Blog topic
Network security
Firewalls, attacks, defence and the ideas behind them.
25 postsNewest first
Network security
CVSS measures severity, not risk: patch priority with EPSS and KEV
CVSS-B rates severity, EPSS the chance of exploitation within 30 days, KEV confirmed attacks. Six myths, BOD 26-04, and a triage order for firewalls and VPNs.
Advanced10 min read
- Vulnerability Management
- CVSS
- EPSS
- KEV
- SSVC
- Patching
Network security
How to read MITRE ATT&CK without treating it as a checklist
What MITRE ATT&CK is, how tactics, techniques and procedures fit, how to read a technique page, and how to use Navigator layers without chasing 100%.
Beginner9 min read
- MITRE ATT&CK
- D3FEND
- Detection engineering
- Threat intelligence
- SOC
Network security
Prompt injection: how one hidden email line hijacks an LLM agent
Walk a toy email assistant through an indirect prompt injection, map it to OWASP LLM01, NIST and MITRE ATLAS, and see which controls limit the damage.
Intermediate11 min read
- Prompt injection
- OWASP LLM Top 10
- AI security
- NIST AI 100-2
- MITRE ATLAS
- LLM agents
Network security
AI model security by lifecycle stage: poisoning, pickles and theft
A five-stage checklist for protecting AI models, from data poisoning and code-running pickle files to model theft, based on NIST, NCSC/CISA, OWASP and ATLAS.
Advanced11 min read
- AI Security
- Machine Learning
- Supply Chain
- NIST AI RMF
- OWASP
- MITRE ATLAS
Network security
Phishing-resistant MFA: why passkeys beat codes and push prompts
One-time codes and push prompts can still be phished or fatigued. How FIDO2/WebAuthn passkeys bind sign-in to the real domain, and synced vs device-bound.
Beginner10 min read
- MFA
- passkeys
- WebAuthn
- FIDO2
- phishing
- identity
Network security
How SIEM and SOAR fit together: logs, alerts and playbooks
A SIEM collects, normalises and correlates logs into alerts; SOAR runs playbooks on them. Covers priority logs and Sigma rules, per NIST and ASD/CISA guidance.
Beginner10 min read
- SIEM
- SOAR
- logging
- detection
- Sigma
- CISA
- NIST
Network security
How a phishing email gets past SPF, DKIM and DMARC
One fictional phishing email, checked by SPF, DKIM and DMARC: what each verifies, why p=none and look-alike domains let it through, and what to do if you click.
Beginner8 min read
- Phishing
- Email security
- SPF
- DKIM
- DMARC
- MITRE ATT&CK
Network security
What a firewall sees in a TLS 1.3 handshake, message by message
Walk a TLS 1.3 handshake in Wireshark from ClientHello to Finished: why SNI stays visible, the certificate does not, and 0-RTT can be replayed.
Intermediate11 min read
- TLS
- TLS 1.3
- Decryption
- Firewalls
- Wireshark
- Cryptography
Network security
What DNSSEC, DoH and DoT protect, and what's left for your logs
DNSSEC proves a DNS answer wasn't forged, DoT and DoH encrypt the hop to your resolver, and logs plus protective DNS help you spot DNS tunnels.
Intermediate10 min read
- DNS
- DNSSEC
- DoH
- DoT
- Protective DNS
- Threat Detection
Network security
SD-WAN picks the path, SASE moves the inspection to the cloud
SD-WAN measures each link and moves flows to the path that meets the SLA; SASE moves SWG, FWaaS, CASB and ZTNA into cloud PoPs. Based on NIST SP 800-215.
Intermediate9 min read
- SD-WAN
- SASE
- ZTNA
- SWG
- CASB
- FWaaS
- Prisma Access
- Zscaler
- NIST
- network design
Network security
NIST SP 800-61r3 incident response: a phase-by-phase checklist
NIST SP 800-61r3 recasts incident response as a CSF 2.0 profile. What changed from r2, plus the questions to ask before, during and after an incident.
Intermediate10 min read
- Incident Response
- NIST
- CSF 2.0
- CISA
- Checklist
Network security
Zero trust explained: what NIST SP 800-207 actually asks for
Zero trust is a set of principles, not a product. NIST SP 800-207's seven tenets, the PE/PA/PEP decision loop and CISA's maturity model, in plain terms.
Beginner9 min read
- zero trust
- NIST
- CISA
- identity
- MFA
- architecture
Network security
Change windows: write and test the rollback before you start
A before, during and after checklist for firewall changes: written go/no-go checkpoints, config snapshots and a tested rollback, mapped to NIST SP 800-128.
