Topic domain
Security Engineering
Threat models, attack surfaces, and defenses that hold.
- Articles
- 80
- Clusters
- 8
- Foundational
- 24
- Intermediate
- 32
- Advanced
- 24
Assets, adversaries, and attack trees.
- Trust Boundaries in Data Flow Diagrams and Where Threats Localize
- Assets as Security Properties Rather Than Components
- Adversary Capability Models and the Assumptions They Encode
- Attack Tree Semantics: AND/OR Nodes and the Cost of the Cheapest Path
- Applying STRIDE per Element Instead of per System
- Attack Graphs, Shared Subgoals, and Shortest Paths Through State Space
Injection, XSS, and request forgery.
- SQL Injection as a Failure of the Tokenization Boundary
- HTML Parsing Contexts and Why One Escape Function Is Never Enough
- How a Browser Computes an Origin, and Why Ports and Schemes Count
- Cross-Site Request Forgery and the Problem of Ambient Authority
- Header Splitting: When a Value Becomes a Field Boundary
- DOM XSS: Sources, Sinks, and Why the Server Never Sees the Payload
Password handling, MFA, and session security.
- Salted Password Hashing and the Cost of a Verification
- Constant-Time Comparison in Credential Checks
- How Cookie Attributes Bound a Session Credential
- Session Fixation and Why Identifiers Must Rotate
- Opaque Session Identifiers Versus Signed Tokens
- TOTP Time Steps, Drift Windows, and Code Replay
Access control models and policy enforcement.
- Reference Monitors and Complete Mediation in Access Control
- POSIX Mode Bits, umask, and the ACL Mask Interaction
- Role Hierarchies and the Reachability Problem in RBAC
- Attribute-Based Policy Evaluation and Combining Algorithms
- Object Capabilities and the Confused Deputy
- Relationship Graphs and How ReBAC Checks Resolve Access
Firewalls, segmentation, and detection.
- How a Stateful Firewall Matches a Packet
- VLAN Segmentation and the Limits of Layer 2 Isolation
- Connection Tracking Under NAT
- Application Proxy Firewalls and Parser Differentials
- Microsegmentation and Policy at the Workload Boundary
- Multi-Pattern Matching in Network Intrusion Detection
Memory corruption and mitigation design.
- Stack Frame Layout and Why a Linear Overflow Reaches the Return Address
- How the PLT and GOT Turn a Library Call Into Writable Memory
- NX and the End of Injected Shellcode
- Return-to-libc and the Argument Staging Problem
- Where Address-Space Randomisation Gets Its Entropy
- Stack Canaries and the Value That Terminates the Overflow
Build integrity and dependency trust.
- How Dependency Resolvers Turn Version Ranges into a Fixed Graph
- What a SHA-512 Integrity Hash in Package Metadata Actually Proves
- Identity in SBOMs: PURLs, CPEs, and Why Names Do Not Join
- Dependency Confusion and the Order Registries Are Consulted
- Reproducible Builds: The Sources of Nondeterminism in Compiler Output
- Provenance Attestations and the Digest They Must Bind
Detection, containment, and forensics.
- Process Start Records as the Unit of Execution Evidence
- Clock Skew and the Limits of Cross-Host Event Ordering
- Disk Image Integrity and Chain of Custody Mechanics
- Containment Through Network Isolation at the Packet Layer
- What Live Memory Acquisition Changes While It Reads
- Behavioral Detection versus Indicator Matching in Alert Pipelines
All Security Engineering articles
- Oct 10, 2026 Where Address-Space Randomisation Gets Its Entropy Which regions are randomised, how many bits of entropy each actually receives, and why a single leaked pointer can undo the whole arrangement.
- Sep 24, 2026 Shadow Stacks, Pointer Authentication, and Memory Tagging in Silicon Three hardware answers to memory corruption differ in what they protect and what they cost: a second return stack, signed pointers, and per-allocation tags checked on every access.
- Aug 26, 2026 VLAN Segmentation and the Limits of Layer 2 Isolation How 802.1Q tags create separate broadcast domains on shared hardware, why trunk links and layer 3 boundaries decide whether isolation holds, and where VLAN hopping attacks get their leverage.
