Writing

Guides and writeups on security, networking and infrastructure, from my coursework, internships and home lab.

2026

2 posts
Jan 07Enterprise Cybersecurity Management: Frameworks, Risk, and StrategyFramework-level thinking from my Enterprise Cybersecurity Management coursework at BU -- how organizations weigh risk, cost, and compliance at scale.enterprise security · 5 min
Jan 01My MITRE eCTF 2026 Experience: Securing Bare-Metal Firmware on Arm Cortex-M0+Designing and attacking secure firmware on the MSPM0L2228 (Arm Cortex-M0+) as part of MITRE's embedded Capture the Flag 2026 competition.ectf · 4 min

2025

12 posts
Dec 07Nmap Mastery: The Reconnaissance Tool Every Security Person Must KnowA deep look at Nmap, the reconnaissance tool behind nearly every network engineer's and penetration tester's toolkit.nmap · 4 min
Nov 06Database Security: Protecting the Crown JewelsWhy database security is the last line of defense once the application layer is compromised, and how to apply least privilege at the data layer.database security · 4 min
Oct 06DeFi Security: Why $3 Billion Was Stolen in 2022 and What It Teaches UsBreaking down why over $3 billion was stolen from DeFi protocols in 2022, and the well-understood vulnerability classes behind most of it.blockchain · 4 min
Sep 05CTF Competitions: How Capture The Flag Made Me a Better Security EngineerHow Capture The Flag competitions on HackTheBox and TryHackMe sharpened my offensive and defensive security thinking beyond coursework alone.ctf · 4 min
Aug 05Cryptography Fundamentals Every Security Engineer Should KnowThe cryptographic primitives behind TLS, password hashing, and digital signatures -- what they do, when to use them, and how to avoid misusing them.cryptography · 5 min
Jul 05Wazuh: The Free SIEM and EDR Worth Taking SeriouslyWhy Wazuh is a serious free alternative to commercial SIEM and EDR platforms, based on running it alongside Splunk in my home lab.wazuh · 5 min
Jun 04Building RBAC Into a Java CRM: What I Learned at Sonata SoftwareWhat building Role-Based Access Control into a Java CRM at Sonata Software taught me about the mechanics and philosophy of authorization.rbac · 5 min
May 04Mobile Forensics 101: What Your Phone Remembers That You've ForgottenWhat smartphones retain that most people don't expect, and how mobile forensics differs from established desktop forensic practice.mobile forensics · 5 min
Apr 04Incident Response in Practice: Building and Running Your First PlaybookBuilding a practical incident response playbook around the NIST SP 800-61 lifecycle -- the process clarity that determines whether you contain a breach.incident response · 5 min
Mar 04Building a Blockchain-Based Authentication System with StellarExploring blockchain-based authentication on the Stellar network -- cryptographic identity as an alternative to centralized identity providers.stellar · 4 min
Feb 01Network Traffic Analysis with Wireshark: A Practical Beginner's WalkthroughA practical, beginner-friendly walkthrough of using Wireshark to analyze network traffic and debug protocols.wireshark · 4 min
Jan 01Is the Google Cybersecurity Professional Certificate Worth It? My Honest ReviewAn honest review of the Google Cybersecurity Professional Certificate, completed while preparing to apply to BU's MS program.certifications · 3 min

2024

10 posts
Dec 01AWS Security Fundamentals: IAM, VPC, and S3 Best PracticesA practical look at AWS IAM, VPC, and S3 fundamentals -- the cloud security controls that matter most, from my AWS Cloud Solutions Architect coursework.aws · 5 min
Nov 01Building Secure APIs: Mistakes I've Made and How to Fix ThemLessons from building and testing APIs in Java, Python, and TypeScript -- where API security actually breaks down and how to fix it.api security · 6 min
Oct 01SQL Injection: From Attack to Defense (What I Learned at My Internship)How SQL injection actually works and every layer of defense I applied while implementing secure database interactions at Sonata Software.sql injection · 6 min
Aug 02Smart Contract Security: The Vulnerabilities That Have Cost Billions of DollarsThe smart contract vulnerability classes -- from reentrancy to oracle manipulation -- that have collectively cost the blockchain industry billions.blockchain · 6 min
Jul 02MQTT Broker Hardening on Raspberry Pi: Lessons from My DoS Attack LabHardening an MQTT broker on a Raspberry Pi after running my own DoS attack lab -- where IoT messaging protocols fail by default.iot · 5 min
Jun 01Digital Twin for Network Security: Building a Virtual Lab to Simulate and Detect AttacksBuilding a virtual replica of an enterprise network in VirtualBox to simulate attacks and validate a Splunk + Zeek monitoring stack.network security · 6 min
May 01Setting Up a Home SIEM with Splunk: My Hands-On GuideA hands-on guide to setting up a home Splunk SIEM, from my Google Cybersecurity Certificate prep through my coursework at BU.siem · 5 min
Apr 01OWASP Top 10 Explained: What Every Developer Needs to KnowThe OWASP Top 10 explained in plain language for developers -- what each vulnerability looks like in real code and how to prevent it.owasp · 6 min
Mar 03How I Built Bounty Hawk: My Automated Recon and Vulnerability Discovery ToolWhy I built Bounty Hawk, a Python automation framework that handles recon and OWASP Top 10 checks so I can focus on the parts of pentesting that need judgment.penetration testing · 5 min
Feb 01Getting Started in Cybersecurity: My Student RoadmapMy path from a Bachelor's in Computer Applications to an MS in Cybersecurity at BU -- and the roadmap I'd give any student starting out.cybersecurity · 5 min