tag: security
Security
General web and transport security as it affects sign-in and APIs.
Articles
- Information security
POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1
How the 2014 POODLE attack broke SSLv3, why RFC 7568 and RFC 8996 later retired SSLv3, TLS 1.0 and 1.1, and which TLS settings to use for identity and API servers.
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Information security
Locking Down a Federation Server: Expose Only What You Must
How to shrink the attack surface of PingFederate or any federation server: separate admin and runtime, allowlist endpoints at the proxy, and add security headers.
- Events & community
API Security Today: The OWASP API Top 10 in Practice
A talk-style tour of the OWASP API Security Top 10 (2023): broken object level authorization, authentication flaws, resource limits, and fixes that work.
- Cloud computing
Cloud Security Standards: Frameworks and Identity Specs
Which standards matter for cloud security: CSA Cloud Controls Matrix, ISO/IEC 27001, 27017 and 27018, SOC 2, plus the identity specs (SAML, OIDC, SCIM) behind them.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.
Guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Topic guide
Cloud security through identity
Identity-centered cloud security: shared responsibility, SSO and SCIM for SaaS, least privilege in IaaS, workload identities, hybrid connections and logging.
- Topic guide
Information security for identity systems
How to protect identity infrastructure itself: signing keys, TLS, admin access, patching, secrets, logging and incident response for IdPs and authorization servers.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.
- Platform category
Other tools in the identity stack
Supporting tools around IAM: directories, PKI and certificate management, secrets managers, HSMs and KMS, privileged access and testing tools.