https://blogs.damiendye.uk/en/tags/security/ Recent content in Security on Damien Dye's Blog Hugo en-GB Sun, 27 Sep 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/dns/dnssec-the-root-is-signed-you-are-not/ Sun, 27 Sep 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/dns/dnssec-the-root-is-signed-you-are-not/ Counted from the live root zone: 1,351 of 1,438 TLDs are signed, every single gTLD among them. Then it stops. 39 of 2,390 live gov.uk domains, 1 of 9 certificate authorities, and windowsupdate.com has no DS at all. What DNSSEC stops, what is really blocking it, and whether the problem is that we still do not understand DNS. https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ Thu, 24 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ DoH sends your DNS lookup to a resolver of the client's choosing on port 443, which your own resolver never sees, so it cannot block a bad name or log it. Sold as privacy, but DoT gave you that in 2016. What DoH really adds is bypassing the network admin. The mechanism, the malware, who pushed it, the courts now suing the resolvers, and the fix. https://blogs.damiendye.uk/en/networking/protocol-helpers-turn-them-off/ Mon, 14 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/networking/protocol-helpers-turn-them-off/ A NAT helper reads the inside of your packets and opens inbound ports on what it finds there. Anyone can write that text — a web page has been enough since 2010. How helpers work, how crafted packets turn them into a port-opening service for strangers, what IPsec pass-through does, why they fail Cyber Essentials, and how to switch the lot off. https://blogs.damiendye.uk/en/random/is-your-msp-lying-to-you-part2/ Fri, 28 Aug 2026 17:00:00 +0100 https://blogs.damiendye.uk/en/random/is-your-msp-lying-to-you-part2/ Part 2 of 3. Cloud for a business all in one building. The firewall brand with the most exploited vulnerabilities on CISA's list. Backups nobody has restored, reports that never reach you, an agent on every machine answering to a console you have never seen. What the ICO found at Advanced and Capita, and the keys that open all of it. https://blogs.damiendye.uk/en/random/backdoors-and-who-is-accused/ Tue, 25 Aug 2026 07:00:00 +0100 https://blogs.damiendye.uk/en/random/backdoors-and-who-is-accused/ Part 6 of 8. Barring a supplier on security grounds needs a standard applied evenly. A Swiss inquiry confirmed two intelligence services owned an encryption firm and sold weakened machines to 120+ governments; a crypto standard was pulled over a suspected weakness; kit gets intercepted in transit. Then the 2024 event that settled it. https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Mon, 24 Aug 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Every domain-joined machine finds its DC by asking DNS for an SRV record, so the _msdcs locators are the most security-critical records you have. Signing them from a Samba4 DC: BIND with dlz_bind9, inline signing, a hidden primary, dynamic updates kept out of the locator zone, then forcing Windows and Linux clients to validate the signatures.