The Certified Information Systems Security Professional (CISSP) offers three advanced courses, each focusing on a specialized area of cybersecurity: * ISSEP — Information Systems Security Engineering ProfessionalSecure systems engineering and integrationSystems engineers, architects, and security integration professionals * ISSMP — Information Systems Security Management ProfessionalLeadership and management of security programsCISOs, program managers, and senior
Container scanning and why Trivy? As a matter of fact does anyone use any other tool? Think of containers as the Old server setup. There used to be a vulnerability scanner, which wouldnt identify all vulnerabilities and the severity level, so we could either do a scan before provisioning services
Why Infrastructure as Code (IaC) Came Along Before IaC, managing infrastructure was manual, error-prone, and inconsistent. Engineers had to manually configure servers, networks, and cloud resources, leading to: * Configuration drift: Environments deviating from the intended state. * Slow provisioning: Setting up infrastructure took days or weeks. * Scalability issues: Manually adding/removing
This TLDR document outlines application deployment evolution from monolithic systems to serverless, highlighting the shift in security practices. Initially focused on perimeter defense, security evolved to include VM, container, and API protection. Now, in cloud-native environments, it emphasizes IAM, automation, and AI-driven threat detection, reflecting the DevSecOps integration. 1. Monolithic
Secrets (passwords, API keys, database credentials, etc.) are essential for applications to function, but their improper handling is a major security risk. Exposing secrets can lead to data breaches, system compromise, and significant financial and reputational damage. Secret Detection & Runtime Security Session 2: Secret Detection - Enhanced What are
Why DevSecOps? With the rise of cloud computing and rapid software delivery (MVPs, Agile, CI/CD), traditional security models fall short. DevSecOps solves this by embedding security into the development lifecycle. Security must shift left—starting at development—to ensure it's continuous, automated, and integrated without slowing delivery.
Considered through two distinct approaches: threat modeling from code and threat modelling with code. Automating threat modeling depends on various systems, processes, and procedures that exist within an environment, ensuring tailored analysis and mitigation strategies aligned with the specific architecture and operations. Threat modelling from code involves processing system information
To follow the series — https://vkfrost.com/tag/threat-modelling/ As Adam Shostack states, “A good threat model is one that produces valid findings.” Threat modelling employs different methodologies to produce useful outcome, These outcome are shaped by factors that vary across different development stages: * Stage 1: No Previous Security Goals
PS. These are notes from the Threat Modelling: A Practical Guide for Development Teams Book and other articles linked below. Follow the series on; https://vkfrost.com/tag/threat-modelling/ Threat modelling is a concept that many organisations engage in to some extent but may not have fully defined. Before a
The tech industry has long been seen as a beacon of innovation and job security, but recent events have proven otherwise. In the beginning of 2021, we saw massive layoffs from both big tech firms and startups. Careers in the tech industry were hit hard, with Crunchbase recording a staggering
Cybersecurity | Application Security | Cloud Security I am a cybersecurity engineer with over seven years of experience across application, endpoint, and infrastructure security, focused on automation-driven, scalable security solutions, maintaining delivery velocity, and supporting regulated, high-availability platforms. This blog highlights projects I have worked on, with an emphasis on technical challenges,
This provides a summary of the tools I use to perform Android Pentest. Setting up the Environment. * Physcial device * ADB tools * APKTOOL * Jadx-GUI * Mobsf * Burpsuite Community edition * Frida and Objection * Drozer Toiled for a month trying to jailbreak my phone. Well I deleted my entire bootloader. Crashed the phone and