ESC1 and ADCS Attack Paths: What to Fix First
ESC1 is an AD CS template misconfiguration that lets any domain user get a certificate as anyone, including a domain admin. Here's how to fix it.
A new question every month
The blog
One question a month, answered in depth by someone who's had to make it work in production, not just on a slide.
What Is PKI? A Practitioner's Guide to IT and OT PKI
PKI (public key infrastructure) is the CAs, certificates, keys and policies that let machines and people prove identity. Here's how it works in practice.
Purdue Model for Identity: What Breaks Below Level 3
The Purdue model splits OT networks into levels 0–5 plus an IDMZ. Here's what identity and access look like at each level, and why IT patterns break.
What Is Identity Governance and Administration (IGA)?
IGA is how you decide who should have access, grant it, review it and prove it. What it does, how it differs from IAM and PAM, and how programs go wrong.
What Is ITDR? Identity Threat Detection and Response
ITDR (identity threat detection and response) finds and stops attacks that abuse identities and the systems behind them, like AD and your IdP.
What Is OT Security? An Identity-First Primer
OT security protects the systems that run physical processes. What makes it different from IT security, and why identity is the place to start.
CyberArk vs. BeyondTrust vs. Delinea: Notes From an Admin
I've run all three PAM platforms in production. Here's where each one shines, where each one hurts, and how I'd choose between them.
Building the Identity Pillar of a Zero Trust Program
Zero Trust identity in practice: the four technology pieces (PAM, access enforcement, IGA, ITDR), how they connect, where to start and how to measure it.
What Is the Dark Web? (And Is Your Info Already on It?)
A plain-English breakdown of the dark web, why your data is almost certainly on it, and the five things that actually make it useless to criminals.
What Is Zero Trust?
Zero Trust in plain English: why "trust but verify" stopped working, the three principles that replaced it, and where to actually start.