into software development, and how services can be developed in a way that makes good security a natural part of the process. It'll take a lot of effort to get there, but continual improvement in security is achievable at any scale.
There are new skills to develop and many segmented fields to learn from, which is both exciting and challenging, but the good thing is that there've been many lessons learned that we can take advantage of to develop more secure systems today.
subscribe via RSS