Peter Bassill — latest writing on cyber security
Latest articles · page 8 of 14
-
How to Use Tor: A Practical Guide to Anonymous Browsing
Install, configure and use the Tor Browser on Linux and Windows with bridges, security levels and operational discipline.
-
The two disciplines that quietly do most of the work
Default-deny on USB and hardware-backed multi-factor authentication. Two unfashionable practices that, between them, would prevent more compromise than any tool a CISO will buy this year.
-
DeepSeek and the supply chain of intelligence
Post 19 of the AI series. The open-weight reasoning models from DeepSeek and others have changed the supply chain of intelligence. The provenance, licensing, and operational properties of the models you run are now a cyber security question worth taking seriously.
-
The Cyber Security and Resilience Bill, a board read
What the Bill actually does, what it changes for boards in and out of scope, and what the executive should be preparing to evidence over the next twelve months.
-
fail2ban is not access control. It is not nothing, either.
A short essay on the long argument I keep having with people who should know better.
-
How to Use I2P: A Practical Guide to the Invisible Internet
Install and configure the I2P router on Ubuntu, access eepsites, and understand how I2P differs from Tor.
-
Setting Up MFA Everywhere: A Practical Small-Business Guide
Multi-factor authentication is the single highest-leverage security control most small businesses still have not enabled. Ten minutes per service, done once.
-
What I deliberately left off
Post four of six on the Covert Cyber Deck. Every component is a question. These are the things I chose not to include — Bluetooth on the management plane, a camera, GPS, cellular, several others — and the single question that flushed each one out.
-
Configure psad: Detecting Port Scans on Linux
Install and configure psad on Ubuntu to detect and optionally block network port scans using iptables log analysis.
-
The CSR Bill and AI in cyber: what the regulator now expects
Post 18 of the AI series. The Cyber Security and Resilience Bill is moving toward commencement. What it changes for AI in cyber security specifically, what the secondary legislation drafting suggests, and what vendors and customers should be preparing.
-
Installing and Configuring Postfix with ClamAV and SpamAssassin
Build a hardened mail server on Ubuntu with Postfix for delivery, ClamAV for virus scanning and SpamAssassin for spam filtering, integrated through Amavis.
-
Self-Hosting a Password Manager with Vaultwarden on Ubuntu
Every credential your organisation holds, stored on someone else's server. Vaultwarden gives you the Bitwarden experience without the trust dependency.
-
SolarWinds at five
Five years on from the disclosure of the SolarWinds Orion compromise, what actually changed in how UK boards think about third-party software risk — and what did not. A practitioner's retrospective on the case study that defined the decade.
-
The supplier underneath the supplier
Three disclosures last month tell the same story from three angles: NHS England's tech provider, an NHS GP software supplier, and the Foreign Office. None of them is the headline brand. All of them are where the actual attack surface lives.
-
The year 2025 was actually about
An end-of-year reflection on what 2025 turned out to be, what the noise mostly was, and what the genuinely consequential shifts were for UK cyber security at board level.