Security-Privacy

The NetScaler zero-days raise a question that reaches beyond Citrix: when a national CSIRT warns some organisations before others, who decides who is worth protecting first?

Two NetScaler zero-days have Dutch hospitals and government taking their remote access offline, six years after the first Citrix-file. The patch is the easy part. The real question is why one appliance can hurt this much.

Compliance is not security. The Cybersecurity Act should strengthen resilience, not put engineers in handcuffs.

A response to the NCSC Community piece on ‘open source, unless’, and why one line about transparency needing a watcher deserves more scrutiny than it got.

The Odido breach did not end when the systems were patched. It continued wherever abandoned domains, forgotten mailflows, and expired infrastructure were still trusted.

The audit passed. The certificate is on the wall. And your security posture is still held together with duct tape and good intentions.

France acts. The Netherlands watches. Digital sovereignty is not a vision problem — it is a lack of spine.

The European Commission ran its infrastructure on AWS while writing sovereignty frameworks for everyone else. Now 350GB is gone. This was not a surprise.

Een waarschuwing voor organisaties: in de zomer neemt mentale vermoeidheid toe, waardoor security-risico’s stijgen, ondanks dat systemen operationeel blijven.

A decade of Dutch digital sovereignty surrendered through procurement. From the failed Rijkscloud to the CLOUD Act, and now a state secretary who confirms it in writing and presses on anyway.

Mobile authenticator vulnerabilities expose a fundamental truth. Securing the endpoint OS while leaving the phone untouched is security theater. Here is what actually works.

How Fortinet’s licensing changes force Linux engineers into costly VPN workarounds, creating operational risk.

ISO 27001 documentation can give a false sense of security, leading to compliance illusions and enterprise risk.

A post-mortem of Dutch digital sovereignty failures, exploring enterprise and systemic IT accountability.

A case study of institutional failures in cybersecurity and governance, highlighting systemic risks in enterprise IT.

How burnout and gamification create easy targets for social engineering attacks on enterprise admins.

SSH infrastructure is often treated as stable, but neglect can create hidden vulnerabilities in enterprise environments.

Pro-Russian hackers exploit Linux VMs inside Windows to bypass EDR, creating a critical security blind spot.

A personal reflection on company laptop security, balancing policy, autonomy and practical IT responsibilities.