BestHub
Sign in

Information Security

Showing 100 articles max
Latest Popular
Cilantro Loves Linux
Cilantro Loves Linux
Oct 15, 2026 · Information Security

System Attack-Defense Architecture: Multi-Layer Security Patterns from CAPTCHA to Replay Prevention

This chapter from Yin Hongliang's Architecture Fundamentals details attack models like SMS abuse, brute force, and replay attacks, then explains layered defenses including risk-based CAPTCHA, distributed verification with one-time credentials, idempotency keys, signature validation, and multi-dimensional rate limiting with circuit breakers.

CAPTCHAdefense in depthdistributed verification
0 likes · 9 min read
System Attack-Defense Architecture: Multi-Layer Security Patterns from CAPTCHA to Replay Prevention
TonyBai
TonyBai
Oct 14, 2026 · Information Security

2029 PQ Deadline: Filippo Valsorda Overhauls Crypto Right Answers — All Asymmetric Algorithms Must Change

Filippo Valsorda updates the Cryptographic Right Answers for 2026, mandating post-quantum migration by 2029: symmetric crypto stays with 256-bit keys, but all asymmetric algorithms change to X25519+ML-KEM-768 for key exchange, ML-DSA-44 for signatures, and HPKE for encryption, with TLS library and tooling recommendations.

Filippo ValsordaHPKEML-DSA-44
0 likes · 18 min read
2029 PQ Deadline: Filippo Valsorda Overhauls Crypto Right Answers — All Asymmetric Algorithms Must Change
IT Services Circle
IT Services Circle
Oct 13, 2026 · Information Security

REA: AI Agents Automate Reverse Engineering Across Binaries, Web, and Mobile

The REA project wraps reverse engineering tools like Ghidra and Hopper into an MCP server, letting AI agents analyze binaries, Electron apps, Android APKs, and websites automatically. The author demonstrates REA reconstructing a 1996 game's audio algorithm with byte-perfect verification, but notes limitations: no dynamic debugging support, struggles with packed/obfuscated commercial software, and adversarial attacks can mislead AI analysis.

AI agentsAndroidElectron
0 likes · 15 min read
REA: AI Agents Automate Reverse Engineering Across Binaries, Web, and Mobile
Golang Shines
Golang Shines
Oct 13, 2026 · Information Security

Go 1.27.1 SCA: Reachability Analysis Detects Hidden CVE Risks in Transitive Dependencies

The article details how an enterprise uses govulncheck's symbol-level reachability analysis and a custom AST scanner to identify high-risk CVEs and Go 1.27.1-incompatible unsafe memory patterns in transitive dependencies, preventing a production segmentation fault from a legacy library's hardcoded alignment assumptions.

Go 1.27.1Memory SafetyReachability Analysis
0 likes · 11 min read
Go 1.27.1 SCA: Reachability Analysis Detects Hidden CVE Risks in Transitive Dependencies
Cilantro Loves Linux
Cilantro Loves Linux
Oct 13, 2026 · Information Security

User Security Architecture: Handling Compromise, RBAC, and Token Revocation

This chapter from 'Architecture Fundamentals' covers user security across the account lifecycle: login kickout mechanisms, password policies and storage, recovery and registration flows, RBAC with data permissions, and token/JWT trade-offs, emphasizing revocation and recovery as critical security capabilities.

JWTRBACauthentication
0 likes · 10 min read
User Security Architecture: Handling Compromise, RBAC, and Token Revocation
ThinkingAgent
ThinkingAgent
Oct 9, 2026 · Information Security

From Chat to Action: The 10-Pillar Security Architecture for Permissioned AI Agents

This article details the fundamental shift from content safety to action safety when AI agents gain real system permissions, presenting a comprehensive 10-pillar security architecture covering identity, IAM, policy engines, guardrails, sandboxes, human-in-the-loop, audit, and kill switches for production agent deployment.

AI Agent SecurityAction SafetyAgent IAM
0 likes · 64 min read
From Chat to Action: The 10-Pillar Security Architecture for Permissioned AI Agents
Architects Research Society
Architects Research Society
Oct 8, 2026 · Information Security

AgentIAM: Open Spec for AI Agent Identity & Access Management in the Autonomous Era

The article analyzes AICTRI's AgentIAM specification, an open-source framework for identity and access management of autonomous AI agents, detailing its seven-part architecture, core innovations like workload attestation and delegation non-amplification, and three reference implementations under permissive licenses.