Intermediate9 min read
- Change Management
- Rollback
- Firewalls
- NIST
- SRE
- Checklist
Network security
Inside a firewall HA failover: heartbeats, session sync, failback
How Palo Alto, FortiGate and Cisco FTD pairs detect a failure, sync sessions, move the virtual MAC and fail back, and how to test it safely.
Advanced11 min read
- High Availability
- Firewalls
- Palo Alto
- FortiGate
- Cisco FTD
- VRRP
- Change Management
Network security
PAN-OS packet flow: six stages and up to three policy checks
The six stages of PAN-OS packet flow, from ingress through session setup and App-ID to egress, and why security policy can be checked up to three times.
Intermediate6 min read
- Palo Alto
- PAN-OS
- Firewalls
Network security
What you still own in the cloud: the shared responsibility model
How AWS, Microsoft and Google Cloud split security duties across IaaS, PaaS and SaaS, and why identity, data and configuration always stay with you.
Beginner9 min read
- cloud
- shared responsibility
- IaaS
- PaaS
- SaaS
- IAM
- logging
- misconfiguration
Network security
Find a port scan and a password spray in firewall and auth logs
Practise on synthetic logs: read syslog and PAN-OS traffic fields, find a port scan and a password spray (event 4625), then link them by time and source.
Intermediate12 min read
- Logging
- Firewall Logs
- Windows Event 4625
- Port Scan
- Password Spraying
- MITRE ATT&CK
- NIST SP 800-92
Network security
PAN-OS, Cisco FTD and FortiGate: how zones, NAT and HA differ
How PAN-OS, Cisco FTD and FortiGate handle zones, rule order, NAT versus policy, application identification and HA, with Huawei USG in brief.
Intermediate5 min read
- Firewalls
- Palo Alto
- Cisco
- Fortinet
Network security
6 password hashing myths, checked against OWASP and NIST
Store passwords with a slow, salted hash such as Argon2id, not SHA-256 or encryption. Six myths checked against OWASP, NIST SP 800-63B-4 and RFC 9106.
Advanced11 min read
- password hashing
- Argon2id
- bcrypt
- scrypt
- PBKDF2
- NIST
- OWASP
- salt
- pepper
Network security
Five network segmentation myths, checked against CISA and NIST
VLANs alone are not segmentation. Five common myths checked against CISA, NIST and MITRE guidance, plus a default-deny rollout and ways to test it.
Beginner10 min read
- network segmentation
- microsegmentation
- zero trust
- lateral movement
- MITRE ATT&CK
- CISA
- NIST
- firewalls
Network security
Inside IKEv2: bringing up an IPsec tunnel one exchange at a time
Walk through IKE_SA_INIT, IKE_AUTH, Child SAs and ESP on a site-to-site IPsec tunnel, then a 7-step checklist for when the tunnel won't come up.
Advanced14 min read
- IPsec
- IKEv2
- VPN
- ESP
- Troubleshooting
- Firewalls
Network security
Spotting lateral movement in Windows logs and east-west traffic
Which Windows logon events (4624, 4625, 4648, 4672) and east-west traffic patterns reveal lateral movement, and how segmentation, LAPS and tiering contain it.
Advanced16 min read
- lateral movement
- MITRE ATT&CK
- Windows event logs
- detection engineering
- Windows LAPS
- tiered administration
- network segmentation
- SIEM
Network security
Scrub secrets from network configs before you share them
Where passwords, keys, SNMP communities and tokens hide in config backups and repos, how to redact them, and why you rotate before you clean up history.
Intermediate11 min read
- secrets management
- credentials
- sanitising
- config backups
- gitleaks
- GitHub secret scanning
- OWASP
- MITRE ATT&CK
- CWE-798
Network security
How STIX 2.1 and TAXII 2.1 make threat intel machine-readable
Build a STIX 2.1 bundle step by step, see how TAXII 2.1 moves it, and why the Pyramid of Pain says behaviour-level intel costs attackers more than IPs.
Advanced10 min read
- Threat intelligence
- STIX
- TAXII
- Pyramid of Pain
- MISP
- SIEM
- Firewalls
Network security
Log4Shell in hindsight: what firewalls could and couldn't stop
How CVE-2021-44228 spread in December 2021, why egress filtering could stop its second stage, and where IPS signatures and network controls fell short.
Advanced5 min read
- Vulnerabilities
- Log4Shell
- CISA