adminThinking on cybersecurity, compliance, and managed defence - from the CyberCheck team.
admin
The OWASP Top 10 gets referenced constantly in security conversations, but for developers and product teams outside dedicated security roles, the list often reads like a wall of jargon – injection, broken access control, cryptographic failures – without much sense of what these categories mean for the code they write every day. Here is a … Read more
Ask security researchers what causes most cloud data breaches, and the answer is rarely a sophisticated zero-day exploit or a nation-state-level attack. It is almost always something far more mundane – a misconfigured storage bucket, an overly permissive access policy, a service left exposed to the public internet that was never meant to be reachable … Read more
APIs have quietly become the primary way most modern applications communicate, both internally between services and externally with partners and customers. That shift has made API security a critical concern, yet a surprising number of organizations still treat API security as an afterthought relative to the more traditional web application security practices they have had … Read more
Zero trust has become one of the most overused terms in enterprise security marketing, applied so broadly to so many different products that the actual underlying architectural principle risks getting lost entirely. Stripped of the marketing language, zero trust is a coherent, useful security model – but actually implementing it requires a real, staged plan … Read more
SOC 2 audits have a reputation for triggering genuine, last-minute organizational panic – weeks of scrambling to gather evidence, retroactively document policies that technically already existed but were never written down anywhere, and generally treating the audit as a fire drill rather than a predictable, manageable process. It does not have to work that way, … Read more
Ask a business owner what a “security assessment” involves and you will usually get a vague answer about scanning for vulnerabilities. That is part of it, but a thorough assessment covers far more ground than an automated scanner report – and the gap between a real assessment and a superficial one is exactly where the … Read more
Compliance frameworks – SOC 2, ISO 27001, HIPAA, PCI DSS, and the rest – exist for good reasons, establishing a baseline of security practices an organization needs in place. The trouble starts when organizations treat achieving compliance as the finish line, rather than the minimum starting point it was always meant to be. Understanding that … Read more
Kubernetes adoption has moved fast, and security practices have, in a lot of organizations, not kept pace with that speed. Teams that would never dream of deploying a web server with default credentials will happily spin up a cluster with permissive default configurations left entirely unexamined, simply because Kubernetes security is more complex than traditional … Read more
A security review of a genuinely well-maintained web application finds that its Content Security Policy header, present and correctly configured for years, has actually been silently non-functional for the past several months – a routine infrastructure change quietly stripped the header before it ever reached real browsers, and nobody noticed, because nobody had actually been … Read more
A company discovers a leaked API key during a routine security review, rotates it within the hour, and treats the incident as genuinely closed – until a follow-up investigation reveals that key had been embedded in a genuinely large number of downstream integrations and cached configurations, several of which quietly broke the moment rotation happened, … Read more