Notes from the noise floor.
Short field notes on the parts of security that rarely get written down: what a control actually costs, what a certification actually tests, what the second line actually does.
What second-line GRC actually does all day
The org chart says: frameworks, policies, oversight. The calendar says: translation. Between what a standard requires and what a warehouse can execute, somebody has to carry the meaning across.
What a firewall certification actually tests
I passed the CSNA in March. The exam verified that I can configure a Stormshield appliance. It could not verify the thing that matters: whether a firewall run by me would still be trustworthy a year later.
On the fragility of EDR assumptions
EDR vendors sell you a dashboard. The dashboard shows what the tool caught. The data you actually need is everything it didn't.
Zero Trust is a posture, not a product
Buying a Zero Trust product does not move you toward the condition the phrase describes. Seventeen vendors will tell you otherwise.
What side-channel attacks taught me about patience
The first 300 traces produced a uniform noise floor. The next 4,500 produced a key. The difference was not more data.