RivasSec

Mid-engagement on a live incident, the EDR on my analyst laptop fired a true-positive against my own activity.

During an incident-response engagement, I worked through a case where the on-disk picture and the runtime picture were saying different things.

Every Security Operations Center follows a familiar pattern: collect telemetry, correlate identities, prioritize signals, and trigger a response.

I built a client-side IAM blast-radius analyzer.

This is the hub page for the DevSecOps writing on rivassec.com.

Anthropic's planned watermark for future Claude models is embedded during token selection.

Most IAM reviews start too late The problem is not the policy itself.

The gap between capability and first screen The market is full of senior engineers who can debug a production outage, harden an IAM boundary, review a Terraform plan, and explain blast radius before the pager goes off.

Prompt injection's threat model is older than the term.

I ran Bandit on bt-tether-multi as part of a routine pre-publish sweep.

TLS gets easier when you stop walking the handshake step by step and start naming what it is for.

Most security defenses are layered.

Adoption is a security control A security control developers can route around is not a control.

There's a class of AWS bug that doesn't show up until audit season: an IAM role that nobody reviewed closely, quietly granted more than it needed, sat for three years, and shows up in a Security Hub finding with * in its action list.

The Duality of the Current Market The tech job market is currently defined by a jarring paradox.

The Common Pwnagotchi Tethering Problem If you're an active Pwnagotchi user, you've likely faced the frustration of losing internet connectivity in the field.

Verifying Elasticsearch snapshots typically requires broad manage permissions.

Securing Kubernetes workloads isn't just about scanning images or tweaking RBAC, it's about enforcing the right guardrails at the pod level to minimize risk by default.

In resource-constrained environments (especially virtual private servers, CI agents, and container hosts) the Linux kernel's Out of Memory Killer (OOM Killer) is a last-resort defense mechanism.

Situation In the lead-up to Venezuela's 2012 regional elections, I observed unusual behavior around Twitter access within the country.

In 2012, a subtle but potentially catastrophic bug was discovered in older versions of the Linux kernel, particularly affecting Red Hat Enterprise Linux (RHEL) and its derivatives.

What Happened?