CORS: Cross-Origin Resource Sharing
There is a security boundary in every browser that developers eventually run into.
Read article: CORS: Cross-Origin Resource SharingSecurity
111 articles tagged Security.
Old Rules, New Tools: Why Pre-AI Security Fundamentals Still Win
Recently, Accuknox invited me to participate as a guest on a webcast discussing why pre-AI security fundamentals still matter.
Read article: Old Rules, New Tools: Why Pre-AI Security Fundamentals Still Win
OAuth 2.1: How OAuth 2.0 Evolved into a More Secure Authorization Framework
Disclaimer: This article was written in Q3,2026. It is current as of that date. The OAuth 2.1 draft proposals have not yet been published as an RFC. So, some changes could still occur. Given the late stage of the process, it is unlikely it will change that much, but be aware that some changes could…
Read article: OAuth 2.1: How OAuth 2.0 Evolved into a More Secure Authorization Framework
Model Context Protocol: MCP, OAuth2, and the Identity Problem of Agentic AI
The Model Context Protocol, or MCP, has quickly become one of the most important pieces of infrastructure in the emerging Agentic AI ecosystem.
Read article: Model Context Protocol: MCP, OAuth2, and the Identity Problem of Agentic AI
Redaction in LLM Security: Sometimes the AI Doesn’t Need to Know
One of the most powerful security controls in an AI system is also one of the least glamorous:
Read article: Redaction in LLM Security: Sometimes the AI Doesn’t Need to Know
OAuth2 + OIDC + Delegation: An example
Delegation is a concept that has always fascinated me in the identity space. It enables secure identity propagation with tokens (assertions, tickets, etc) being properly scoped. As functionality in my Identity Protocol Debugger has continued to evolve, I wanted to add a feature that would make it…
Read article: OAuth2 + OIDC + Delegation: An example
Data Masking: Because Sometimes the Best Way to Protect Data Is to Stop Showing It
There is a simple idea hiding underneath a lot of enterprise data security in that If someone doesn’t need to see the real data, don’t show them the real data.
Read article: Data Masking: Because Sometimes the Best Way to Protect Data Is to Stop Showing It
Hardware Security Modules (HSMs)
There is a certain type of security engineer who hears the words Hardware Security Module and immediately pictures something the size of a washing machine, installed in a locked rack, surrounded by three layers of physical security, two security cameras, and a person whose entire job appears to be…
Read article: Hardware Security Modules (HSMs)
Content Security Policy: Putting the Browser on a Security Diet
Web applications have become remarkably powerful.
Read article: Content Security Policy: Putting the Browser on a Security Diet
The Digital Dead: Existence Beyond Death Online
I started thinking about this post a while back when I saw a former colleague’s Medium profile still listed as following mine. He died in the early days of covid. A quick check showed that his LinkedIn profile seems to have disappeared — not sure how that works. It was still there a few years ago.
Read article: The Digital Dead: Existence Beyond Death Online