← Home

Scott's Lab

Changelog — 5 articles

Download the archive

All articles as PDF
Each article as PDF (zip)

All (70)
Secure Software Development (2)
Employee Safety & Emergency Planning (2)
Incident Response (5)
Security Principles & Privileged Access (2)
Cybersecurity Investigations & Forensics (5)
Security Program Assessment (5)
Disaster Recovery (3)
Code Testing & Secure Development (5)
Log Reviews & Monitoring (5)
Penetration Testing (5)
Vulnerability Management (3)
Social Engineering & Access Control Attacks (3)
Kerberos, NTLM & Authorization (4)
Accountability & Account Management (5)
Identification & Authentication (8)
Home Lab & Infrastructure (8)

No articles in Cybersecurity Investigations & Forensics yet. View all articles.

Secure Software Development (2)

Measuring How Grown-Up Your Process Is: CMMI, IDEAL, and SAMM Sep 18, 20264 min read
From Waterfall to SAFe: How Software Actually Gets Built Sep 18, 20264 min read

Employee Safety & Emergency Planning (2)

Emergency Management: Plans That Match the Actual Threat Sep 16, 20264 min read
Employee Safety Comes First. Everything Else Is Negotiable Sep 16, 20263 min read

Incident Response (5)

Closing the Incident: Validation, Lessons Learned, and What You Keep Sep 14, 20264 min read
Eradication and Recovery: Getting the Attacker Out and Staying Out Sep 14, 20264 min read
Detection, Triage, and Containment: The First Hour Sep 11, 20264 min read
Building and Staffing the Incident Response Team Sep 11, 20264 min read
Writing an Incident Response Plan Before You Need One Sep 9, 20264 min read

Security Principles & Privileged Access (2)

Privileged Access Management: Taking the Keys Out of People's Hands Sep 9, 20265 min read
Need-to-Know vs. Least Privilege: Two Different "No"s Sep 7, 20265 min read

Cybersecurity Investigations & Forensics (5)

Telling People and Handing It Over: Incident Reporting and eDiscovery Sep 7, 20264 min read
Where Digital Evidence Lives — and How to Keep It Admissible Sep 4, 20263 min read
Digital Forensics Principles: Never Touch the Original Sep 4, 20264 min read
Evidence That Actually Holds Up: Types and Admissibility Sep 2, 20264 min read
Four Kinds of Investigation, Four Bars of Proof Sep 2, 20263 min read

Security Program Assessment (5)

Control Testing, Exceptions, and Compensating Controls Aug 31, 20261 min read
Audits vs. Assessments: Who's Asking, and How Formal It Gets Aug 31, 20262 min read
KPIs vs. KRIs: Measuring the Program You Have and the Risk You're Taking Aug 28, 20261 min read
Watching the Watchers: Management Reviews and Privileged Access Aug 28, 20261 min read
Security Data and Documentation: If It Isn't Recorded, It Didn't Happen Aug 24, 20263 min read

Disaster Recovery (3)

Backup Strategies: Full, Differential, Incremental — and Actually Getting Data Back Aug 26, 20262 min read
Disaster Recovery Fundamentals: RTO, RPO, and Somewhere Else to Run Aug 26, 20262 min read
Testing the Plan: DR Exercises and the After-Action Report Aug 24, 20264 min read

Code Testing & Secure Development (5)

Building Security In: The Secure SDLC and Test Coverage Aug 21, 20264 min read
Code Repositories and Third-Party Code: Where Your Risk Actually Lives Aug 21, 20264 min read
Fuzzing and Misuse Cases: Testing Like Someone Who Wants It to Break Aug 19, 20264 min read
SAST, DAST, IAST: Three Ways to Test Code, and Why You Need All of Them Aug 19, 20264 min read
Code Review, Done Formally: The Fagan Inspection Aug 17, 20264 min read

Log Reviews & Monitoring (5)

Continuous Monitoring: Turning Logs Into Ongoing Awareness Aug 17, 20262 min read
SOAR: When the SIEM Stops Watching and Starts Acting Aug 16, 20264 min read
SIEM: Turning a Pile of Logs Into a Story Aug 16, 20261 min read
The Syslog Standard: Facilities, Severities, and Which Variant to Run Aug 16, 20262 min read
Log Sources: What to Collect Before You Can Analyze Anything Aug 15, 20261 min read

