IT security and identity & access management
Your systems process health, banking or business data and are subject to regulatory requirements. I check whether the configuration lives up to what the architecture promises, and close the gaps in between.
When a review pays off
- An application is to be connected to a central login (single sign-on).
- An identity provider such as Keycloak, Okta, Auth0 or Cidaas is being introduced or replaced.
- Accounts are taken over through phishing, and password plus SMS code is no longer enough.
- An audit, a certification or the MDR conformity assessment of a medical device is coming up.
- Cloud environments and containers have grown, and nobody has an overview of permissions any more.
Services
Identity and access management
Connecting applications with OAuth2 and OpenID Connect, clean role and permission models, secure token handling. Experience with Keycloak, Okta, Auth0 and Cidaas. I check existing integrations for the known mistakes: wrong flows, tokens that live too long, missing server-side checks.
YubiKeys and passkeys
Hardware keys and passkeys based on FIDO2 are phishing-resistant: an attacker cannot capture the login on a fake site. I plan and support the rollout, from choosing the keys and connecting them to your identity provider to spare keys, the process for lost keys and briefing your staff.
Hardening of cloud environments and containers
Review of accounts, roles, network and configuration in the cloud, and of container images and runtime. The goal is least privilege and a configuration that does not quietly loosen again.
Security scanning in CI/CD pipelines
Dependencies, container images, secrets and configuration are checked on every build, so weaknesses show up before they reach production.
MDR compliance in MedTech
For medical devices with software, the MDR requires demonstrable cybersecurity. I help with the threat model, the security requirements and the documentation for them.
Approach
Every engagement starts with a clear agreement on what is in scope. Then come review and targeted tests, a report with prioritised measures and, if you wish, implementation together with your team. Changes to live systems only happen after we agree on them.
Related services: AI security for LLM and agent applications, social engineering to test whether processes and people hold up.