https://securityblueprints.io/categories/security-invariants/ Recent content in Security Invariants on Security Blueprints Hugo en user@example.com (Niels Provos) user@example.com (Niels Provos) Security Blueprints, LLC Sun, 06 Sep 2026 23:57:44 +0000 https://securityblueprints.io/security-invariants/supply-chain-aging/ Fri, 01 Nov 2024 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/security-invariants/supply-chain-aging/ Overview Supply Chain Aging is a security invariant that mandates all third-party open-source software to be aged by a specified number of days before it can be imported into the production environment. This aging period allows the community to identify and mitigate any malicious backdoors or vulnerabilities that may have been introduced into the software. Benefits Increased Detection of Malicious Code: Significantly increases the likelihood that malicious backdoors inserted into open-source packages have been found and removed. https://securityblueprints.io/security-invariants/positive-execution-control/ Tue, 29 Oct 2024 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/security-invariants/positive-execution-control/ Overview Positive execution control is a security invariant that enables only pre-approved (allow-listed) applications to execute on endpoints and production systems. By strictly controlling which applications can run, organizations effectively prevent unauthorized or malicious software from executing. Benefits Malware Prevention: Stops unknown or unauthorized software from executing, thus preventing malware infections. Ransomware Protection: Prevents ransomware from executing, protecting company data from theft or irreversible loss due to unpaid ransoms. Spear Phishing Resistance: Enhances security by blocking socially engineered attacks involving the download and execution of malicious software. https://securityblueprints.io/security-invariants/egress-control/ Mon, 28 Oct 2024 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/security-invariants/egress-control/ Overview Egress control is a security invariant that requires all outbound network traffic from services to be explicitly allowed through domain-based allowlists. By enforcing that services can only connect to pre-approved external destinations, this security control: Prevents exploitation of vulnerabilities that require external connectivity, e.g. to download a second stage payload. Blocks command and control (C2) traffic from compromised systems Limits data exfiltration attempts from compromised hosts Provides clear visibility into legitimate vs. https://securityblueprints.io/security-invariants/hardware-second-factor/ Mon, 28 Oct 2024 00:00:00 +0000user@example.com (Niels Provos) https://securityblueprints.io/security-invariants/hardware-second-factor/ Overview A mandatory hardware second factor requires all user authentication to be completed using a physical security key, in addition to traditional passwords. This approach effectively nullifies password phishing and credential stuffing attacks. Benefits Password Phishing Protection: Password compromise alone becomes insufficient for account access Elimination of Replay Attacks: Unlike SMS or time-based tokens, hardware keys cannot be intercepted or replayed Real-World Implementation Major technology companies have proven the effectiveness of this security invariant through comprehensive deployments: