Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

TL;DR: If your development, staging, and production API servers all trust the same OIDC issuer and audience, Kubernetes will accept the same cached kubectl token across all of them. You should use separate audiences in your API.

TL;DR: A production kubeconfig that contains a certificate or token is a production credential, and every copy then accesses the cluster with the same identity. You should use individual single sign-on (SSO) logins and short-lived credentials for your clusters.

Most conversations about PCI DSS 4.0 start with the requirements, but I’d rather start with a habit. As a GRC & Cybersecurity Consultant advising organizations preparing for PCI DSS 4.0 assessments, I’ve developed a habit of observing how findings move from identification to ownership, remediation, and documented closure. That’s often where accountability gaps and unresolved findings surface first.

FIPS 140-3 is the current standard for validating cryptographic modules, which are the specific hardware or software components that implement encryption and manage keys inside a defined boundary. FIPS 140-3 was approved on March 22, 2019, became effective on September 22, 2019, and supersedes FIPS 140-2, which dates back to 2001. Most FIPS 140-3 security requirements come from ISO/IEC 19790:2012, with test requirements drawn from ISO/IEC 24759:2025.

ISO 42001 is the management system standard for artificial intelligence. It sits on the backbone of ISO 27001 but with a different focus: do you have a system for governing AI, and can you prove that system runs, with evidence? Core to the standard is an Artificial Intelligence Management System (AIMS), a structured set of policies, processes, and controls an organization uses to govern AI.

Cisco and Teleport are announcing a strategic partnership centered on deep technology integration, licensing, and investment. As the largest strategic investor, Cisco is reinforcing its commitment to accelerating the next phase of Teleport's evolution.

Blame for all flaws belongs to the flawed human author. Historically, the bottleneck for finding security bugs in software was human bandwidth. As pointed out in this great post by Tom Ptacek, it appears that large language models are exceptionally good at finding them with simple prompting. This adds substantial bandwidth to the effort of finding bugs.

In RBAC (Role-based Access Control), a role is a defined object with explicit permissions attached to it. Because roles are designed to be fixed, changing what a particular role can do (for example, in a one-off situation where other permissions are needed for the role) requires editing the role itself. However, repeatedly editing roles makes them less flexible and re-usable, and ultimately complicates access strategies as organizations scale.