- Aug 1, 2026 Attribute-Based Policy Evaluation and Combining Algorithms How XACML-style policies decide by matching attributes and combining rule effects, why deny-overrides is not the same as first-applicable, and what obligations and indeterminate results cost.
- Jul 16, 2026 The Places Parameter Binding Cannot Reach Identifiers, sort direction, operators, and collation are resolved before execution, so binding cannot protect them; the designs that survive are structural.
- Jul 10, 2026 Multi-Pattern Matching in Network Intrusion Detection How signature engines match thousands of byte patterns against a reassembled stream with one pass, why normalisation decides what the engine actually sees, and where matching still fails.
- Jul 9, 2026 Return-to-libc and the Argument Staging Problem Reusing an existing function needs its arguments placed where the calling convention expects them, and the stack arithmetic that makes this possible also limits which functions a chain can call.
- Jul 4, 2026 Constrained Delegation and Token Exchange in OAuth 2.0 How the token exchange grant carries a subject through a chain of services, what scopes and audience restrict, and why impersonation and delegation differ in what the audit log records.
- Jun 14, 2026 SQL Injection as a Failure of the Tokenization Boundary Why a database cannot distinguish a value from a statement once they are concatenated into one string, and how separate parameter transport restores the boundary.
- May 5, 2026 POSIX Mode Bits, umask, and the ACL Mask Interaction How the nine permission bits, the setuid and sticky bits, umask filtering, and POSIX ACL entries combine into one effective permission, and why chmod rewrites an ACL mask.
- May 4, 2026 Remote Blackholing and FlowSpec Distribution How a network tells its upstream to drop traffic for a specific prefix or flow, why the trigger is a BGP route rather than a firewall rule, and what collateral damage the mechanism accepts by design.
- May 3, 2026 VEX: Encoding Exploitability So a Scanner Can Stop Guessing A CVE in an SBOM is not a finding. VEX records whether a product is affected and why, with a justification token that a machine can act on and a human can audit.
- Apr 29, 2026 Process Start Records as the Unit of Execution Evidence Why the parent-child relationship and process start time are the two facts an investigation needs first, what records the kernel actually keeps, and where those records disappear.
- Apr 16, 2026 Attack Graphs, Shared Subgoals, and Shortest Paths Through State Space How an attack graph differs from an attack tree, why shared subgoals force a DAG, and how monotone reachability analysis computes the closure of what an attacker can obtain.
- Feb 24, 2026 Identity in SBOMs: PURLs, CPEs, and Why Names Do Not Join An SBOM is only as useful as its keys. Component identity schemes disagree about what a component is, and vulnerability matching fails where they disagree.
- Feb 24, 2026 Server-Side Request Forgery and the Address the Server Can Reach Why filtering a user-supplied URL is a parsing problem with a resolution step attached, and where DNS, redirects, and IPv6 forms defeat the check.
- Feb 20, 2026 Policy as Code: Decision Engines and Deterministic Evaluation How a general-purpose policy engine turns rules into a decision, why partial evaluation produces residual queries, and what non-determinism costs an authorization system.
- Feb 20, 2026 Reproducible Builds: The Sources of Nondeterminism in Compiler Output Two builds of identical source differ because something in the environment leaked into the artifact. The taxonomy of those leaks, and the normalizations that remove them.
- Jan 28, 2026 DOM XSS: Sources, Sinks, and Why the Server Never Sees the Payload How client-side flow from attacker-controlled input to an executing sink bypasses server-side encoding, and which of the flow-tracking approaches can follow the value.
- Jan 24, 2026 Relationship Graphs and How ReBAC Checks Resolve Access How relationship tuples model authorization as graph traversal, why depth-bounded checks are the practical answer, and where cycles and fan-out break naive evaluation.
- Jan 8, 2026 Role Hierarchies and the Reachability Problem in RBAC How role-based access control assigns permissions through roles, why the role hierarchy is a partial order, and why reachability queries and separation-of-duty constraints dominate evaluation cost.
- Jan 6, 2026 Augmented PAKE and What a Stolen Verifier Costs an Attacker How a password-authenticated key exchange lets a server store a value that is not a password hash, and why that changes the economics of a database breach without making weak passwords safe.