AI agentsAI securityAgentIAM
0 likes · 10 min read
AgentIAM: Open Spec for AI Agent Identity & Access Management in the Autonomous Era
Model Perspective
Model Perspective
Oct 7, 2026 · Information Security

Why 'Has the Cat Been Fed?' Saved a Life: Bayesian Analysis of Covert Distress Signals

The article analyzes how a pre-arranged innocuous phrase served as a covert distress signal in a kidnapping case, using Bayesian probability to show why it outperformed vague warnings, explains the dual-audience requirement, the time-critical value of early alert before victim transfer, and the economic logic of human trafficking that makes negotiation futile, concluding with practical steps for setting up personal safety codes.

Bayesian inferencecovert communicationcrime economics
0 likes · 10 min read
Why 'Has the Cat Been Fed?' Saved a Life: Bayesian Analysis of Covert Distress Signals
21CTO
21CTO
Oct 7, 2026 · Information Security

Cloudflare to Launch Free Public CA with ACME Automation and Post-Quantum MTC

Cloudflare plans to become a public certificate authority offering free, automated TLS certificates via ACME, leveraging GlobalSign's trusted root for immediate compatibility, while pursuing operational transparency and Merkle Tree Certificates for post-quantum readiness, providing a redundant alternative to Let's Encrypt for Linux admins and self-hosted developers.

ACMECertificate AuthorityCloudflare
0 likes · 6 min read
Cloudflare to Launch Free Public CA with ACME Automation and Post-Quantum MTC
IT Architects Alliance
IT Architects Alliance
Oct 7, 2026 · Information Security

Zero Trust Done: Build Control Plane Before Ticket Agent Write Access?

Article argues for read-first validation before enabling ticket-closing Agent write access, detailing five enforcement layers (identity, tool authorization, credentials, runtime isolation, audit), a dual-track transition with human-in-the-loop, idempotency and atomic state checks, and a seven-question launch review to ensure execution boundaries exist before any control-plane investment.

auditauthorizationcontrol plane
0 likes · 15 min read
Zero Trust Done: Build Control Plane Before Ticket Agent Write Access?
Frontline Investigation
Frontline Investigation
Oct 3, 2026 · Information Security

Data Labels Show Sensitivity, Not Permissible Use: The Governance Gap in Sharing

The article explains that data classification and grading labels indicate protection requirements but do not define permissible usage conditions, which depend on specific purpose, scope, and time limits per regulations like China's Government Data Sharing Regulations; it warns that reusing existing interfaces for new purposes risks unauthorized expansion unless governance systems preserve the original authorization context.

Data GovernanceGB/T 43697Government Data Sharing Regulations
0 likes · 7 min read
Data Labels Show Sensitivity, Not Permissible Use: The Governance Gap in Sharing
Frontline Investigation
Frontline Investigation
Oct 1, 2026 · Information Security

Patch Installed, Risk Unresolved: The Three States of True Vulnerability Remediation

A vulnerability patch showing 'installed' doesn't guarantee risk is resolved; true remediation requires verifying exposure convergence and business acceptability, aligning security and business validation, and documenting residual risks with clear ownership and review timelines.

NIST guidelinesbusiness continuityevidence-based remediation
0 likes · 7 min read
Patch Installed, Risk Unresolved: The Three States of True Vulnerability Remediation
Frontline Investigation
Frontline Investigation
Sep 30, 2026 · Information Security

AI Voice Clones Sound Like Family: Why You Must Still Call Back

As AI voice cloning becomes indistinguishable from real voices, regulators warn that familiar-sounding calls cannot be trusted for financial requests; independent verification via known contact methods remains the most reliable defense against increasingly sophisticated impersonation scams.

AI voice cloningFTC guidelinesNFRA warning
0 likes · 8 min read
AI Voice Clones Sound Like Family: Why You Must Still Call Back
DeepHub IMBA
DeepHub IMBA
Sep 29, 2026 · Information Security

Cross-Session Memory Poisoning: Auditable Secure Write Paths for Agent Memory

This article explains how memory poisoning attacks persist across AI agent sessions, details the MINJA attack technique, and proposes auditable memory storage formats, secure write paths with trust scoring, and detection methods including integrity checks and activation monitoring to defend against persistent memory corruption.

AI Agent SecurityMINJA attackOWASP ASI06
0 likes · 15 min read
Cross-Session Memory Poisoning: Auditable Secure Write Paths for Agent Memory