I write about turning security requirements into working controls—and keeping evidence of the result.
Configured? Prove It. is the question behind the work here: what should a control allow, what should it deny, and what evidence shows the decision?
Explore the portfolio: a complete architecture study, eight practical guides, four proposed project concepts, reusable templates, and a locally tested offline evidence-index checker. Includes an interview walkthrough and explicit evidence labels.
These are collaboratively drafted educational designs and synthetic demonstrations; implementation status and authorship context are documented in the portfolio.
New: Access Boundary Lab. A free offline browser lab: change a request, inspect tenant/action/expiry boundaries, and distinguish modeled decisions from evidence. Includes regression tests, a threat model, and interview challenge cards.
| If you want to… | Start here |
|---|---|
| Explore policies, queries, and verification cases | Security Controls in Practice companion repository |
| Record the expected and observed result of a test | Verification record |
| Organize control ownership and evidence | Control register |
| Review a change before operating acceptance | Change checklist |
- Identity and least privilege: access decisions, scope, and verification.
- Network and cloud controls: policy examples, queries, and test cases.
- Operational evidence: verification records, change checklists, and control registers.
The companion examples use fictional values and placeholders. Documented behavior and Lab-tested results are different evidence levels; review the repository's scope and test in an authorized non-production environment before adapting examples.
Author of Cybersecurity Engineering in Practice and Security Controls in Practice: From Requirements to Working Enterprise Protection.
Explore the books · Free Security Control Verification Checklist
Math Heroes: Save the City: a free, superhero-themed first-grade learning game I built for my son. Kids defeat villains with math (adding, time, coins, shapes, skip counting, and more), reading comic stories, spelling, sentence building, letter tracing, and the water cycle. It has a recorded hero voice, a daily mission with streaks and spaced review, story cutscenes, a sidekick pet, 2-player mode, multiple kid profiles, a grown-up area, and optional sync across devices. No accounts or ads. Play it here.
LinkedIn · YouTube · DEV tutorial: test the decision, not just the error
Found a mismatch between an example and current vendor documentation? Open a focused correction with the file, product/version context, and primary source. Useful evidence beats a confident guess.