Security concepts become more meaningful when they can be connected to real systems, risks and observable behaviour.

Testing Security Concepts is where I explore security principles encountered through study and technical research, examine why they exist, and where appropriate test their application within a controlled lab environment.

The Approach

Each investigation begins with a security concept or question rather than a technology.

Before considering a control, I examine the purpose behind the concept: what is valued, who that value serves, the ethical responsibilities involved, and what could prevent the intended objective from being achieved. I then examine the associated risk and determine how the concept or relevant controls could be represented, tested or observed within my lab.

The objective is not simply to demonstrate tools or controls, but to understand the relationship between purpose, people, value, ethics, risk, security principles, controls, implementation and evidence.

Testing Process

• Understand — Identify the principle, its purpose, and the value it is intended to support.
• Question — Examine who is affected, the ethical responsibilities involved, the problem being addressed and the assumptions being made.
• Risk — Determine what could prevent the intended value or objective from being achieved.
• Control — Identify how the risk may be treated and what controls may be appropriate.
• Test — Represent or implement the concept or control within the lab where practical.
• Observe — Examine behaviour, logs, telemetry and other evidence.
• Analyse — Evaluate what the evidence demonstrates, including where my original understanding or assumptions were incomplete.
• Apply — Connect the findings back to practical security decisions and their effect on people, processes and technology.
• Document — Record the findings, limitations and lessons learned.

Security Notes

Findings from these investigations are published as Security Notes. Supporting configurations, commands, diagrams or other technical material may also be published through the Labs, Projects or GitHub sections where appropriate.