$ ls writing/ -lt
writing.
Notes from the desk, not thought leadership. Specifics over slogans. If a piece couldn't earn its keep at a kitchen table, it didn't make it here.
Total · 201 pieces
Latest · 2026·10·10 Page · 5 / 9 Locale · en_GB
License · CC BY 4.0
2026·03·28
What I got wrong An honest account of the calls I have made in the past three years that did not land — what I was reading into the evidence that was not there, and what I would do differently. reflection · craft · leadership
6 min
2026·03·14
Living with it: the costs of offline-first Post five of six on the Covert Cyber Deck. Honest notes on using the slate as a daily driver for several months. What I gave up. What surprised me. Where the bargain felt good and where it felt silly. cyberdeck · craft · honesty · sovereignty
7 min
2026·03·10
Hardening Microsoft 365 for a Small Business Most small businesses run Microsoft 365 and have never touched its security settings. This tutorial covers the controls that matter, in order of impact. tutorial · defence · microsoft-365 · small-business · hardening · email · cloud
14 min tutorial
2026·03·10
How to Use Tor: A Practical Guide to Anonymous Browsing Install, configure and use the Tor Browser on Linux and Windows with bridges, security levels and operational discipline. tutorial · privacy · tor · anonymity · opsec
12 min
2026·03·07
The two disciplines that quietly do most of the work Default-deny on USB and hardware-backed multi-factor authentication. Two unfashionable practices that, between them, would prevent more compromise than any tool a CISO will buy this year. operational · craft · hardening
5 min
2026·03·03
DeepSeek and the supply chain of intelligence Post 19 of the AI series. The open-weight reasoning models from DeepSeek and others have changed the supply chain of intelligence. The provenance, licensing, and operational properties of the models you run are now a cyber security question worth taking seriously. ai · supply chain · provenance · series
7 min
2026·02·14
The Cyber Security and Resilience Bill, a board read What the Bill actually does, what it changes for boards in and out of scope, and what the executive should be preparing to evidence over the next twelve months. regulation · governance · ned · board
8 min
2026·02·11
fail2ban is not access control. It is not nothing, either. A short essay on the long argument I keep having with people who should know better. technical · hardening · ssh
4 min
2026·02·10
How to Use I2P: A Practical Guide to the Invisible Internet Install and configure the I2P router on Ubuntu, access eepsites, and understand how I2P differs from Tor. tutorial · privacy · i2p · anonymity · networking
11 min
2026·02·03
Setting Up MFA Everywhere: A Practical Small-Business Guide Multi-factor authentication is the single highest-leverage security control most small businesses still have not enabled. Ten minutes per service, done once. tutorial · defence · mfa · small-business · hardening · authentication
12 min tutorial
2026·01·24
What I deliberately left off Post four of six on the Covert Cyber Deck. Every component is a question. These are the things I chose not to include — Bluetooth on the management plane, a camera, GPS, cellular, several others — and the single question that flushed each one out. cyberdeck · subtraction · privacy · craft
7 min
2026·01·21
Configure psad: Detecting Port Scans on Linux Install and configure psad on Ubuntu to detect and optionally block network port scans using iptables log analysis. tutorial · defence · psad · linux · hardening · intrusion-detection
9 min
2026·01·20
The CSR Bill and AI in cyber: what the regulator now expects Post 18 of the AI series. The Cyber Security and Resilience Bill is moving toward commencement. What it changes for AI in cyber security specifically, what the secondary legislation drafting suggests, and what vendors and customers should be preparing. ai · regulation · csr-bill · series
7 min
2026·01·19
Installing and Configuring Postfix with ClamAV and SpamAssassin Build a hardened mail server on Ubuntu with Postfix for delivery, ClamAV for virus scanning and SpamAssassin for spam filtering, integrated through Amavis. tutorial · defence · postfix · clamav · spamassassin · email · hardening · amavis
22 min
2026·01·19
Self-Hosting a Password Manager with Vaultwarden on Ubuntu Every credential your organisation holds, stored on someone else's server. Vaultwarden gives you the Bitwarden experience without the trust dependency. tutorial · defence · vaultwarden · password-manager · self-hosting · docker · hardening
12 min tutorial
2026·01·17
SolarWinds at five Five years on from the disclosure of the SolarWinds Orion compromise, what actually changed in how UK boards think about third-party software risk — and what did not. A practitioner's retrospective on the case study that defined the decade. supply chain · governance · ned · retrospective
8 min
2026·01·10
The supplier underneath the supplier Three disclosures last month tell the same story from three angles: NHS England's tech provider, an NHS GP software supplier, and the Foreign Office. None of them is the headline brand. All of them are where the actual attack surface lives. supply-chain · third-party · governance · cni
6 min
2025·12·29
The year 2025 was actually about An end-of-year reflection on what 2025 turned out to be, what the noise mostly was, and what the genuinely consequential shifts were for UK cyber security at board level. annual review · governance · ned · board
8 min
2025·12·20
Where I trusted, where I didn't Post three of six on the Covert Cyber Deck. The supply chain decisions behind the build — why I chose the parts I chose, why I rejected several I considered, and why I ended up drawing the carrier PCB myself rather than buying one. cyberdeck · supply-chain · craft · sovereignty
7 min
2025·12·09
Year in cyber AI 2025: the agentic year that mostly was not Post 17 of the AI series. The 2025 retrospective. Operator agents arrived but mostly in pilot, the determinism property went mainstream in procurement, the regulators caught up, and constrained agency became the named shape. The honest read going into 2026. ai · retrospective · soc · series
8 min
2025·12·08
Building a Honeypot with T-Pot on Ubuntu I have run honeypots since 1998. T-Pot bundles a dozen of them behind a single dashboard and turns passive observation into actionable intelligence. tutorial · defence · honeypot · t-pot · threat-intelligence · linux · hardening
15 min tutorial
2025·11·27
Hardening Firefox for Privacy Tor is for when you need anonymity. This is for the everyday browser — configured so it stops volunteering information about you to every site you visit. tutorial · privacy · firefox · browser · hardening · dns
13 min tutorial
2025·11·22
The threat model, written down Post two of six on the Covert Cyber Deck. The threat model I have spent the last month writing down — what I am protecting against, what I am not, and why putting it in plain English changed the rest of the build. cyberdeck · threat-model · privacy · sovereignty
6 min
2025·11·17
What the merger was actually for Hedgehog Security and UK Cyber Defence merged this month. Here is the thinking the announcement did not contain — what we were trying to fix, and what kind of firm we are now trying to be. leadership · ukcd · hedgehog · craft
7 min
2025·11·10
How to Use GPG to Secure Your Email Generate a GPG key pair, publish your public key, encrypt and sign email on the command line and in Thunderbird. tutorial · privacy · gpg · pgp · email · encryption
14 min
$ grep -l tag:* | sort | uniq
Browse by tag — filtering applies to the list above.