QudratSec

Qudratulla

Cybersecurity specialist in the public sector

Most of my work is detection, secure architecture and risk. I find out where an organization is exposed, and close those gaps in a way the people running it can actually maintain.

Email me Read my background
Network segmentation diagramFour nested zones: internet, perimeter, internal network and critical systems. A request from a user passes through an opening in each boundary to reach a database. A workstation that tries to reach the critical zone directly is stopped at the boundary.internetuserperimetergatewayinternalapp serverworkstationcriticaldatabaseblocked
Segmentation in one picture: traffic only enters a zone through an opening that has been deliberately allowed. Anything else stops at the boundary.
Works on
Detection, secure architecture, governance and risk
Tools
SIEM, EDR and XDR
Principles
Zero Trust, network segmentation, access control
Background
Self-taught, starting at age eleven

How I got into security

It started with a game of Counter-Strike, and two strangers who took the time to explain what they had just done to my computer.

  1. Age 11

    On the receiving end

    I was playing Counter-Strike: Source when someone used an exploit against me. It turned out to be two guys serving in the U.S. military. Instead of laughing it off and moving on, they got on Ventrilo and walked me through what they had done and how to clean it up.

    From then on, computers weren’t just something I used. I wanted to understand how they worked underneath.

  2. School years

    Two unlikely mentors

    At school I became the one people came to with computer questions, so I had to make sure I actually knew the answers. A friend and I stayed in touch with the two from the game, and over time they became proper mentors. They set us up with VPS servers to practice on and taught us techniques one step at a time.

    The rest I picked up on IRC, forums and through a lot of trial and error. Early on I set myself one rule that I still follow: I don’t touch a system unless I have permission to.

  3. Today

    Doing it for a living

    The curiosity is still there. I’ve become more methodical about it, and I’ve ended up in a job where understanding how systems fail is exactly what’s needed to protect them.

How I work

  • Follow the attack path

    Real attacks rarely depend on one big flaw. They chain small ones together: a reused password, a flat network, an account with more rights than it needs. I look at how those pieces connect, because that’s usually where the actual risk sits.

  • Stay inside the mandate

    Knowing how to get into a system comes with responsibility. Public-sector systems serve citizens and fall under strict rules, so I only ever work within what I’ve been authorized to do.

  • Build for the team you have

    Security that needs a full team and an open budget won’t last in a real IT department. I aim for controls that a busy team can run, monitor and keep up to date on an ordinary Tuesday.

What I do day to day

My work spans security operations, architecture and governance, risk and compliance. In practice it breaks down roughly like this.

  • Monitoring and detection

    Keeping critical systems under watch with SIEM, EDR and XDR, and tuning detections so an alert means something.

  • Secure architecture

    Segmentation, access control and Zero Trust principles, worked into new solutions while they’re still on the drawing board.

  • Risk assessments

    Assessments that end in a decision, kept short enough that people actually read them.

  • Testing defenses

    Checking designs and controls against realistic attack scenarios before they go into production.

  • Advising management

    Explaining technical risk in terms leaders can weigh against cost and put in order of priority.

  • Staying current

    Labs, new tools and research, so my advice reflects how attacks look today and not five years ago.

Happy to talk shop

If you work in security, GRC or architecture, or you’re just curious how this works in the public sector, send me an email. I’m not selling anything.