Interim Findings: How Well Does Federal Guidance Cover the OWASP CI/CD Top 10?

Last month I introduced my SANS research project: a structured mapping of federal cybersecurity guidance against the risks that actually show up in CI/CD pipelines. The control-extraction and mapping phase is now done, and the interim numbers are worth sharing.

The usual caveat applies, and I mean it: these are interim results from a single coder. An independent reliability audit is pending, and no final calls get made until it has run. I flag this not as fine print but because reporting what the evidence says, before you know whether you like it, is the whole job. It is the same discipline I bring to security audits.

The NIS2 Registration Deadline Is October 3, 2026. Here Is What You Must Do Before Then

Poland’s amended National Cybersecurity System Act (the KSC Act), which implements the EU’s NIS2 directive, has been in force since April 3, 2026. The first hard deadline it sets is closer than most companies realize: by October 3, 2026, covered entities must self-identify and register with the authorities.

Note the phrasing. Nobody sends you a letter telling you that you are covered. The obligation to figure that out is yours, and so is the liability if you get it wrong.

From Pipeline to Policy: Writing a Research Whitepaper on Federal CI/CD Security

One of the most rewarding parts of the SANS Master’s program has been the push to take what you’ve seen in production and turn it into something rigorous. For my research project, I’m doing exactly that: writing a whitepaper that bridges the gap between federal CI/CD security guidance and what actually shows up in real pipelines.

Where the Idea Came From

I’ve spent years building and maintaining CI/CD pipelines across GitHub Actions, GitLab CI/CD, and Azure DevOps. Two patterns kept showing up regardless of team size or agency:

GWAPT Journey: The Reality of Web Application Security Testing

As I prepare for my upcoming GWAPT (GIAC Web Application Penetration Tester) certification, I’ve been reflecting on the incredible complexity and time-intensive nature of web application security testing. It’s fascinating how the virtual world has evolved to such an accessible state, yet the underlying security challenges remain as intricate as ever.

The Time Investment Reality

One of the most eye-opening aspects of web application security testing is just how time consuming it can be. Even with professional-grade tools like Burp Suite Professional at your disposal, the process requires an immense amount of patience, persistence, and deep technical understanding.

DevSecOps Best Practices: Integrating Security into CI/CD Pipelines

In today’s rapidly evolving cybersecurity landscape, the integration of security practices into the development lifecycle has become paramount. DevSecOps represents a cultural shift that emphasizes the importance of security as a shared responsibility across development, operations, and security teams.

The Foundation of DevSecOps

DevSecOps builds upon the principles of DevOps while adding security as a core component. This approach ensures that security is not an afterthought but rather an integral part of the development process from the very beginning.