Google Cloud offers several network and application security controls that are easy to collapse into the word “firewall.” VPC firewall rules and firewall policies govern […]
Cybersecurity
Google Cloud PCSE: Workload Identity Federation vs Service Account Keys
External workloads often need to call Google Cloud APIs, but the way they obtain credentials changes the security model dramatically. A downloaded service-account key is […]
Google Cloud PCSE: Security Command Center, Threat Detection & Cloud IDS
Security Command Center, Event Threat Detection, and Cloud IDS all surface security findings, but they occupy different positions in the detection architecture. Security Command Center […]
CompTIA 220-1202: Windows Security Boundaries
Windows access control is built from several security boundaries that solve different problems. NTFS permissions control access to files and folders on NTFS volumes. Share […]
CompTIA 220-1202: Help Desk Malware Remediation Workflow
Malware remediation is more than running an antivirus scan. A help desk technician has to reduce the chance of further damage, preserve the information needed […]
CompTIA 220-1202: Secure Remote Support with Least Privilege
Remote support is convenient because a technician can solve problems without being physically present. It is also risky because remote-access tools can provide a direct […]
CompTIA SY0-701: Choosing the Right Security Control Type
Security controls are easy to memorize as vocabulary and much harder to classify correctly in a real scenario. A firewall can prevent an unwanted connection […]
CompTIA SY0-701: Vulnerability Scanning, Penetration Testing, or Red Teaming?
Vulnerability scanning, penetration testing, and red teaming are all security assessment activities, but they answer different questions. A scanner can identify large numbers of known […]
CompTIA SY0-701: SIEM, SOAR, EDR, and XDR Roles
Modern security operations use several technologies whose names sound interchangeable because they all participate in detection and response. SIEM, SOAR, EDR, and XDR are not […]
CompTIA XK0-006: SELinux, AppArmor, firewalld, and UFW
SELinux, AppArmor, firewalld, and UFW are often grouped under “Linux security,” but they do not enforce the same thing. SELinux and AppArmor are mandatory access […]
Amazon AWS SCS-C03: GuardDuty, Security Hub, and Detective
Amazon GuardDuty, AWS Security Hub CSPM, AWS Security Hub, and Amazon Detective can operate together, but they solve distinct detection, posture, correlation, and investigation problems. […]
Amazon AWS SCS-C03: KMS Key Policies, IAM Policies, or Grants?
AWS KMS permissions can be confusing because access to a KMS key can involve more than one authorization mechanism. Every KMS key has a key […]
Amazon AWS SCS-C03: Security Groups, NACLs, and Network Firewall
AWS security groups, network ACLs, and AWS Network Firewall all control network traffic, but they operate at different points and with different state models. Security […]
Amazon AWS SAA-C03: Organizations, IAM Identity Center, and SCPs
Large AWS environments need more than IAM policies inside individual accounts. AWS Organizations provides the account hierarchy and organization-wide policy boundary, IAM Identity Center provides […]
Microsoft AZ-700: ExpressRoute vs VPN Gateway
Azure ExpressRoute and VPN Gateway both connect on-premises networks to Azure, but they solve different hybrid-connectivity requirements. VPN Gateway establishes encrypted IPsec/IKE tunnels across the […]