Branden R. Williams, Business Security Specialist

SSH Proxy, Using a Jumphost standard

Those who know me know about my love of the Raspberry Pi. I’ve got tons of them stashed around various places to provide a variety of services. One thing I use them for is to allow me access into remote networks via Twingate for troubleshooting or maintenance purposes. Usually these networks are less sophisticated with consumer-grade tech enabling them, and Twingate provides a nice way to be able to access specific hosts easily over their technology. It does like to have two connectors per network, so in order to keep the portal green, I will put normally a Raspberry Pi and a Pi Zero on that network and have them connect back to Twingate. In my world, Twingate is used ...

23rd of January, 2025
In: Consumer Security, Enterprise Security, Security Tools
0
0

Level Up Cybersecurity with Kasm Workspaces standard

Ever look at plethora of browser tabs staring back at you with “I’ll check this out later” vibes and feel the urge to mercy-close the ones that just wont get done anytime soon? Browser tabs are now another subtle, nagging to-do list that gets neglected or ignored. I’m specifically referring to the tabs in the middle of your window that you pinky-promised you would revisit. They are reminders of things that you might do without making an actual to-do list. I had one of those purge moments last week and remembered I had a tab open to check out Kasm Workspaces. This was an instance where I was glad I left that nagging to-do item waiting for me to revisit ...

pgMail 1.5 Released! standard

Well, it’s pretty rare that I get anyone talking about my old PostgreSQL email stored procedure, but here we are. I wrote this thing almost 25 years ago to essentially replicate the functionality of xp_sendmail into PostgreSQL. I released it to the world, because I knew other people would have this issue. And as it turned out, they absolutely do. Thus, pgMail was born. The history is all on Github now, and it’s generally been stable over the years. There were some bugs that needed to get fixed over time such as issues with SMTP Pipelining, adding support for MIME Multipart emails that would offer HTML formats as are the norm these days. But today I had someone request to ...

Let’s Encrypt for non-webservers standard

Let’s say you want to use Let’s Encrypt for something that isn’t a website. So you download certbot, you get things going with your manual cert, and you realize that when it goes to rotate you will need to restart some services. When you go look through the docs, it’s not very clear on how to do this exactly. So here’s my post to remind myself what I did (and if it helps you as well, then hooray!). What you want to do is configure a hook. They come in three varieties: pre-hooks (commands to run prior to running the re-issue), deploy-hooks (commands to run immediately after the cert is issued but prior to deployment), and post-hooks (commands to be ...

When Man Pages Go Weird standard

You may not realize that I got my start in the technology world in the early 1990s learning Unix. From my first Netcom account to my high school allowing me, A JUNIOR, to have and run a Slackware machine directly connected to the Internet. My first Linux kernel was a 1.2.8 kernel, and I vividly remember someone trolling me on IRC to fix some strange problem the best bet was to rm -rf /* as root. He got me good. Working through *nix in those days was made easier (and still is today) through Manual Pages, or manpages for short. It’s the thing that people would expect you to go do when they replied “RTFM” when you asked a question ...

Ten Things Companies Get Wrong About CIAM standard

Customer Identity and Access Management (CIAM) is a core component of creating your digital user experience. If you are unfamiliar with Customer Identity and Access Management, it is the process by which companies grant access to their digital assets (like websites, mobile apps, and even chatbots) to their customers, as well as controlling what those customers can access. The idea is to ensure the right person or process has access to the right applications and information at the right time while being risk and context aware. In a previous role, I was responsible for a complete CIAM modernization at a large bank. More recently, I modernized an entire IAM system for a premier identity company. In both cases, my guiding ...

Protect Yourself and Freeze Your Credit standard

Breaches are never ending, and if you have not already put freezes on your credit reports, make a late New Year’s resolution and do it now. There are a couple of steps you will need to take for each of the four bureaus (yes four). Before you freeze, get in a habit of requesting your report annually. Some bureaus partner with apps you can use as well (such as Credit Karma, Credit Sesame) that are free to download and set up. You want to make sure nobody opened a line of credit in your name without you knowing. One thing you need to know about freezing your credit report is anytime you take an action that requires a hard inquiry, ...

Selective Domain Filtering with Postfix and a SPAM Filtering Service standard

Yes, that title was a mouthful, but I’m trying to make sure I’m descriptive enough for the next guy who is in this situation. I was facing something interesting lately. There is a spambot network that is ignoring whatever you put in the MX record, and trying to send emails to other IPs associated with the domain. Yep, rookie mistake on my part. Should have set things up so that domains forwarding to my spam filtering service can only be delivered locally if they come FROM that service. So I turned to the extremely helpful Postfix Users group. Essentially, they suggested leveraging access(5) rules to define this in main.cf. You could throw the domains into a hash table as well, ...

PCI DSS 4.0 and TLS standard

In 2015, I published an addendum to our PCI DSS 4th Ed. book that covered version 3.1. I titled it, “PCI DSS 3.1: The Standard that Killed SSL” because that version removed the ability to use old and outdated versions of the standard in favor of the improved TLS standard originally released in January 1999. Now eight years later, we’re still struggling with moving past version 1.0 of TLS, something that the Council required after June 2018. Outdated versions of these protocols still exist in certain embedded devices, and are only allowed in limited scenarios. Version 4 of the standard pushed the remainder of TLS version requirements to your routine vulnerability scans—prioritized by the resulting CVSS score. You will find ...

Why APA is Important in your Masters Journey standard

Another semester has closed and the reviews are in. As always, I had one student who rails on their hatred of APA formatting and one student who loved it. OK, maybe not loved it, but mentioned that it made a positive impact on their journey. The goal of this post is to help provide some context on why I take points off of papers for poor APA formatting. If you are one of my current students reading this, please take some notes. I make APA 7th Ed. an optional text because there are freely available resources you can use to learn what you need to do. You should also use the services of the writing coach provided by the university ...