How an attacker who already controls a Domain Controller keeps coming back - the Golden Ticket forged from the krbtgt key and the Skeleton Key LSASS backdoor, with detection and mitigation.
2026, Jun 30 — 9 minute read
How Windows protects credentials at rest and in memory - password policy, LAPS, logon types, disabling WDigest, LSA Protection (RunAsPPL), Credential Guard (VBS), and the Protected Users group.
2026, Jun 30 — 11 minute read
How Windows replaces passwords with smartcards, TPM-backed virtual smartcards and Windows Hello for Business, the Kerberos PKINIT flow behind them, and why NTLM and ticket theft still apply.
2026, Jun 30 — 10 minute read
How SLH-DSA (FIPS 205) builds a stateless post-quantum signature from hash functions alone, layering WOTS+, XMSS, a hypertree, and FORS, with the twelve parameter sets and the small/fast trade-off.
2026, Jun 29 — 14 minute read
How ML-KEM (FIPS 203) builds a post-quantum key-encapsulation mechanism from module lattices, the K-PKE component, the Fujisaki-Okamoto transform with implicit rejection, and the three parameter sets.
2026, Jun 29 — 13 minute read
How ML-DSA (FIPS 204) builds a post-quantum digital signature from module lattices, the Fiat-Shamir with Aborts construction, rejection sampling, and the three NIST parameter sets.
2026, Jun 29 — 17 minute read
A technical survey of Linux isolation primitives (mount options, chroot, netfilter, cgroups, namespaces) and how they compose into containers, hypervisors, and Qubes OS as defense in depth.
2026, Jun 29 — 14 minute read
