Most of what I publish here starts as something that broke. A site I own was compromised and stayed compromised for six days while every health check reported 200. A monitor I trusted turned out never to have been tested against a failure. An IAM policy I revoked left the access key behind it fully live. Each of those became a control, and each control became a piece of writing.
The through-line is verification. Anyone can describe a control. A control nobody tested is a belief, and a control with no stated residual risk is a sales pitch. So the pieces here follow one shape: what the exposure actually was, why the obvious fix did not close it, what got built, how it was proven, and what is still sitting there unaddressed.
What I actually operate
- A production WordPress site behind a CDN-only origin firewall, with public SSH closed and access over a mesh VPN.
- A two-GPU inference node running a local model, so student work never reaches a vendor API during grading or feedback.
- Uptime and patch-state monitoring for both, including a push canary that fails when the update machinery itself dies.
Where I am headed
Toward security and AI governance work. The credential track is NIST AI RMF and the IAPP AIGP; the practical track is the systems above, documented properly. Both are in progress and I write about them as they go rather than after they are tidy.
Elsewhere
Classroom, curriculum, and student-facing work lives at STEMageddon. I mentor a NASA HUNCH team and host regional design reviews.
Contact
Email is the reliable path: david@davidcberry.com.