Lester Nichols (@sec_doc) header
Lester Nichols (@sec_doc) profile picture

Lester Nichols

@sec_doc

Simply pointing out the obvious about security and anything...A nerd at heart...My opinions are always mine - #infosec #security #cybersecurity

 Texas
secdoc.tech
Joined November 2009
  • Tweets746
  • Following119
  • Followers99
18Media
Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)
A Synthetic Security Event Should Test the Whole Detection Path secdoc.tech/a-synthetic-secu… #soc #siem #detection-engineering #wazuh #graylog #opensearch #security-testing #cybersecurity
A Synthetic Security Event Should Test the Whole Detection Path

A Synthetic Security Event Should Test the Whole Detection Path

A detection can pass a parser test and still fail in transport, indexing, alert delivery, or cleanup. A useful synthetic event proves the path from a controlled source action to searchable evidence...

secdoc.tech
21
Certificate Rotation Without an Outage or Trust Bypass secdoc.tech/certificate-rota… #pki #certificate-rotation #tls #step-ca #cert-manager #open-source #cybersecurity
Certificate Rotation Without an Outage or Trust Bypass

Certificate Rotation Without an Outage or Trust Bypass

Safe certificate rotation is an ordered change to keys, chains, trust bundles, reload behavior, revocation services, automation, and rollback, not a last-minute file replacement.

secdoc.tech
1
20
Egress Control Begins with a Dependency Inventory secdoc.tech/egress-control-b… #egress-control #network-security #nftables #proxy #dns #open-source #cybersecurity
Egress Control Begins with a Dependency Inventory

Egress Control Begins with a Dependency Inventory

A deny-by-default egress policy works only when DNS, time, repositories, proxies, certificate validation, and every other external dependency are inventoried and tested as flows.

secdoc.tech
1
17
Operator Attribution Across APIs, Proxies, and Automation secdoc.tech/operator-attribu… #audit-logging #identity #api-security #proxies #automation #opentelemetry #incident-response #cybersecurity #basicsseries #cybersecurity-basics
Operator Attribution Across APIs, Proxies, and Automation

Operator Attribution Across APIs, Proxies, and Automation

Reliable operator attribution preserves the human initiator, delegated identities, automation executors, target subjects, trusted network context, and outcome across every hop.

secdoc.tech
36
Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence secdoc.tech/cerebro-a-read-o… #cerebro #security-architecture #soc #threat-intelligence #risk-management #devsecops #platform-engineering
Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence

Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence

Why I built Cerebro, how its read-only architecture limits authority, and what its current platform, investigation, threat, risk, GEOINT, and operational integrations can do.

secdoc.tech
18
The Joiner, Mover, Leaver Process Is a Distributed System secdoc.tech/the-joiner-mover… #identity #identiy-access-management #iam #scim #lifecycle-management #reconciliation #zero-trust #open-source #cybersecurity
The Joiner, Mover, Leaver Process Is a Distributed System

The Joiner, Mover, Leaver Process Is a Distributed System

Joiner, mover, and leaver automation works only when identity teams treat it as a distributed state machine with durable events, immutable identifiers, reconciliation, and tested failure handling.

secdoc.tech
1
56
Break-Glass Access That Does Not Quietly Become Normal Access secdoc.tech/break-glass-acce… #identity-access-management #privileged-access #break-glass #incident-response #open-source #security-architecture #cybersecurity #CAH2 #packt #NIST #keycloak #authentik #freeipa
Break-Glass Access That Does Not Quietly Become Normal Access

Break-Glass Access That Does Not Quietly Become Normal Access

A practical design for emergency access that remains independent, time-bounded, observable, testable, and difficult to normalize into an ordinary administration path.

secdoc.tech
41
Proving Least Privilege with Denial Tests secdoc.tech/proving-least-pr… #identity-access-management #least-privilege #authorization #policy-as-code #open-source #security-testing #cybersecurity #CAH2 #packt @PacktPublishing
Proving Least Privilege with Denial Tests

Proving Least Privilege with Denial Tests

Least privilege is not proved by showing that approved work succeeds. It is proved by testing the nearby actions, resources, identities, and conditions that policy must deny.

secdoc.tech
20
The Architecture Review Must End with a Decision secdoc.tech/the-architecture… #security-architecture #architecture-review #governance #decision-records #devsecops #open-source #cybersecurity #CAH2 #packt
The Architecture Review Must End with a Decision

The Architecture Review Must End with a Decision

An architecture review earns its cost only when it produces an explicit decision, bounded conditions, accountable owners, verification criteria, and a durable record.

