Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
Sometime around 2012, I published a similar list (up to the point of APIs). I recently put the same list in another post. I thought having this as its own post would be useful, or, at least, amusing.
Read article: Begotten & Forgotten Distributed Service TechnologiesIn a previous post, we made a point of “Non-Prod Environments Must Have The Same Security Protections As Production”. In this post, we’re going to go one step further and say that your internal and external endpoints, generally, should have the same security capabilities baked into their security…
Read article: Internal Endpoints Must Have The Same Security Capabilities As External EndpointsI have the ability to be a profound jackass. So, most feedback that’s been included in yearly reviews is probably fair. But, fifteen, plus, years ago, I did get one annual review that had one negative remark on it that bothered me then and still does to this day.
Read article: The Yearly Review Feedback That I Could Never AcceptI’ve discussed APIs and API Management in previous blog posts. These are among my older blog posts, but the points being made are, generally, still relevant. I’ve never published a blog post exclusively about API design. I have a blog post about “API Gateways and Multiple Consumer Types” where I…
Read article: API Design: Planned, Unplanned, Security and Utter ChaosI’ve been wanting to use this as a title for a blog post for a while now. It’s actually one of the quotes I have in my personal email signature. The open question has been what the topic of this blog post should be. There are so many asinine stories from fifteen years of consulting that could be…
Read article: Any Day Your Socks Don’t Burst Into Flames Is A Good DayYour non-production environments must have the same security capabilities as your production environment.
Read article: Non-Prod Environments Must Have The Same Security Protections As ProductionOver the course of my consulting career, I’ve been brought into organizations to troubleshoot “weird” problems on several occasions — those stories for another time. These engagements are often fun; though, can be very challenging. The organizations where we had the most success in tracking down…
Read article: Ability To Do Point In Time Restore / Rebuild Of EnvironmentsDigital sovereignty refers to a nation’s ability to control, regulate, and secure its digital infrastructure, data, platforms, and technological ecosystem in accordance with its own laws, values, and strategic interests.
Read article: What Is Digital Sovereignty?Your production environment should be isolated from your non-production environments. In fact, every application environment should be isolated from every other environment. Sounds simple in practice, but how does one accomplish this? Through a multi-layered isolation strategy:
Read article: Achieving Application Environment IsolationBut, let’s face it, you’re probably going to do it anyway.
Read article: No, You Shouldn’t Use Production Data For TestingLooking for something specific? Browse all 124 topics.
