Writing and courses at the intersection of technology, security, and the craft of building systems that last.
Drawn from practice. Written to be useful.
From power button to shell prompt. A 25-article series explaining how a computer actually starts -- voltage, firmware, bootloaders, kernel, filesystem, and shell. Every step, no prerequisites assumed.
From alert to after-action report. Covers triage methodology, evidence preservation, containment decision trees, and structured communication under pressure. Grounded in 20 years of hands-on response work across enterprise environments.
The complete manual encryption system used in Cold War field operations. Mod-10 straddling checkerboard, key material handling, encrypt/decrypt pipelines. Interactive drills, timed exercises, and skill benchmarks build genuine operational proficiency.
Apply language models, TensorFlow, and zero-shot classifiers to security telemetry. Build pipelines that surface behavioral anomalies without signature dependency. Real datasets, real tooling, real adversarial conditions.
Not frameworks — outcomes. Covers metrics that matter, stakeholder communication, hiring and retaining analysts, and the organizational patterns that separate durable programs from ones that collapse under pressure.
The international standard for establishing, implementing, maintaining, and continually improving an ISMS. Annex A controls, risk assessment methodology, Statement of Applicability, and certification audit preparation.
The complete vulnerability lifecycle -- from intake and severity assessment through coordinated disclosure. Covers response team structure, CVSS triage, 60-90 day disclosure timelines, researcher engagement, and advisory publication. Practical, actionable, built on real-world coordination experience.
The common taxonomy for adversary behavior. Tactics, techniques, sub-techniques, and procedures mapped to real-world threat groups. Used for detection engineering, threat intelligence, and purple team exercises.
Standards for uniquely identifying physical objects across supply chains. Issuing agency codes, GTINs, SSCCs, serialization, and the bridge between physical items and digital records.
