Post-Quantum Cryptography for OT and IIoT: CNSA 2.0 and NIST IR 8547 Deadlines
ML-KEM and ML-DSA on 15-year-lifespan PLCs, gateways and sensors: what CNSA 2.0 and NIST IR 8547 deadlines mean for industrial firmware and PKI.
SPIFFE & SPIRE: Workload Identity Architecture for Zero Trust (2026)
SPIFFE and SPIRE workload identity explained: SPIFFE IDs, X.509 and JWT SVIDs, node and workload attestation, trust domains and mTLS - the reference architecture for zero-trust service identity in 2026.
SLSA + Sigstore: Software Supply Chain Security Architecture (2026)
SLSA and Sigstore explained: build provenance, keyless signing with Fulcio and Rekor, in-toto attestations and cosign verification - a 2026 reference architecture for securing your software supply chain.
Post-Quantum Cryptography Migration: A Crypto-Agility ADR (2026)
Post-quantum cryptography migration for platform teams: ML-KEM and ML-DSA rollout, hybrid TLS key exchange, cryptographic inventory, PKI and firmware signing, and a crypto-agility decision record for 2026.
Card Tokenization and the PCI DSS Vault: A Payment Security Architecture (2026)
How card tokenization shrinks PCI DSS scope: vault design, format-preserving vs random tokens, network tokens, detokenization flows, and key management for payment systems.
MCP Server Security Architecture: Defending Model Context Protocol Tools (2026)
MCP server security architecture: tool poisoning, indirect prompt injection, OAuth 2.1, sandboxing, least privilege, and a defense-in-depth model for Model Context Protocol.
OpenBao Secrets Management: A Production Tutorial (2026)
A 2026 production tutorial for OpenBao secrets management: sealing, auth methods, dynamic secrets, Kubernetes injection, and high-availability deployment.
DMZ and Port Forwarding: Secure Remote Access Architecture
DMZ and port forwarding done safely — network segmentation, NAT and firewall rules, port forwarding vs VPN vs reverse proxy, and a hardened reference setup.