- Dec 20, 2025 Header Splitting: When a Value Becomes a Field Boundary How CR and LF terminate header fields on the wire, what modern servers do to reject them, and why the response body and the request line need separate treatment.
- Dec 5, 2025 How Dependency Resolvers Turn Version Ranges into a Fixed Graph A manifest states constraints, not versions. Resolution is a search over the version space, and the lockfile is the memoized answer that makes a build repeatable.
- Oct 22, 2025 How a Browser Computes an Origin, and Why Ports and Schemes Count The tuple comparison behind the same-origin policy, the opaque origins that never match anything, and the document.domain exceptions that weaken the rule.
- Oct 9, 2025 Detecting DNS Tunnels from Query Structure How DNS becomes a bidirectional data channel, which structural properties of queries carry the signal, and why entropy alone is a weak discriminator against legitimate naming schemes.
- Oct 8, 2025 Application Proxy Firewalls and Parser Differentials What a layer 7 proxy gains by terminating and re-originating a connection, why the parser it runs becomes an attack surface, and how two systems disagreeing about the same bytes creates a bypass.
- Oct 4, 2025 Heap Chunk Metadata and Why tcache Changed the Exploit Shape How glibc lays out an allocated chunk, what the free-list pointers in a freed chunk mean, and how a per-thread cache with no consolidation turned a single overflow into an arbitrary allocation.
- Sep 30, 2025 NX and the End of Injected Shellcode Marking the stack and heap non-executable removed the simplest payload, and the cost of that removal is paid on every page table entry and every legitimate JIT.
- Sep 14, 2025 What Live Memory Acquisition Changes While It Reads Why the act of capturing physical memory alters the state being captured, which artifacts survive the read, and the ordering rules that follow from the perturbation.
- Aug 31, 2025 Hermetic Builds: Isolating the Network, the Clock, and the Filesystem A build that can read the network, the clock, or the ambient filesystem is not a function of its source. Isolation removes those channels and makes the input set explicit.
- Aug 19, 2025 Flow Records and Traffic Baselining How routers summarise traffic into flow records, what the cache timeouts decide about those records, and which questions the resulting telemetry can and cannot answer.
- Jul 30, 2025 Object Capabilities and the Confused Deputy How unforgeable references replace identity checks, why ambient authority enables the confused deputy, and what membrane and revocation designs cost in a capability system.
- Jul 2, 2025 CSP Nonces and the Script Gadgets That Survive Them How a nonce marks the scripts a policy permits, why whitelisting a host also authorises every script on it, and how existing library code becomes an execution path.
- Jun 28, 2025 Keeping a Threat Model Current When the System Changes How to bind threats to the artifacts that encode their assumptions, what invalidates a model silently, and how diffing architecture against model finds the stale entries before an audit does.
- Jun 16, 2025 Gadget Chains as a Programming Language, and What CFI Restricts A chain of short instruction sequences ending in ret is computationally complete, and control-flow integrity is an attempt to bound where those sequences may begin and end.
- Jun 14, 2025 Attack Nets, Concurrency, and the State-Space Explosion How Petri-net attack models represent parallel attacker actions and partial progress, why the reachability graph grows faster than exponentially, and which reductions keep analysis tractable.
- May 23, 2025 Attack Tree Semantics: AND/OR Nodes and the Cost of the Cheapest Path How attack trees represent alternative and conjunctive attacker actions, how cost and probability propagate through the two node types, and why the cheapest path is rarely the most likely one.
- May 15, 2025 How a Format String Becomes an Arbitrary Write The %n conversion stores a count through a pointer the caller supplies on the stack, and variadic argument handling makes that pointer reachable from the format itself.
- Apr 29, 2025 Cross-Site Request Forgery and the Problem of Ambient Authority Why a browser attaches cookies to requests it did not intend to make, which request shapes are reachable without a script, and how token binding restores an intent check.
- Apr 26, 2025 Clock Skew and the Limits of Cross-Host Event Ordering Where host clocks diverge, how much error an unsynchronized timeline carries, and which ordering conclusions survive when timestamps from different machines are merged.
