Tag
Encryption
8 articles
Security engineering
Key management and rotation
How key hierarchies, separation of duties, rotation and key deletion work in a cloud KMS, what PCI DSS and ISO 27001 expect, and the evidence auditors test.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
Tokenization and PCI DSS scope
Tokenization takes systems out of PCI DSS scope only under certain conditions. Where the vault sits, who can detokenize, and what assessors check in a design.
6 min read
Compliance frameworks
Reducing your PCI DSS scope
Every in-scope system must meet every applicable PCI DSS requirement. How scope works, the options that shrink it, and the ones that only look like they do.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read