Penetration Testing (5)

Red, Blue, and Purple Teams: Running the Fight on Purpose Aug 15, 20262 min read
Bug Bounty Programs: Paying Attackers to Be on Your Side Aug 15, 20261 min read
Zero-Days and Responsible Disclosure: The Window Nobody Can Patch Yet Aug 14, 20261 min read
How a Pen Test Actually Runs: Discovery, Attack, and Leaving No Trace Aug 14, 20262 min read
Vulnerability Testing vs. Penetration Testing (and Why the ROE Comes First) Aug 13, 20262 min read

Vulnerability Management (3)

Reading the Report: Triage, False Positives, and the Analyst Who Cried Wolf Aug 13, 20262 min read
Picking and Configuring What You Scan Aug 12, 20262 min read
What Vulnerability Management Actually Is (and Why You're Doing It) Aug 12, 20261 min read

Social Engineering & Access Control Attacks (3)

Watering Holes and Tailgating: Attacking Where People Already Trust Aug 11, 20262 min read
Impersonation, Pretexting, and Identity Fraud: The Story Is the Weapon Aug 11, 20262 min read
Social Engineering: Hacking the Human, and How to Make It Harder Aug 10, 20262 min read

Kerberos, NTLM & Authorization (4)

Database Authorization: Roles, Grants, and Locking It to Business Hours Aug 10, 20261 min read
RBAC and ABAC: Roles vs. Attributes Aug 9, 20261 min read
MAC and DAC: Who Actually Decides Who Gets In Aug 9, 20262 min read
Kerberos, NTLM, and the Ticket That Runs Your Network Aug 9, 20264 min read

Accountability & Account Management (5)

Password Policies, Group Policy, and What NIST Changed Aug 8, 20266 min read
Joiners, Movers, Leavers — and Watching the Accounts In Between Aug 8, 20261 min read
Least Privilege, Segregation of Duties, and the Slow Rot of Privilege Creep Aug 8, 20261 min read
Account Types, and Why You Don't Do Daily Work as Admin Aug 7, 20262 min read
Accountability: Making Every Action Traceable Aug 7, 20262 min read

Identification & Authentication (8)

Catching Auth Attacks: Brute Force, Credential Stuffing, MFA Fatigue Aug 6, 20262 min read
Sessions vs. Tokens: Cookies, JWTs, and Where Each One Bites Aug 6, 20262 min read
OAuth 2.0 and OIDC, Explained by Wiring Up My Own Admin Login Aug 5, 20262 min read
Why Passwords Keep Losing: MFA, Passkeys, and Account Takeover Aug 5, 20262 min read
Onboarding an Identity: Registration and Identity Proofing Aug 4, 20262 min read
Biometrics: When You Are the Credential Aug 4, 20261 min read
Proving Identity, Part 1: Usernames and Access Cards Aug 3, 20262 min read
Identification, Authentication, Authorization — and the Accounting Nobody Talks About Aug 3, 20262 min read

Home Lab & Infrastructure (8)

Hacking with AI: What Security Engineers Get Wrong (and What Moltbot Proved) Jul 28, 202617 min read
Building a Forensic Evidence Pipeline: Workstation to Evidence Locker Jul 7, 20263 min read
Why I Use CSI Linux as My Digital Forensics Workstation Jun 9, 202612 min read
Ansible Alternative: Why I Use Action1 for Windows Management May 5, 202611 min read
Ansible & Ludus: Automating a Home Lab with Infrastructure as Code Apr 7, 202611 min read
Building a Home Lab SIEM: Wazuh Deployment with Custom Detection Rules Mar 10, 20264 min read
Infrastructure Security Hardening: Firewall Audit, IDS Tuning, and SIEM Alert Management Feb 11, 202612 min read
Stop Feeding Your Secrets to ChatGPT 🔀 Jan 29, 202610 min read

about tooling portfolio newsletter @scottslabio github

© Scott S.