- Apr 25, 2025 Attack-Defense Trees and Countermeasure Selection as a Two-Player Problem How adding defender nodes changes attack tree semantics from satisfiability to a game, what min-max evaluation computes, and why the defender moving first or second changes the answer.
- Apr 21, 2025 Assets as Security Properties Rather Than Components Why an asset inventory keyed by server names produces useless threat lists, how to decompose a system into confidentiality, integrity, and availability assets, and what ownership of each asset implies.
- Feb 25, 2025 What a SHA-512 Integrity Hash in Package Metadata Actually Proves Subresource Integrity, package lockfile digests, and Go checksums look alike but answer different questions about who computed the hash and what it covers.
- Jan 21, 2025 Stack Canaries and the Value That Terminates the Overflow A per-process guard word placed between the buffer and the saved return address converts a silent hijack into a detected abort, and its design depends on which byte patterns an overflow cannot write.
- Jan 17, 2025 Authorization Models for Multi-Tenant Data Isolation How tenant identity must be bound into every query and token, why row-level filtering fails when it is optional, and what isolation guarantees separate deployments actually provide.
- Dec 27, 2024 Factor Independence and the Paths That Bypass MFA Why the assurance of two factors is the product of their independence, and how fallback, enrolment, and recovery paths quietly collapse a two-factor system to one.
- Dec 12, 2024 Trust Boundaries in Data Flow Diagrams and Where Threats Localize How a data flow diagram encodes trust as lines rather than prose, why a boundary is only real where a principal loses authority, and how moving one line changes the entire threat list.
- Dec 7, 2024 Dependency Confusion and the Order Registries Are Consulted When a build resolves a private package name against a public registry, an attacker can claim the name first. The mechanism is registry precedence, not a bug.
- Nov 29, 2024 Containment Through Network Isolation at the Packet Layer Why disabling an account does not stop an intrusion, and how switch port filters, ACLs, and quarantine VLANs differ in what they actually block.
- Nov 22, 2024 Reference Monitors and Complete Mediation in Access Control Why an access check only means something if every access passes through it, how the policy decision point is separated from the enforcement point, and where check-then-use gaps appear.
- Oct 13, 2024 Disk Image Integrity and Chain of Custody Mechanics What a hash establishes about a disk image, why acquisition order determines what the image can prove, and how write blockers and hashing after the fact differ in evidentiary value.
- Sep 5, 2024 The WebAuthn Ceremony and Origin Binding What the browser signs, what the relying party verifies, and why the challenge and the origin check are what make the credential resistant to relay and phishing.
- Aug 7, 2024 Adversary Capability Models and the Assumptions They Encode How an attacker profile is really a list of things the attacker cannot do, why network position and time budget dominate the labels, and where capability tiers mislead.
- Jun 26, 2024 TOTP Time Steps, Drift Windows, and Code Replay How a shared secret and a counter quantised to thirty seconds produce a six-digit code, why the verifier searches a window, and what makes a used code reusable.
- Jun 19, 2024 Opaque Session Identifiers Versus Signed Tokens How server-side session lookup and self-contained signed tokens differ in revocation, verification cost, and failure behaviour when a key or a datastore goes away.
- May 13, 2024 How the PLT and GOT Turn a Library Call Into Writable Memory Lazy binding keeps resolution out of process startup by routing calls through a stub that patches a table, which leaves a writable function pointer for every imported symbol.
- Apr 27, 2024 Stack Frame Layout and Why a Linear Overflow Reaches the Return Address How the System V x86-64 frame places locals, the saved frame pointer, and the return address, and why writing past a buffer lands on control data.
- Feb 16, 2024 Behavioral Detection versus Indicator Matching in Alert Pipelines How signature rules and behavioral rules differ in what they can express, why indicator matching decays, and what the cost of a rule is in false positives per unit of signal.
- Feb 8, 2024 Session Fixation and Why Identifiers Must Rotate How an attacker who chooses a session identifier inherits the victim's authenticated session, and which state transitions require a fresh identifier to break the link.
