https://saleemyousaf.co.uk/articles/ Cloud and cyber security architecture, threat analysis and governance by Saleem Yousaf. en-gb Mon, 07 Sep 2026 10:24:00 +0000 https://saleemyousaf.co.uk/articles/aws-security-agent-vs-pen-test/ https://saleemyousaf.co.uk/articles/aws-security-agent-vs-pen-test/ Mon, 24 Aug 2026 09:00:00 +0000 Cloud A practitioner's guide to AWS Security Agent and AWS Continuum: what the autonomous pen-testing service does, where and how to deploy it, costs, limitations and roadmap, with high-level and low-level design diagrams, and an honest comparison to human penetration testing. https://saleemyousaf.co.uk/articles/vpn-anonymity-network-account-device/ https://saleemyousaf.co.uk/articles/vpn-anonymity-network-account-device/ Sun, 23 Aug 2026 09:00:00 +0000 Threat A VPN covers the network layer and nothing else. Using the Scattered Spider GDID case and the GTA 6 leaker subpoenas, a practitioner's breakdown of the three layers of identity, why Tor has the same blind spot, and what real separation would take. https://saleemyousaf.co.uk/articles/bug-bounty-programme-defender-guide/ https://saleemyousaf.co.uk/articles/bug-bounty-programme-defender-guide/ Tue, 04 Aug 2026 09:00:00 +0000 Threat A bug bounty is an intake pipe you have to staff, not a control you buy. Safe harbour, scope, triage capacity, reward rubrics, and when a bounty is the right tool versus a pentest, from the programme owner's seat. https://saleemyousaf.co.uk/articles/incident-response-first-hour/ https://saleemyousaf.co.uk/articles/incident-response-first-hour/ Tue, 04 Aug 2026 09:00:00 +0000 Governance and Compliance Most organisations have an incident response plan and have never run it. Declaring the incident, containing without destroying evidence, the disclosure clock, the roles and the retainer, and the tabletop that tests it all. https://saleemyousaf.co.uk/articles/third-party-vendor-risk-management/ https://saleemyousaf.co.uk/articles/third-party-vendor-risk-management/ Tue, 04 Aug 2026 09:00:00 +0000 Governance and Compliance You can outsource the service, not the risk. Why the security questionnaire is theatre, and what a real programme covers: inventory, tiering, independent assurance, contract clauses, concentration risk and exit planning. https://saleemyousaf.co.uk/articles/iot-streaming-sticks-residential-proxy/ https://saleemyousaf.co.uk/articles/iot-streaming-sticks-residential-proxy/ Mon, 03 Aug 2026 09:00:00 +0000 Threat Preinfected Android TV boxes run as residential proxies while you stream and as ad-fraud bots while you don't. The consumer story is only half of it. What it means for network trust, fraud controls, IoT procurement and home-office risk. https://saleemyousaf.co.uk/articles/ciso-3-0-accountable-executive/ https://saleemyousaf.co.uk/articles/ciso-3-0-accountable-executive/ Sun, 02 Aug 2026 09:00:00 +0000 Governance and Compliance CISO 3.0 explained without the hype: the real lineage from 1.0 to 3.0, where the term is derived from, and the two forces behind it, board-level accountability and autonomous AI. What the mandate now owns, and the responsibility-versus-authority gap nobody has solved. https://saleemyousaf.co.uk/articles/physical-layer-rf-tools-and-the-law/ https://saleemyousaf.co.uk/articles/physical-layer-rf-tools-and-the-law/ Sun, 02 Aug 2026 09:00:00 +0000 Threat What handheld RF tools genuinely do, why legacy access credentials keep failing, the UK legal position on possession versus conduct, and how to run physical testing under proper authorisation. https://saleemyousaf.co.uk/articles/software-supply-chain-sbom-provenance/ https://saleemyousaf.co.uk/articles/software-supply-chain-sbom-provenance/ Sat, 01 Aug 2026 09:00:00 +0000 Cloud Security An SBOM nobody queries is a receipt. Inventory, signing, provenance and the enforcing admission policy that turns all of it into a control, plus the delivery sequence that gets you there. https://saleemyousaf.co.uk/articles/m365-google-workspace-hardening/ https://saleemyousaf.co.uk/articles/m365-google-workspace-hardening/ Sat, 01 Aug 2026 09:00:00 +0000 Cloud Security The tenant is the perimeter, and both platforms ship configured for adoption rather than defence. Identity, application consent, mail forwarding, sharing defaults, and the delivery plan that