Work

• Automating DISA STIG checks for Cisco ISE through a scanner with no ISE support

  The 81 rules of the Cisco ISE NDM and NAC STIGs (V2R4): 24 checked automatically over SSH and a read-only API, 7 in part, and 50 kept visible as manual items, never counted as a pass.

  DISA STIG · NIST 800-53 · NIST 800-171

• From a 223-item compliance register to a payment reference architecture

  A design corpus for a card-present payment reference architecture in which a compliance register drives the design, and card data is kept out of platform software by structure rather than policy.

  PCI DSS v4.0.1 · PCI Secure Software Standard v2.0 · NIST CSF · CIS Controls

• Compliance invariants enforced in the database, not the application

  A data model for regulated records in which the rules a reviewer checks are triggers, grants and constraints in PostgreSQL, tested on their failure paths.

  NIST 800-53

• Regulatory rules as versioned, effective-dated data in a small application

  A jurisdiction's statutory deadlines stored as effective-dated data rows instead of code, with a retention schedule and breach runbook written against the same records.

  NIST 800-53 · WCAG 2.1

• Making account disable revoke OIDC refresh tokens in a self-hosted identity provider

  An identity provider codebase serving OIDC, LDAPS and RADIUS, and a mutation-tested fix for a familiar bug class: disabling a user left their refresh tokens working.

  NIST 800-53 · NIST 800-171 · IEC 62443-3-3

• A phishing-resistant MFA rollout built on hardware security keys

  An enrollment and enforcement playbook for FIDO2 hardware keys on a business password manager: two keys per person, a firmware gate, no weaker fallback, and enforcement only after a per-person pilot.

  NIST 800-53 · NIST 800-171

• A team messenger whose server cannot read message content

  An end-to-end encrypted messenger for a small private group, built on MLS (RFC 9420), with passkey-only sign-in and a written statement of the metadata the server still sees.

  NIST 800-53

• Vendor advisory triage that never defaults to safe

  A tracker that pulls security advisories from seven network vendors, classifies each by what the vendor actually offers, and never reports an ambiguous remediation as fixed.

  NIST 800-53 · NIST 800-171 · IEC 62443

• From a one-off compromise assessment to a repeatable Windows audit

  An agentless, read-only PowerShell audit that re-runs the checks of a Windows compromise assessment, diffs each run against a known-good baseline and keeps remediation behind tiers.

  NIST 800-53 · NIST 800-171 · MITRE ATT&CK

• An insider-threat audit of self-hosted infrastructure, and the fixes it drove

  A read-only audit that assumed a compromised insider, found 51 verified issues, and traced how one foothold reached the keys. The fixes broke that chain first.

  NIST 800-53 · NIST 800-171 · IEC 62443-3-3

• Operations monitoring with recovery that is tested, not assumed

  A network and security operations monitor with asset-matched advisories, a fail-closed warm standby and a scheduled test restore.

  NIST 800-53 · NIST 800-171 · IEC 62443-3-3

• Resilient internal DNS: redundant resolvers, serve-stale and a sinkhole

  An authoritative and forwarding resolver, designed as redundant resolvers, to keep answering through upstream failures, block by policy without breaking internal names, and hold latency under load.

  NIST 800-53 · CIS Controls v8

• Agentless Cisco inventory over SSH, with an SNMP v2c/v3 fallback

  A single-file PowerShell collector that inventories Cisco hardware, software, licensing and enabled services, then writes import files for a support cloud, a CMDB and a network automation platform.

  NIST 800-53 · NIST 800-171 · IEC 62443-3-3

• Network documentation generated from the network itself

  A local tool that builds a de-duplicated L2/L3 map from what routers and switches report about themselves, behind one audited egress point, and exports it to editable Visio.

  NIST 800-53 · NIST 800-171 · IEC 62443 · FedRAMP

• Using public AI models on sensitive material without disclosing the values

  An offline Windows desktop tool that swaps identifiers in PHI, PII, card data, CUI and secrets for consistent tokens, puts every detection in front of a person, and restores real values in the model's reply.

  NIST 800-53 · NIST 800-171 · HIPAA Privacy Rule

• Private retrieval-augmented AI designed so no-egress is proved by test

  Local models answer questions over public security guidance with citations or a fixed refusal. The successor is designed so that ingest of non-public text stays locked until a packet-level egress test passes.

  NIST 800-53 · NIST 800-171

• Two AI agents, one audit trail: separation of duties for AI-assisted engineering

  A file-based mailbox protocol between two AI coding agents from different vendors: delegated tasks, cross-vendor adversarial review of designs and changes, a recorded tie-break, and a human go for every live change.

  NIST 800-53 · NIST 800-171 · NIST AI RMF 1.0

Independent work by Wade Blackwell. Each write-up is written from scratch for this site, without client, employer or personal data. Names, hostnames, addresses and configuration detail are left out on purpose.