Acuity Health: Part 3 — STRIDE Threat Modeling & BOLA Elimination
Integrate mini-STRIDE threat modeling into Agile sprint planning and implement bulletproof data-layer context checks against OWASP API1: BOLA.
AppSec
Bridging the Browser-to-Boundary Gap: From Client-Side SPA State Reconnaissance to Safe Harbor Verification
🔍 The Modern SPA Testing Paradox For more than two decades, the standard operating procedure for web application security assessments has centered around the interception proxy. Tools like Burp Suite, OWASP ZAP, and Caido position themselves between the browser and the target origin, capturing every HTTP request and response traversing the network socket. In traditional server-rendered architectures (PHP, ASP.NET, Rails), this model was nearly exhaustive: every routing decision, session transition, and authorization challenge occurred strictly across the wire. ...
Designing a Secure Software Development Program: Acuity Health AppSec Framework
An engineering framework operationalizing NIST SP 800-218 (SSDF), CI/CD quality gates, and OWASP API security defenses in a healthcare delivery organization.
Software Security Metrics, Technical Debt Quantification, and Program Maturity
Risk assessment in the modern software industry must evolve beyond static checklists to address the dynamic nature of Agile and DevSecOps environments. This plan adopts a scenario-based approach aligned with ISO 27001, b…
Ransomware Simulator: Cryptographic Attack Modeling and Application-Level Defenses
Broadcom. (2016). Alpha Ransomware. Symantec Enterprise. https://www.broadcom.com/support/security-center/protection-bulletin/alpha-ransomware…
Static Application Security Testing (SAST) and Secure Web Application Design
International Information System Security Certification Consortium (ISC2). (n.d.). Cybersecurity certifications and continuing education. https://www.isc2.org…
Threat Modeling and Architectural Risk Analysis: STRIDE and DREAD Applications
Hardening a Windows Server environment requires a structured, multi-layered approach that addresses risks, threats, and vulnerabilities across organizational, architectural, network, identity, software, and auditing doma…
Secure Software Development Life Cycle (SSDLC): Comparative Analysis of Microsoft SDL and Apple Ecosystems
Security cannot be treated as a post-deployment consideration in modern software development. Microsoft’s Security Development Lifecycle (SDL) embeds security requirements, threat modeling, verification, and monitoring i…
Compromised Network Indicators and Secure Application Risk Mitigations
Cybersecurity & Infrastructure Security Agency. (2021). Best practices for securing your home network [CSIA Guide 21-01]. U.S. Department of Homeland Security. https://www.cisa.gov/sites/default/files/publications/CISA_H…
Secure Software Development Life Cycle (SDLC) Phase Analysis and Control Gates
GeeksforGeeks. (2025). Top 8 Software Development Models Used in Industry. https://www.geeksforgeeks.org/software-engineering/top-8-software-development-models-used-in-industry/…