closes the gaps. https://saleemyousaf.co.uk/articles/securing-the-cicd-pipeline/ https://saleemyousaf.co.uk/articles/securing-the-cicd-pipeline/ Sat, 01 Aug 2026 09:00:00 +0000 Cloud Security The pipeline deploys to production, holds every cloud credential, and executes code from anyone who can open a pull request. Trust boundaries, OIDC federation, runner isolation, SHA pinning, artefact provenance, and the delivery plan that closes the gaps. https://saleemyousaf.co.uk/articles/windows-cdp-gdid-attribution/ https://saleemyousaf.co.uk/articles/windows-cdp-gdid-attribution/ Sat, 18 Jul 2026 09:00:00 +0000 Threat The Connected Devices Platform and the Global Device Identifier are convenience features that double as durable forensic evidence. How the GDID works, and how it helped name a Scattered Spider suspect. https://saleemyousaf.co.uk/articles/global-edge-front-door-cloudfront-gcp/ https://saleemyousaf.co.uk/articles/global-edge-front-door-cloudfront-gcp/ Thu, 16 Jul 2026 09:00:00 +0000 Cloud Security The global edge is your real internet-facing perimeter, and it is underrated. Azure Front Door, the AWS equivalent, and the GCP equivalent compared: security features, cloud and hybrid models, and setup via Terraform and the portal. https://saleemyousaf.co.uk/articles/azure-databricks-data-factory-security/ https://saleemyousaf.co.uk/articles/azure-databricks-data-factory-security/ Tue, 14 Jul 2026 09:00:00 +0000 Cloud Security A practitioner's guide to securing Azure Data Factory and Azure Databricks. Real use cases, why the data platform is a top-tier security boundary, and the identity, secrets, network, data, compute, and monitoring controls required in production. https://saleemyousaf.co.uk/articles/ai-security-field-guide/ https://saleemyousaf.co.uk/articles/ai-security-field-guide/ Sat, 11 Jul 2026 09:00:00 +0000 AI Security A practitioner's map of the OWASP LLM Top 10 and the open source tools to test, guard, and govern the LLM stack. Prompt injection, red-teaming with garak and PyRIT, runtime guardrails, and continuous evaluation. https://saleemyousaf.co.uk/articles/post-quantum-migration/ https://saleemyousaf.co.uk/articles/post-quantum-migration/ Thu, 09 Jul 2026 09:00:00 +0000 Cryptography What a post-quantum cryptography migration actually is, why harvest-now-decrypt-later makes it urgent, and the order that works: inventory first, crypto-agility second, algorithms last. https://saleemyousaf.co.uk/articles/cloud-iam-blast-radius/ https://saleemyousaf.co.uk/articles/cloud-iam-blast-radius/ Tue, 07 Jul 2026 09:00:00 +0000 Cloud Security Most cloud breaches are not clever. They are an over-privileged identity doing exactly what it was allowed to do. A practitioner's take on cloud IAM, blast radius, least privilege and the guardrails that hold up in production. https://saleemyousaf.co.uk/articles/cryptographic-keys-pki-rotation/ https://saleemyousaf.co.uk/articles/cryptographic-keys-pki-rotation/ Tue, 30 Jun 2026 09:00:00 +0000 Cryptography A practitioner's take on cryptographic keys, key material, key rotation and PKI. Why key management, not the algorithm, decides whether encryption protects anything, and the best practices that hold up in production. https://saleemyousaf.co.uk/articles/finops/ https://saleemyousaf.co.uk/articles/finops/ Tue, 23 Jun 2026 09:00:00 +0000 Security FinOps programmes stall because the engineer who deploys the infrastructure never sees the bill. The tooling is fine. The accountability structure is broken. A cloud security architect's view on fixing it. https://saleemyousaf.co.uk/articles/cloud-hsm/ https://saleemyousaf.co.uk/articles/cloud-hsm/ Tue, 16 Jun 2026 09:00:00 +0000 Security Cloud HSM gets specified for the wrong reasons. Saleem Yousaf breaks down AWS KMS, custom key store and CloudHSM direct: the real costs, and when each is right. https://saleemyousaf.co.uk/articles/cyber-essentials-plus-certification-pathway/ https://saleemyousaf.co.uk/articles/cyber-essentials-plus-certification-pathway/ Mon, 27 Apr 2026 09:00:00 +0000 Governance and Compliance A practitioner's guide to Cyber Essentials Plus under the Danzell question set and Requirements v3.3. The certification pathway, the five test cases, sampling mechanics, the new auto-fail rules, and the gotchas that sink remediation programmes.