I’m building in public toward Tier 1 SOC and Detection Engineering roles. I share: Home lab builds Alert triage and investigations SIEM, EDR and network telemetry Detection logic and troubleshooting No production claims. Just evidence of what I’m learning, testing and building.

Your banking app does not need direct access to the bank's database to show your balance. It communicates through an API. An API lets applications exchange data and request services. But every API endpoint needs proper security. Convenience should never mean unrestricted access

Your password gets you through the login. But what gives an application permission to access your data afterward? An access token. It carries authorization information for specific resources. If stolen, it can give attackers access within its permissions.

What if an attacker does not need your password because they stole your active session? That is session hijacking. It happens when an attacker obtains a valid session and uses it to impersonate you. Sometimes stealing the session is enough.

RAM is one of the most valuable evidence sources in DFIR, especially during a live incident. In many investigations, memory can contain evidence that will disappear permanently the moment the computer is powered off or restarted. Think of RAM as the computer’s live workspace. The hard drive tells you a lot about what happened historically; RAM can tell you what is happening right now. A simple example: imagine an attacker compromises a Windows workstation using PowerShell and launches a reverse shell entirely in memory. There may be no obvious malware executable on the disk. If the investigator shuts the computer down before collecting RAM, some of the strongest evidence could disappear. This is why DFIR commonly follows the Order of Volatility: CPU/register/cache → RAM → active network connections/processes → temporary files → disk → remote logs/backups. In practice, RAM is usually acquired before shutting down a compromised machine when operational and legal considerations permit. Common memory-forensics tools include Volatility 3, WinPmem, Magnet RAM Capture, FTK Imager, DumpIt, Belkasoft RAM Capturer, and similar trusted acquisition tools.

Logging in is only the first step. How does an application remember that you already proved who you are? An authentication token can provide that proof after authentication. Protect the token. If someone steals it, they may not need your password.

There are other entry-level roles worth going after besides a SOC Analyst.

Day 31 & 32/90 of My Cybersecurity Learning Journey 🔐 The past two days have been about Reconnaissance, OSINT and getting more hands-on with Kali Linux. I learned how reconnaissance helps build a picture of what is publicly exposed before moving into active testing.

One of the biggest mistakes I see in many Ghanaian banks is the overreliance on GRC-driven security strategies. Some CISOs and CIOs are quick to approve budgets worth millions of cedis for security products and platforms, yet give little attention to manual security testing. Most of them often invest millions of cedis in security products, yet overlook the critical value of manual penetration testing, Forensics investigations and hands-on security validation. They invest because GRC says so; mostly not because is the right thing to do. There are little or no technical people in there. Most works are outsourced. This is why many CISOs and CIOs get misled sometimes. A vulnerability assessment report is presented to them as a penetration test report, and they accept it without question😂😂. Security tools are important, but they are not a silver bullet. The threat landscape today is evolving rapidly, and many of today's vulnerabilities, misconfigurations, and attack paths can only be uncovered through skilled manual assessment.

I’m about to take another 100 practice questions before I sleep. I’m not just counting correct answers anymore. I’m studying WHY I get things wrong and where my thinking breaks down. That’s where I’m seeing my progress. What are you working on tonight?

Installing Windows Server was the easy part. Deciding what this machine was going to become was more important. Part 13 of rebuilding my SOC home lab. The isolated network was ready, so I started putting actual systems inside it. First up: DC01.

An alert tells you where to start looking. It doesn’t tell you what happened. That’s where the investigation starts.

I wanna be so good in cybersecurity Especially soc analyst That's all my desire

Getting into digital forensics is one thing. Learning how to think like a forensic examiner is another. I spoke about the journey, the mindset and the technical side of digital forensics with Deogratius Okello on The Cyber Weekly.

The world is round. And the place that might seem like the end, might also be the beginning.

Today I learnt about the OWASP Top 10: 2025. the most critical web application security risks right now. Not just memorizing the list, but understanding how these vulnerabilities happen and how attackers can abuse them.

Cybersecurity capstone, Task 2: Kali and Ubuntu VMs talking to each other. What tripped me up: Default NAT isolates VMs. A NAT Network fixed it. SSH was installed on Ubuntu but switched off. Ping 0% loss, SSH login works. Nmap scans are next.