The DevSecOps Guide: Hardening, IAM, and Incident Response
A hub for the DevSecOps writing on rivassec.com: IAM blast radius, TLS, incident response, and controls that hold up in production.
RivasSec | DevSecOps, Kubernetes, AWS IAM
Infrastructure. Security. Insight.
Latest posts
When the Output Carries the Signal: Claude, SynthID-Text, and the New Detection Attack Surface
Claude's planned text watermark is embedded through token selection rather than hidden characters. Once enterprises automate on its detector, that provenance feature becomes a security control plane with spoofing, evasion, oracle, key-management, supply-chain, and policy-abuse requirements.
IAM Blast Radius Is an Architecture Problem, Not a Policy Problem
Most IAM reviews start too late, after the account structure and trust boundaries are set. Least privilege isn't fewer actions; it's smaller failure domains.
The Discovery Layer Is Broken: Hiring as an Observability Problem
The senior engineering market has a routing failure, not a talent shortage: resumes and funnels index for keywords and discard the signal seniors depend on.
Prompt Injection Will Become a Supply Chain Evasion Technique
Prompt injection's threat model is older than the term. The mechanism is new, the objective is the evasion goal attackers have pursued for decades.
Bandit-Clean Pwnagotchi Plugins: How `subprocess` Goes From Risk to Routine
Hardening a Pwnagotchi plugin against Bandit B602/B603/B607: shutil.which() full paths, argv-list calls, input validation, and the nosec discipline.
TLS Has Three Jobs. Forget the Rest.
TLS gets easier when you stop walking the handshake and name what it's for. It does three jobs; anchor those and it becomes design, not memorization.
Adoption Is a Security Control: Notes from Paving a Road
A control developers route around isn't a control. Field notes on making the secure path the easy path: 40% less remediation time, 27% less pipeline latency.
The Teensy That Failed in Public: An EFI Brute Force, Hours Late
In 2013 Hackaday called my MacBook EFI brute force a failure; hours later it worked. Three rate-limiting defenses, each leaking at a different seam.
IAM Roles That Fail Loud: Small Defaults, Big Difference
A small Pulumi library that treats IAM safety as a precondition: mandatory permissions boundary, no wildcard trust, no wildcard actions, every opt-out explicit.
The Trust Decay: Why Modern Hiring Has Become an Adversarial System
The tech hiring pipeline has shifted from talent discovery to risk mitigation. In 2026, the engineers who get hired are the ones who are hardest to doubt.
Never Lose Connection: Multi-Phone Bluetooth Tethering for Pwnagotchi
bt-tether-multi is a Pwnagotchi plugin for intelligent multi-phone Bluetooth tethering with automatic WAN failover and silent-disconnect recovery in the field.
Elasticsearch Snapshot Verification, Minimal Privileges
Verify Elasticsearch snapshots without manage_snapshot: minimal API key, Prometheus-friendly script, and a public tools repo for hardened monitoring automation.
Hardening Kubernetes Deployments
Pod-level Kubernetes guardrails aligned with the Pod Security Standards Restricted profile: non-root, no caps, read-only FS, NetworkPolicies, SA hardening.
Taming the OOM Killer: Process Priorities on Linux
The Linux OOM Killer decides what dies under memory pressure. Protect sshd, mysqld, and other critical processes with oom_score_adj via a small script.
Catching a Nation-State Proxy: OSINT on Twitter
In 2012 I traced a state-aligned Twitter proxy tied to Venezuela's ruling party. OSINT lessons for spotting subtle, credential-phishing nation-state infra.
The 208.5-Day Kernel Bug: Uptime, Overflow, and Risk
A 2012 Linux kernel bug caused CPU lockups after 208.5 days of uptime due to an integer overflow in sched_clock(). RHEL 5/6 lesson: patch and observe uptime.
The 2012 Leap Second: When Time Broke Java and the Cloud
The 2012 leap second broke Reddit, Yelp, Java apps, and more. A retrospective on how fragile timekeeping bit the cloud, and what SRE teams should do today.