Security

Identity, access, cryptography, and defense in depth.

Core Competencies

Domain Coverage

Identity & Access Management

SAML, OIDC, OAuth, Kerberos, Keycloak, Azure AD

PKI & Certificates

X.509, CA architecture, Vault PKI, ACME

Secrets Management

HashiCorp Vault, pass, SOPS, age

Hardening & Compliance

CIS Benchmarks, STIG, compliance scanning

Threat Detection

SIEM, log analysis, threat hunting

Cryptography

Symmetric, asymmetric, hashing, GPG

Security Philosophy

  1. Defense in depth — multiple layers of protection

  2. Principle of least privilege — minimal access required

  3. Zero Trust — never trust, always verify

  4. Assume breach — design for when, not if

Identity Federation Flow

┌──────────┐                  ┌──────────┐                  ┌──────────┐
│   User   │───── Login ─────►│   IdP    │◄─── Trust ──────│    SP    │
│          │                  │(Keycloak)│                  │  (App)   │
└──────────┘                  └──────────┘                  └──────────┘
     │                              │                            │
     │         SAML Assertion / OIDC Token                       │
     └──────────────────────────────────────────────────────────►│

PKI Hierarchy

                    ┌─────────────────┐
                    │   Offline Root  │
                    │       CA        │
                    └────────┬────────┘
                             │
              ┌──────────────┼──────────────┐
              │              │              │
     ┌────────▼────────┐  ┌──▼───┐  ┌───────▼───────┐
     │ Issuing CA      │  │ CRL  │  │ Issuing CA    │
     │ (Vault PKI)     │  │ CDP  │  │ (AD CS)       │
     └────────┬────────┘  └──────┘  └───────┬───────┘
              │                             │
       ┌──────┴──────┐               ┌──────┴──────┐
       │ Server Cert │               │ Client Cert │
       └─────────────┘               └─────────────┘

Related