- Feb 1, 2024 Constant-Time Comparison in Credential Checks Why byte-wise equality on secrets leaks prefix information through timing, how the standard constant-time primitives are built, and which comparisons in a login path actually need them.
- Jan 26, 2024 Filesystem Timestamps and Why Timestomping Leaves a Seam Which timestamps an application can set, which only the kernel writes, and how the divergence between them exposes an attempt to backdate a file.
- Sep 26, 2023 Administrative Models, Safety Analysis, and Sandhu's Schematic Protection Model How to reason about whether a protection system can leak a right, why safety is undecidable in general, and which restricted models admit tractable analysis.
- Sep 8, 2023 Detecting Periodic Beacons in Flow Telemetry Why fixed-interval check-ins are visible in timing even when the payload is encrypted, how jitter and distribution shape change the test, and where the statistical approach fails on sparse data.
- May 22, 2023 Log Destruction, Rotation, and the Gaps It Leaves Behind Which logs an intruder with privilege can erase, which records survive in the kernel and on remote collectors, and how absence of evidence is distinguished from evidence of absence.
- May 21, 2023 Recovering Hidden Processes from a Physical Memory Image How the kernel links processes in several independent structures, why unlinking from one is insufficient, and the scan strategies that recover what the lists no longer contain.
- May 4, 2023 Server-Side Template Injection: When Data Reaches an Evaluator Why template engines are interpreters, how a template chosen from user input escalates from text output to code execution, and why sandboxes are the wrong layer.
- Apr 23, 2023 How a Stateful Firewall Matches a Packet The order in which a packet filter evaluates rules, how the connection-tracking table overrides the rule set, and where the model breaks under fragmentation and asymmetric routing.
- Apr 17, 2023 Threshold Roles and Rollback Protection in the Update Framework TUF treats a repository as four roles with separate keys and quorum thresholds. The design turns a compromised signing key into a bounded, detectable incident.
- Feb 6, 2023 Microsegmentation and Policy at the Workload Boundary Why per-workload policy beats address-based rules, how enforcement located in the host kernel changes the failure model, and what has to be observed before a policy can be written at all.
- Jan 31, 2023 Connection Tracking Under NAT How address and port translation rewrites the five-tuple, why the mapping table is the real policy state, and which behaviours the NAT requirement documents leave to the implementation.
- Jan 30, 2023 DREAD Scores and Why Ordinal Risk Ratings Do Not Multiply What the five DREAD dimensions actually ask, why averaging ordinal ranks produces a number with no meaning, and how to replace the arithmetic with a comparison that survives review.
- Jan 24, 2023 Keyless Signing and Transparency Logs for Build Artifacts Short-lived certificates bound to an OIDC identity remove long-lived keys from the signing path, and an append-only log makes a signature public evidence rather than a private promise.
- Jan 17, 2023 Applying STRIDE per Element Instead of per System Why the six threat classes are property violations, which of them are vacuous for each diagram element type, and how the per-element grid turns a mnemonic into an assignable work list.
- Dec 23, 2022 Salted Password Hashing and the Cost of a Verification How salts, iteration counts, and memory hardness set the price of an offline guess, and why the stored record must carry its own parameters.
- Sep 9, 2022 Provenance Attestations and the Digest They Must Bind An attestation is a signed claim about a build. Its value depends on a subject digest that names the exact artifact, a predicate that names the process, and a verifier policy.
- Jun 3, 2022 Bounding Online Guessing with Rate Limits and Lockouts How attempt budgets, keyed counters, and timing equalisation set an upper bound on password guessing, and which limit designs convert a defence into a denial of service.
- May 23, 2022 Lateral Movement Inferred from Authentication Records How a domain authentication log encodes the machine a logon came from, why that field is forgeable, and which patterns distinguish traversal from ordinary administration.
- Mar 27, 2022 HTML Parsing Contexts and Why One Escape Function Is Never Enough How the HTML tokenizer switches states by context, what each state treats as dangerous, and why encoding rules must be chosen per insertion point rather than per application.
- Jan 23, 2022 How Cookie Attributes Bound a Session Credential What the Domain, Path, Secure, HttpOnly, and SameSite attributes actually constrain, which of them are enforced by the browser versus the server, and where the scope model leaks.