Security

The Claim Under Test If your password and your TOTP seed live in the same 1Password vault, unlocked by the same master password, you are running two-step verification (2SV), not multi-factor authentication (MFA). Same secret store, same unlock event, same attacker who now has both factors the moment they get one. This isn’t a hot take. It’s already worked out, published, and ignored, largely because PCI DSS Requirement 8.3 only mandates two factors from two categories, not factor independence or phishing resistance, and most cyber insurance underwriting still treats SMS OTP as an acceptable floor for standard users, even as carriers increasingly downgrade or reject it for privileged accounts. It’s really the same reason why faxing in the USA is considered acceptable for patient health data: HIPAA’s Security Rule requires reasonable and appropriate administrative, technical, and physical safeguards for transmitting e-PHI, not a specific transmission technology, so fax was never excluded and never got re-evaluated once better options existed. Not because either is safe or secure: because it’s legacy knowledge enshrined in permanance. The compliance bar and the security bar diverged years ago for MFA and 2SV; the industry kept building to the compliance bar. ...

SREs split into two camps, and neither one is fully right. The first camp matured out of operational IT. They’ve lived through a bad patch Tuesday, a driver update that bricked a fleet, a vendor hotfix that took down a cluster. Their instinct: let a patch cycle pass before you touch it. Let someone else find the landmine. This dates me, but is the world I learned in myself. The second camp never did operational IT work. They came up through cloud-native, IaC, CI/CD. They don’t have the scar tissue, but they inherit the doctrine anyway, because the first camp is louder and… has tenure. ...

The Problem: Conflicting MFA Configurations When your organization has both per-user Multi-Factor Authentication (MFA) and Conditional Access (CA) policies enabled simultaneously, per-user MFA takes precedence. This creates a cascading problem: users face excessive MFA prompts, support tickets increase, and your security posture becomes difficult to audit and control centrally. In one organization with ~200 users on per-user MFA and ~400 users on CA policies, this conflict was creating unnecessary friction and made it difficult to implement granular access controls based on risk and resource sensitivity. ...

The Internet Has a Security Blind Spot at Boot Time Most security people focus on the steady state. Is the WAF rule tuned correctly? Is the SIEM catching the right events? Is the policy up to date? What they often miss is the window between “the process started” and “the process is ready.” In Kubernetes, that window can be a meaningful attack surface — and in the case of Fastly’s Next-Gen WAF (formerly Signal Sciences) NGINX Ingress integration, it was. ...

Microsoft sent an email this week that caught my attention: all Azure Key Vault API versions prior to 2026-02-01 retire on February 27, 2027. The new API makes Azure RBAC the default access control model for Key Vaults, and legacy access policies become an explicit opt-in. Time to migrate before the deadline forces your hand. The Change: What Microsoft Is Actually Doing Starting with API version 2026-02-01 (releasing February 2026): ...