secdoc.tech
1
16
AI needs controls. Security skills need practice. Explore practical cybersecurity architecture, AI security, and hands-on lab guidance from Lester Nichols at secdoc.tech. Security made simple. #CAH2 #cybersecurity youtu.be/NQ8T97Ob1BA
secdoc.tech

secdoc.tech

In a World with Threats Around Every Corner...Explore practical cybersecurity architecture, AI security, and network defense guides from Lester Nichols, author of the Cybersecurity Architect's...

secdoc.tech
28
Security Exceptions Are Architecture Decisions with Expiration Dates #security-architecture #risk-management #governance #policy-as-code #devsecops #open-source #cybersecurity secdoc.tech/security-excepti…
Security Exceptions Are Architecture Decisions with Expiration Dates

Security Exceptions Are Architecture Decisions with Expiration Dates

A security exception changes the effective architecture, so it needs an owner, bounded scope, compensating controls, verification evidence, and an enforced expiration path.

secdoc.tech
25
An Installed Agent Is Not Security Coverage secdoc.tech/an-installed-age… #wazuh #endpoint-security #security-monitoring #asset-management #open-source #detection-engineering @wazuh
An Installed Agent Is Not Security Coverage

An Installed Agent Is Not Security Coverage

Why package installation, registration, policy synchronization, telemetry, indexing, and alert visibility must be measured as separate security coverage gates.

secdoc.tech
17
Fail Closed Without Standing Still secdoc.tech/fail-closed-with… #security-automation #devsecops #platform-engineering #wazuh #open-source #reliability
Fail Closed Without Standing Still

Fail Closed Without Standing Still

What a stalled security-agent rollout taught me about safe concurrency, elapsed-time holds, blocker states, evidence, and automation that keeps making progress.

secdoc.tech
1
39
How to Test Yourself in a Personal Cybersecurity Lab secdoc.tech/how-to-test-your… #basicseries #cybersecurity-basics #cybersecurity-skills #homelab #virtualization #virtualization #linux #windows #networking #security-monitoring #cah2 #packt
How to Test Yourself in a Personal Cybersecurity Lab

How to Test Yourself in a Personal Cybersecurity Lab

A practical skills checklist for building a personal VM lab, testing what you know, collecting evidence, and recovering from your own mistakes.

secdoc.tech
1
1
38
A Secret Scan Is a Release Gate, Not a Pipeline Decoration secdoc.tech/a-secret-scan-is… #devsecops #secrets-management #trufflehog #application-security #supply-chain-security #open-source
A Secret Scan Is a Release Gate, Not a Pipeline Decoration

A Secret Scan Is a Release Gate, Not a Pipeline Decoration

How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.

secdoc.tech
28
Retiring a Security Platform Without Bringing It Back by Accident secdoc.tech/retiring-a-secur… #security-architecture #decommissioning #siem #identity #disaster-recovery #open-source
Retiring a Security Platform Without Bringing It Back by Accident

Retiring a Security Platform Without Bringing It Back by Accident

Decommissioning is the controlled removal of authority, dependencies, identities, and startup paths, not a power-off event.

secdoc.tech
16
A Backup Is Not Recovery Evidence secdoc.tech/a-backup-is-not-… #backup #disaster-recovery #resilience #proxmox #open-source #security-architecture #basics-series #cyberscurity-architecture
A Backup Is Not Recovery Evidence

A Backup Is Not Recovery Evidence

A completed backup proves data was written somewhere. Recovery evidence proves the right service can be restored safely, within its objective, without colliding with production.

secdoc.tech
20
AI Guardrails Are Operating Controls, Not Prompt Instructions secdoc.tech/ai-guardrails-ar… #ai-governance #ai-security #guardrails #security-architecture #risk-management #responsible-ai #cah2 #packt #2guystek
AI Guardrails Are Operating Controls, Not Prompt Instructions

AI Guardrails Are Operating Controls, Not Prompt Instructions

A practical baseline for governing AI authority, data, tools, consequential actions, evidence, and lifecycle risk without mistaking a system prompt for a security boundary.

secdoc.tech
16
Security Architecture in an AI and Quantum World: My Conversation with 2GuysTek secdoc.tech/security-archite… #security-architecture #cybersecurity #artificial-intelligence #zero-trust #post-quantum-cryptography #career-development #youtube #cah2 #packt @PacktPublishing @2GuysTek
Security Architecture in an AI and Quantum World: My Conversation with 2GuysTek

Security Architecture in an AI and Quantum World: My Conversation with 2GuysTek

A conversation with Rich from 2GuysTek about the Cybersecurity Architect's Handbook, the fundamentals that still matter, and how architects should approach AI, zero trust, quantum readiness, and...

secdoc.tech
25
Load more