Vendor Remote Access Without Permanent Trust
Vendor access should be named, scoped, approved, observed, time-limited, and removed when the work is complete.
From the journal
Latest articles
Practical perspectives on infrastructure, software delivery, and the systems connecting them.
Dependency Admission Policies for the Build Pipeline
Dependency admission policies evaluate source, maintenance, license, integrity, and risk before packages enter the trusted build path.
Securing Out-of-Band Management Before You Need It
Out-of-band management must remain isolated, attributable, and available when the production network cannot be trusted.
Secrets Have Lifecycles Too
Secrets should be requested, issued, scoped, delivered, observed, rotated, revoked, and destroyed through a controlled lifecycle.
Network Segmentation by Risk, Not Just Department
Useful segmentation separates systems by trust, exposure, impact, and management needs instead of organizational charts alone.
Authentication Is Not Authorization
Authentication proves identity; authorization decides what that identity may do in a specific context.
Physical Access Control for Server Rooms and Network Closets
Physical access controls should connect identity, authorization, evidence, environmental safety, and emergency recovery.
The Defensible Stack: CodeVelo's Defense-in-Depth Framework
A defensible stack limits trust, contains failure, preserves evidence, and provides safe recovery from the rack to the runtime.
The Longevity Audit: CodeVelo's September Maintenance Checklist
The Longevity Audit reviews ownership, condition, upgrade paths, documentation, and retirement across infrastructure and software.