Security
Vulnerability response, hardening, authn/authz, and practical security work — with pointers to official sources rather than definitive legal takes.
kex_exchange_identification: read: Connection reset by peer, 5 SSH Fixes
Getting "kex_exchange_identification: read: Connection reset by peer"? Pinpoint the cause in 5 minutes: Fail2Ban ban, MaxStartups limit, hosts.deny or sshd down, with exact commands to fix each.
Entrustment vs. Third-Party Provision of Personal Information: Consent Requirements and Case Comparisons
Distinguish personal information entrustment from third-party provision by purpose and role. This post compares legal bases other than consent, entrustment contracts, disclosure and supervision, and what to check for cross-border transfers
certificate has expired: a five-branch diagnosis (nginx · openssl)
A table that classifies certificate has expired, ERR_CERT_DATE_INVALID, and no shared cipher into five root causes in 30 seconds from the error text alone, plus openssl diagnostic commands, a technique to confirm a missed reload, and a socket-based expiry monitoring script.
Fixing Missing Kubernetes ServiceAccount Tokens and 401 Unauthorized (1.24+)
If a Pod is missing its ServiceAccount token file or returns 401 Unauthorized, you have an authentication problem, not an RBAC problem. This post covers an error-text triage table, version differences after Kubernetes 1.24, automount precedence, and projected-token refresh and revocation.
72-Hour Personal Data Breach Response: Decision Matrix, Timeline, and Filing Templates
What do you notify, and where, inside the 72-hour personal data breach window? A 30-second decision matrix for notice vs. regulatory reporting, a 0h–72h timeline, three report and notice templates, plus playbooks for unconfirmed scale, proc
kubectl Error from server (Forbidden) 403: 5 Causes and How to Fix RBAC
kubectl "Error from server (Forbidden)" is an RBAC authorization failure, not a 401 authentication issue. This post covers an error-message anatomy table, five root-cause branches, auth can-i diagnostics, three least-privilege Role/RoleBind
Personal Information Access Log Retention: 1-Year vs 2-Year Decision Table and Practical Log Design Guide
Unsure whether personal information access logs must be kept for 1 year or 2 years? Use the by-system decision table and settle it in five minutes. This guide covers Article 8–based log schema DDL, a comparison of tamper-prevention options,
30-Second Linux Server Compromise Check Runbook (lastb · auth.log · netstat)
A copy-paste runbook to tell in 30 seconds whether a slow or suspicious Linux server has been compromised, using lastb, auth.log, and netstat. Includes a normal-vs-anomalous criteria table plus isolation, account-lock, and SSH-key revocatio
NO_PUBKEY apt Error Recovery Runbook — Registering a signed-by Keyring
Is apt update blocked by NO_PUBKEY or "public key is not available"? This diagnostic table and copy-paste runbook shows how to recover safely with signed-by keyring registration and gpg dearmor—instead of the deprecated apt-key.
2026 ISMS-P Certification Criteria Guide Summary: 101 Criteria, Who Must Certify, Common Findings
A practical summary of the ISMS-P certification criteria guide: the 101 criteria across management system, protection measures and personal data, who must certify, the application steps, common findings, and the 2026 reform timeline.
fail2ban SSH Blocking Setup in 5 Minutes — Copy-Paste jail.local Example
When SSH brute force floods auth.log, go from installing fail2ban to a copy-paste jail.local template in 5 minutes. Covers maxretry, bantime, and findtime settings plus false-positive unban recovery, laid out in command tables.
sudo: no tty present and no askpass — 30-Second Diagnosis and Recovery (cron, CI, Ansible)
The real cause of the sudo "no tty present and no askpass" error in cron, CI, and Ansible, plus a 30-second diagnosis table. Copy-paste recovery for a safe NOPASSWD sudoers setup, requiretty removal, and SUDO_ASKPASS.
Fixing x509: certificate signed by unknown authority — Copy-paste runbook for Docker, Go, k8s, and git
A copy-paste runbook that matches the 'x509: certificate signed by unknown authority' error verbatim across Docker, Go, Kubernetes, and git so you can diagnose and recover in five minutes. Also covers how to trust a private CA safely withou
Preventing Cloud Data Leaks: An Architecture Design Guide for GDPR and Korean Privacy Law Compliance
Data-leak prevention and regulatory risk management are essential in the cloud. This guide compares GDPR with Korea’s Personal Information Protection Act and presents encryption, least-privilege access, and lifecycle controls from a Securit
How to Prevent Terraform Security Vulnerabilities with GitOps and Policy as Code
Learn how to fundamentally block risks such as secret exposure and over-privileged access during IaC deployments. This post presents practical best practices that combine GitOps and Policy as Code (PaC) to automatically validate security is
Preventing Cloud Security Vulnerabilities: A Practical DevSecOps Guide to Stopping IAM, Secrets, and IaC Issues in Code
A practical guide to defending against critical cloud security vulnerabilities—such as IAM misuse and hardcoded secrets—at the code level rather than in theory. It shows how to embed security into the development process, from implementing
Enforcing and Verifying mTLS Between Kubernetes Services with Istio PeerAuthentication
This guide analyzes East-West traffic security gaps in MSA environments through a Zero Trust lens, then walks through step-by-step labs and troubleshooting tips for forcing all service-to-service communication onto mutually authenticated mT
Blocking Privileged Containers with Pod Security Admission After PSP Removal
A hands-on guide to configuring Pod Security Admission, the built-in standard after PSP was removed. Block privileged, hostPath, and root with namespace labels, interpret violates PodSecurity errors, pass restricted with the right securityC
2026 CSAP Simplified Grade Prep Checklist — A Practical Guide for Public SaaS
A 2026 CSAP Simplified Grade preparation guide for SaaS sold to public institutions. It covers Standard vs. Simplified Grade, the application process and costs, frequently failed controls, and a copy-paste-ready deliverables checklist.
2026 Practitioner Guide to the Pseudonymized Information Combination Application Process: From Combination Specialist Institutions to Export Review
A step-by-step walkthrough of the pseudonymized information combination application process, from generating combination keys through export review and adequacy assessment. This practitioner guide covers how to choose a combination speciali
When fail2ban Won't Ban IPs: A 5-Minute Diagnostic Guide for Banned: 0
When fail2ban isn't banning SSH brute-force IPs (Banned: 0), diagnose and fix the six common causes—from systemd backend and failregex through banaction—in five minutes with copy-paste commands.
JWT Invalid Signature 401 Errors: Diagnosing 6 Causes (Spring/Node/Python)
When a 401 hits with JWT "invalid signature" or "signature does not match," diagnose six causes—secret mismatch, HS256/RS256 confusion, encoding traps, and more—then fix it immediately with Spring, Node, and Python code plus copy-paste comm
How to Fix SSH "Too many authentication failures" (IdentitiesOnly)
SSH "Too many authentication failures" is not a bad key — ssh-agent is offering too many keys and exceeding MaxAuthTries. Pin a per-host key with IdentitiesOnly in your SSH config and permanently fix it in 5 minutes.
Emergency Recovery After ufw enable Drops SSH (Self-Lockout) + Safe Setup
Can't SSH in after ufw enable? Immediate recovery if the session is still alive, serial-console and rescue-mode recovery on AWS, GCP, and Oracle when fully locked out, plus copy-paste commands for safely allowing port 22, restricting by IP,