Lester Nichols (@sec_doc) header
Lester Nichols (@sec_doc) profile picture

Lester Nichols

@sec_doc

Simply pointing out the obvious about security and anything...A nerd at heart...My opinions are always mine - #infosec #security #cybersecurity

 Texas
secdoc.tech
Joined November 2009
  • Tweets751
  • Following119
  • Followers102
18Media
Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)Photo by Lester Nichols (@sec_doc)
Basic Series: Security and privacy at home and around town secdoc.tech/basic-series-sec… #cybersecurity-basics #basicsseries #personal-privacy #home-wifi #home-safety
Basic Series: Security and privacy at home and around town

Basic Series: Security and privacy at home and around town

Your email, phone, and even your home router can be useful to a criminal. Learn what can go wrong, why it matters to you, and the small habits that make common attacks harder.

secdoc.tech
1
26
From Alert to Case: Preserving the Evidence Chain secdoc.tech/from-alert-to-ca… #incident-response #digital-forensics #thehive #velociraptor #timesketch #open-source #cybersecurity #cybersecurity-basics #soc #basicsseries
From Alert to Case: Preserving the Evidence Chain

From Alert to Case: Preserving the Evidence Chain

Turning an alert into a case should preserve the original record, provenance, timestamps, hashes, custody events, and exportable evidence without claiming more forensic assurance than the pipeline...

secdoc.tech
1
11
I’m glad to see my book, Cybersecurity Architect’s Handbook, Second Edition, included in Packt’s Humble Tech Book Bundle: AI Cybersecurity Career Blueprint. Explore the bundle: humblebundle.com/books/ai-cy… #worthy-cause #CAH2 ##humblebundle #packt @PacktPublishing
Humble Tech Book Bundle: AI Cybersecurity Career Blueprint by Packt

Humble Tech Book Bundle: AI Cybersecurity Career Blueprint by Packt

Unlock the eBooks you need to protect your sensitive data and more with the all-new AI Cybersecurity Career Blueprint Bundle by Packt!

humblebundle.com
24
How to Keep a SOAR Playbook from Containing the Wrong Host secdoc.tech/how-to-keep-a-so… #soar #incident-response #security-automation #shuffle #stackstorm #open-source #cybersecurity
How to Keep a SOAR Playbook from Containing the Wrong Host

How to Keep a SOAR Playbook from Containing the Wrong Host

A safe containment playbook binds a fresh alert to one verified asset, separates approval from execution, makes retries idempotent, and proves the result at the enforcement point.

secdoc.tech
19
Alert Severity and Response Authority Are Different Decisions secdoc.tech/alert-severity-a… #soc #incident-response #soar #decision-engineering #security-automation #wazuh #thehive #cybersecurity
Alert Severity and Response Authority Are Different Decisions

Alert Severity and Response Authority Are Different Decisions

A critical alert does not automatically justify a critical action. Severity, confidence, asset context, and response authority need separate policy, evidence, and approval paths.

secdoc.tech
1
40
A Synthetic Security Event Should Test the Whole Detection Path secdoc.tech/a-synthetic-secu… #soc #siem #detection-engineering #wazuh #graylog #opensearch #security-testing #cybersecurity
A Synthetic Security Event Should Test the Whole Detection Path

A Synthetic Security Event Should Test the Whole Detection Path

A detection can pass a parser test and still fail in transport, indexing, alert delivery, or cleanup. A useful synthetic event proves the path from a controlled source action to searchable evidence...

secdoc.tech
1
36
Certificate Rotation Without an Outage or Trust Bypass secdoc.tech/certificate-rota… #pki #certificate-rotation #tls #step-ca #cert-manager #open-source #cybersecurity
Certificate Rotation Without an Outage or Trust Bypass

Certificate Rotation Without an Outage or Trust Bypass

Safe certificate rotation is an ordered change to keys, chains, trust bundles, reload behavior, revocation services, automation, and rollback, not a last-minute file replacement.

secdoc.tech
1
22
Egress Control Begins with a Dependency Inventory secdoc.tech/egress-control-b… #egress-control #network-security #nftables #proxy #dns #open-source #cybersecurity
Egress Control Begins with a Dependency Inventory

Egress Control Begins with a Dependency Inventory

A deny-by-default egress policy works only when DNS, time, repositories, proxies, certificate validation, and every other external dependency are inventoried and tested as flows.

secdoc.tech
1
17
Operator Attribution Across APIs, Proxies, and Automation secdoc.tech/operator-attribu… #audit-logging #identity #api-security #proxies #automation #opentelemetry #incident-response #cybersecurity #basicsseries #cybersecurity-basics
Operator Attribution Across APIs, Proxies, and Automation

Operator Attribution Across APIs, Proxies, and Automation

Reliable operator attribution preserves the human initiator, delegated identities, automation executors, target subjects, trusted network context, and outcome across every hop.

