PowerDNS-AuthAdmin
A modern, self-hosted DNS administration UI for PowerDNS Authoritative.
Security & compliance
Security and compliance, built on the fundamentals
Most breaches do not need a clever attacker. They need an unpatched server, a reused password or a backup nobody has tested. I focus on the fundamentals that close those doors, and treat compliance as the evidence that they are closed.
The fundamentals that matter
No product replaces these. Get them right and most attacks fail; skip them and no tool will save you.
Know what you have
You cannot protect a server, account or service you do not know exists. Keep one up-to-date inventory and make it the source every other tool trusts.
Patch fast, internet first
Most attacks use flaws that already have a fix. Internet-facing systems are patched in days, not quarters, and someone checks that it happened.
Strong sign-in
MFA on everything that matters, starting with email, remote access and admin accounts. Phishing-resistant methods where possible.
Least privilege
People and systems get the access they need, for as long as they need it. Admin rights are separate, logged and rare.
Hardened, consistent builds
Every server and container starts from a known, hardened baseline, and drift is detected automatically rather than discovered during an incident.
Segment the network
A breach in one place should stay in one place. Separate what does not need to talk, and filter what does.
Secrets out of code
Passwords, keys and tokens live in a vault, rotate, and never appear in a repository, a ticket or a chat.
Backups you have restored
A backup is only real once you have restored from it. Keep a copy attackers cannot reach, and test recovery on a schedule.
Logs someone reads
Collect the logs that answer who did what and when, keep them where an intruder cannot erase them, and alert on what matters.
Encrypt by default
TLS everywhere with certificates that renew themselves, and data encrypted at rest. Expired certificates are outages waiting to happen.
Know your supply chain
Know what third-party code you run, pin versions, keep images minimal and update deliberately rather than blindly.
Plan for the bad day
Decide before an incident who leads, who decides and who talks to customers. Then practise it, because the first hour sets the outcome.
Questions every leader should be able to answer
If the answer to any of these is a pause, that is where to start.
- If we lost our main systems today, could we restore them, and when did we last prove it?
- Who has admin access right now, and does each of them still need it?
- How quickly do we patch an internet-facing system with a known flaw?
- Would we know if someone signed in who should not have?
- Who leads, decides and communicates in the first hour of an incident?
- Which system would hurt most if it failed or leaked, and is it protected accordingly?
What I do
- Security reviews of infrastructure, networks, cloud and Kubernetes, with findings ranked by real risk to the business
- Hardened, consistent builds for Linux, Kubernetes and cloud, measured against CIS Benchmarks
- Identity and access: MFA everywhere, least privilege, no shared admin accounts, short-lived credentials
- Network segmentation, firewalls and VPNs, so one compromised system does not mean all of them
- Secrets management with HashiCorp Vault and OpenBao, keeping credentials out of code and chat
- Logging, monitoring and alerting that someone actually acts on
- Incident response plans and runbooks, and the communication that goes with them
- Compliance programs (Essential Eight, ISO 27001, SOC 2, PCI DSS, NIST CSF, ISM / IRAP, Privacy Act) with evidence produced by the systems themselves
How I approach it
Compliance follows good engineering, not the other way round. When the fundamentals are automated and measured, the evidence an auditor needs is a by-product: a report the systems produce, not a spreadsheet someone fills in the week before the audit.
Security has to fit how people actually work. A control that slows everyone down gets worked around. One built into the platform, the pipeline or the sign-in flow simply becomes the way things are done.
Compliance, in plain terms
Frameworks I have implemented controls for and produced evidence against. Each one asks the same underlying question: can you show the fundamentals are in place and working?
- Essential Eight
- Australia's baseline of eight controls against the most common attacks: patching, MFA, admin privileges, backups, application control and hardening, measured in maturity levels.
- ISO/IEC 27001
- Running security as a managed system: risks identified, controls chosen, owners assigned, and improvement over time.
- SOC 2
- An independent report that shows customers a service provider's security and availability controls actually work, over a period of time.
- CIS Benchmarks
- Detailed hardening baselines for operating systems, Kubernetes and cloud services that can be checked automatically.
- PCI DSS
- The rules for any environment that stores, processes or transmits card payments.
- NIST CSF
- A common language for a security program: govern, identify, protect, detect, respond and recover.
- ISM and IRAP
- The Australian Government's Information Security Manual, and the IRAP assessments that check systems against it.
- Privacy Act and NDB
- What personal information you may hold, how to protect it, and when a breach must be reported under the Notifiable Data Breaches scheme.
Practised here
This site is held to the same standard. Every item below is checked automatically on each deploy.
- HTTPS only, TLS 1.2 and 1.3 with modern ciphers, HSTS, and the domain submitted to the browsers' preload list
- A strict Content-Security-Policy on every page: only this site's own code and Google Analytics can run, and each inline script is pinned by its hash
- No forms, no accounts and no stored personal data, so there is very little to steal
- Security headers that block clickjacking and MIME sniffing, trim the referrer and switch off camera, microphone and location
- DNSSEC-signed DNS, a CAA record that allows one certificate authority only, and email spoofing blocked with SPF, DKIM and DMARC set to reject
- A published security.txt and a disclosure policy (below)
- Every deploy passes an automated gate first, and checks the live headers, redirects, TLS, DNS and email controls afterwards
Reporting a vulnerability
Found a security issue on this site or in one of my open-source projects? Email jad.seifeddine@gmail.com with the details and how to reproduce it. I will acknowledge it promptly, keep you informed while it is fixed, and credit you if you would like. Please do not access other people's data or degrade the service while testing.
Track record
Automated CIS-style hardening, patching and drift control across RHEL and Ubuntu fleets, keeping hosts consistent and compliant.
Macquarie Technology GroupDelivered releases with RBAC and isolated environments, and secrets held in HashiCorp Vault.
Macquarie Technology GroupSecurity hardening and patching across a large Linux fleet, plus firewalls, VLAN segmentation and SD-WAN across multiple data centres.
Next Generation NetworksOwned the firewall and VPN networks that kept the organisation secure and connected.
HoneyBee InternationalBuild model-serving controls, deployment guardrails and tenant isolation into production LLM platforms.
MercorDesigned PowerDNS-AuthAdmin's security model: about 60 granular permissions, SSO with MFA, Argon2id passwords, scoped API tokens and an append-only audit log.
Open source
Related projects
certifi
A self-hosted ACME v2 certificate manager that works for private domains.
FAQ
Questions people ask
Which security and compliance frameworks does Jad Seifeddine work with?
Jad has hands-on experience implementing controls and producing evidence for the Essential Eight, ISO/IEC 27001, SOC 2, CIS Benchmarks, PCI DSS, the NIST Cybersecurity Framework, the Australian Government ISM (including IRAP assessments) and the Privacy Act's Notifiable Data Breaches scheme.
What are the most important security fundamentals for a business?
In Jad's experience most breaches exploit the basics. The fundamentals that matter most are knowing what you have, patching internet-facing systems quickly, MFA everywhere, least privilege, hardened builds, network segmentation, secrets kept in a vault, backups that have been restored, logs someone reads, and an incident plan that has been practised.
How does Jad Seifeddine approach compliance?
Jad treats compliance as the outcome of good engineering. The fundamentals are automated and measured, so the evidence auditors need for frameworks such as the Essential Eight, ISO 27001 or SOC 2 is produced by the systems themselves rather than assembled by hand before an audit.
Have a hard infrastructure problem?
Open to select consulting, contract and advisory work. Tell me what you are building and where it hurts.