An engineering and technical research publication by Joshua A. Wortz, CISSP — exploring Zero Trust cloud architectures, shift-left DevSecOps, active blue-team defense, and hands-on AI security.
“Partnering with colleges, conference organizers, and enterprise security leaders on accessible curriculum design, technical keynotes, and defensive architecture advisory.”
🎓 The Academic Knowledge Management Dilemma Modern higher education and enterprise training programs rely almost universally on Learning Management Systems (LMS) like Instructure Canvas to distribute coursework, lecture modules, assignments, student discussions, and grading rubrics. Yet for technical students, researchers, and security practitioners who build their intellectual workflows inside personal knowledge management (PKM) tools like Obsidian, Canvas represents an isolated, walled-off data silo: Ephemerality & Term Expiration: Once an academic semester concludes, student access to Canvas courses is routinely archived or revoked. Syllabi, instructor annotations, curated reading lists, and assignment rubrics vanish behind institutional access gates. Disconnected Knowledge Silos: Course notes authored in Obsidian remain disconnected from source materials, grading criteria, and module pacing guides living inside the web browser. Administrative Token Gating: Canvas exposes an extensive REST API, but institutional administrators frequently disable personal access tokens (Account > Settings > + New Access Token) for student roles due to enterprise compliance policies. Third-Party Cloud Aggregation Risks: Existing third-party scrapers and web integrations require routing student session credentials, course documents, and peer discussions through external SaaS servers. For students handling proprietary lab code or education records governed by FERPA and GDPR, third-party cloud aggregation is an unacceptable privacy compromise. Third-Party Cloud Scraper (High Risk): [Canvas LMS] ----(Credentials/Course Data)----> [Cloud Relay / SaaS] ----> [Obsidian Vault] ▲ └── Attack Surface & Data Leakage Risk Canvas to Obsidian Sync (Hybrid Local-First Architecture): [Canvas LMS REST API] ════(Direct Token / requestUrl)═══════════════════╗ ▼ [Canvas LMS Web Tab] ════(Session Cookies)════> [Browser Ext] ──(127.0.0.1)──> [Obsidian Vault] To bridge this divide while respecting strict privacy boundaries, I designed and open-sourced Canvas to Obsidian Sync (v0.3.1)—a hybrid, local-first ecosystem that provides two flexible ingestion pathways converging on a unified rendering engine. ...
How to probe and break local LLMs using Direct Injection, Roleplay, Obfuscation, and Authority Claims, demonstrating why system instructions fail as security boundaries.
How to build an isolated, Zero Trust development architecture using ephemeral runners, proxy-scanned package caches, and NIST SP 800-218 practices without slowing engineering velocity.
🔍 The Modern SPA Testing Paradox For more than two decades, the standard operating procedure for web application security assessments has centered around the interception proxy. Tools like Burp Suite, OWASP ZAP, and Caido position themselves between the browser and the target origin, capturing every HTTP request and response traversing the network socket. In traditional server-rendered architectures (PHP, ASP.NET, Rails), this model was nearly exhaustive: every routing decision, session transition, and authorization challenge occurred strictly across the wire. ...
How to build a 100% free, local AI security sandbox using Docker Desktop, Ollama (llama3.2), and a custom vulnerable chatbot to test prompt injection defenses without cloud API costs.
🚨 The 5:00 PM Firehose It is Tuesday, September 8, 2026, at 5:00 PM. Your vulnerability management dashboard updates, and the room goes silent. Microsoft has just released patches for 973 vulnerabilities in a single monthly update cycle—including 113 rated Critical. By every metric, it is the largest Patch Tuesday in history, shattering previous records. Pagers begin chiming. The compliance team sends an automated Slack notification reminding engineering leads that Critical CVEs must be remediated within 72 hours per enterprise SLA. ...
Why deploying hardware firewalls across 15 satellite clinics is an operational trap—and how to architect a cloud-native Zero Trust perimeter under NIST SP 800-207 that protects EMR databases without slowing down clinicians.
As the father of a college student with autism, my approach to inclusive teaching is both professionally grounded and deeply personal. I see firsthand how traditional, single-mode instructional methods can create unintentional barriers for neurodivergent learners or students balancing non-traditional paths. To foster an environment where every student can succeed regardless of their starting point or learning style, I focus on building multimodal, accessible, and low-cost learning environments across three key areas. ...
In August 2026 I delivered a webinar for the NCyTE Center on a question I kept hearing from community college faculty: how do you teach AI security when you don’t have a budget, your IT department locks down what you can install, and API costs for a live LLM are unpredictable? The answer I built — and the one this post walks through — is a zero-cost, fully local lab that any instructor can drop into their course next week. ...
The definitive synthesis and lessons-learned hotwash uniting enterprise architecture, DevSecOps, active defense, forensics, CTI, and governance into a master healthcare security blueprint.