secdoc.tech
36
Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence secdoc.tech/cerebro-a-read-o… #cerebro #security-architecture #soc #threat-intelligence #risk-management #devsecops #platform-engineering
Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence

Cerebro: A Read-Only Security Intelligence Layer Built Around Evidence

Why I built Cerebro, how its read-only architecture limits authority, and what its current platform, investigation, threat, risk, GEOINT, and operational integrations can do.

secdoc.tech
18
The Joiner, Mover, Leaver Process Is a Distributed System secdoc.tech/the-joiner-mover… #identity #identiy-access-management #iam #scim #lifecycle-management #reconciliation #zero-trust #open-source #cybersecurity
The Joiner, Mover, Leaver Process Is a Distributed System

The Joiner, Mover, Leaver Process Is a Distributed System

Joiner, mover, and leaver automation works only when identity teams treat it as a distributed state machine with durable events, immutable identifiers, reconciliation, and tested failure handling.

secdoc.tech
1
56
Break-Glass Access That Does Not Quietly Become Normal Access secdoc.tech/break-glass-acce… #identity-access-management #privileged-access #break-glass #incident-response #open-source #security-architecture #cybersecurity #CAH2 #packt #NIST #keycloak #authentik #freeipa
Break-Glass Access That Does Not Quietly Become Normal Access

Break-Glass Access That Does Not Quietly Become Normal Access

A practical design for emergency access that remains independent, time-bounded, observable, testable, and difficult to normalize into an ordinary administration path.

secdoc.tech
41
Proving Least Privilege with Denial Tests secdoc.tech/proving-least-pr… #identity-access-management #least-privilege #authorization #policy-as-code #open-source #security-testing #cybersecurity #CAH2 #packt @PacktPublishing
Proving Least Privilege with Denial Tests

Proving Least Privilege with Denial Tests

Least privilege is not proved by showing that approved work succeeds. It is proved by testing the nearby actions, resources, identities, and conditions that policy must deny.

secdoc.tech
20
The Architecture Review Must End with a Decision secdoc.tech/the-architecture… #security-architecture #architecture-review #governance #decision-records #devsecops #open-source #cybersecurity #CAH2 #packt
The Architecture Review Must End with a Decision

The Architecture Review Must End with a Decision

An architecture review earns its cost only when it produces an explicit decision, bounded conditions, accountable owners, verification criteria, and a durable record.

secdoc.tech
1
16
AI needs controls. Security skills need practice. Explore practical cybersecurity architecture, AI security, and hands-on lab guidance from Lester Nichols at secdoc.tech. Security made simple. #CAH2 #cybersecurity youtu.be/NQ8T97Ob1BA
secdoc.tech

secdoc.tech

In a World with Threats Around Every Corner...Explore practical cybersecurity architecture, AI security, and network defense guides from Lester Nichols, author of the Cybersecurity Architect's...

secdoc.tech
28
Security Exceptions Are Architecture Decisions with Expiration Dates #security-architecture #risk-management #governance #policy-as-code #devsecops #open-source #cybersecurity secdoc.tech/security-excepti…
Security Exceptions Are Architecture Decisions with Expiration Dates

Security Exceptions Are Architecture Decisions with Expiration Dates

A security exception changes the effective architecture, so it needs an owner, bounded scope, compensating controls, verification evidence, and an enforced expiration path.

secdoc.tech
25
An Installed Agent Is Not Security Coverage secdoc.tech/an-installed-age… #wazuh #endpoint-security #security-monitoring #asset-management #open-source #detection-engineering @wazuh
An Installed Agent Is Not Security Coverage

An Installed Agent Is Not Security Coverage

Why package installation, registration, policy synchronization, telemetry, indexing, and alert visibility must be measured as separate security coverage gates.

secdoc.tech
17
Fail Closed Without Standing Still secdoc.tech/fail-closed-with… #security-automation #devsecops #platform-engineering #wazuh #open-source #reliability
Fail Closed Without Standing Still

Fail Closed Without Standing Still

What a stalled security-agent rollout taught me about safe concurrency, elapsed-time holds, blocker states, evidence, and automation that keeps making progress.

secdoc.tech
1
39
How to Test Yourself in a Personal Cybersecurity Lab secdoc.tech/how-to-test-your… #basicseries #cybersecurity-basics #cybersecurity-skills #homelab #virtualization #virtualization #linux #windows #networking #security-monitoring #cah2 #packt
How to Test Yourself in a Personal Cybersecurity Lab

How to Test Yourself in a Personal Cybersecurity Lab

A practical skills checklist for building a personal VM lab, testing what you know, collecting evidence, and recovering from your own mistakes.

secdoc.tech
1
1
38
Load more