Risk Analysis with Magerit: Methodology Applied to a Real Case
1. Introduction Risk analysis with Magerit is the reference methodology in Spain for assessing and treating risks to information systems. Developed by the former Ministry of Public Administrations and maintained by CCN-CERT, Magerit allows any organization, public or private, to identify its assets, understand the threats against them and calculate impact in an objective, reproducible way. In this article we apply the methodology to the real case of an SME with cloud services. Risk analysis with Magerit is not just a practical obligation to comply with the ENS (National Security Scheme) or regulations such as GDPR: it is a management …
OT and ICS Security: Protecting the Industrial World
1. Introduction OT and ICS security has become one of the strategic priorities of industrial cybersecurity. While confidentiality dominates the CIA triad in IT, availability and integrity are absolute in OT environments: a failing PLC can stop a production line, cut the power supply or compromise people’s physical safety. In this article we explore how to protect these critical systems with a practical methodology based on standards such as IEC 62443. The IT/OT convergence, driven by Industry 4.0, has exposed industrial plants to the same threats as corporate networks: ransomware, APTs and insecure remote access. OT and ICS security is …
Threat Intelligence with MITRE ATT&CK: Prioritize and Defend Better
1. Introduction Threat intelligence with MITRE ATT&CK has become the favorite combination of defense teams that want to stop chasing alerts at random. Threat intelligence provides the data (indicators, campaigns, adversary tactics) and MITRE ATT&CK provides the common language to structure it. Working with threat intelligence with MITRE ATT&CK means applying real information about adversaries to a reference framework that every security professional understands, from the SOC analyst to the security architect. In this article you will see the complete workflow: how to collect intelligence through STIX and TAXII, how to map techniques against the MITRE ATT&CK framework, how to …
SOAR and Incident Response Automation: Playbooks in Action
1. Introduction SOAR incident response automation is the natural evolution of any security operations center that has outgrown email alerts and Excel spreadsheets. When a SOC matures, the alert volume grows faster than the team that must analyze it, which is where automation stops being a luxury and becomes an operational necessity. This article explains what lies behind SOAR incident response automation, with real examples you can adapt to your own environment. I will assume you already know what a SIEM is and how a basic SOC works: if you need to refresh that foundation, the end of this article …
AWS Security: Taking Control of IAM and S3 Buckets
1. Introduction AWS security IAM and S3 is, arguably, the cloud area responsible for the largest number of data exposure incidents in recent years. Every week there are reports of open buckets, leaked credentials and users with excessive privileges that end up compromising entire accounts. The good news is that, in most cases, these are avoidable mistakes when you apply clear AWS security IAM and S3 criteria from day one. This article is not a theoretical manual: it is a practical guide with real policies, AWS CLI commands you can run in your test account and an audit workflow that …
Linux Server Hardening: Essential Security Checklist
1. Introduction Linux server hardening remains the task with the highest security return per hour invested, and yet it is the one most often left to improvisation. A freshly installed server connected to the public Internet receives brute-force login attempts within minutes, and most automated scans look for exactly what an unhardened server exposes: password-based SSH, open administration ports and unpatched packages. In this article I have prepared a complete Linux server hardening checklist that can be applied in order to any distribution (Debian, Ubuntu, RHEL or Rocky), with real sshd configuration, UFW firewall rules, fail2ban and SELinux, plus the …
Applied Cryptography and PKI: Encryption, Signatures and Key Management
1. Introduction Applied cryptography and PKI is the discipline behind almost everything we take for granted on a connected system: the encryption of an HTTPS session, the signature of a document, mutual authentication between services and the chain of trust that makes your browser trust a certificate issued by a public CA. Yet textbook theory collides with day-to-day reality: keys that have not been rotated in years, expired certificates taking production services down, and signatures validated poorly because nobody checked the hash algorithm. In this article I cover applied cryptography and PKI from the practitioner’s point of view: the cryptographic …
Zero Trust Architecture: Enterprise Implementation Guide
1. Introduction Zero Trust architecture has moved from analyst hype to the security model demanded by regulators, cyber-insurance carriers and advanced technical audits alike. The classic perimeter model —a firewall at the network edge and implicit trust inside— no longer holds against remote work, hybrid cloud and ransomware campaigns that shift the entry point from the VPN to email, a weakly-protected SaaS or a compromised personal device. This guide takes a hands-on approach: what Zero Trust architecture really is, its pillars, how to roll it out in phases with a realistic roadmap, what identity policies you need from day one …
Lateral Movement and Persistence: The Decisive Red Team Phase
1. Introduction Lateral movement and persistence Red Team operations mark the difference between a contained incident and a total breach: this is the phase where the adversary abandons the initial foothold, moves across the network with stolen credentials, and secures a second entry even if discovered. In any professional engagement, lateral movement and persistence Red Team planning decide whether the exercise becomes a real demonstration of risk or a simple intrusion drill. This article covers that decisive phase with a hands-on approach: movement techniques with psexec, WMI, and Pass-the-Hash, persistence mechanisms that survive reboots, pivot tunnels with chisel and SSH, …
Manual SQL Injection: Advanced Data Exfiltration Techniques
1. Introduction Manual SQL injection remains, more than two decades after the first public exploits, the technique that compromises the most databases in real-world assessments. Unlike automated scanners, manual SQL injection lets you understand exactly what happens inside each query, adapt the payload to the precise database engine, and exfiltrate data with a surgical precision that no generic tool achieves. In this article we will build a local lab with MySQL and PHP to walk through manual SQL injection end to end: detection, error-based injection, UNION-based extraction, blind boolean and time-based variants, and a responsible final pass with sqlmap automation. …
Latest News
