Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
IETF
Dry-Run DNSSEC Tests a Resolver Cohort, Not the Internet
A zone is signed, a validator finds the signature wrong, and the user still gets an answer. That apparent contradiction is the point of dry-run DNSSEC. Failure is exposed to an operator without yet becoming failure for the ordinary client. The rehearsal can reveal a broken…
Europe and Middle East Institutional Trends
ENISA confirms manual CRA reporting at launch
ENISA's CRA platform launches without an API, so manufacturers must submit mandatory cyber reports through its interface from 11 September.
History
Both Networks Were Correct Until They Met: RFC 1918 and the Price of Local Uniqueness
At 09:00, two enterprise networks can each be orderly. Each has one machine at the same private address, one route toward it and one name that resolves correctly. At 09:01, an interconnection comes up. Nothing inside either machine has changed, yet the address can no longer…
IETF
A CDN must carry a loop warning it cannot authenticate
A cooperative defence can depend on preserving information that remains untrusted. CDN-Loop exposes the division between a customer's configuration freedom, a provider's protective decision and the evidence needed to explain a failed request.
Creators
Roy Arends and the hard work of changing DNS safely
Roy Arends helped write the 2005 specifications that made modern DNSSEC interoperable across implementations. Two decades later, his work at ICANN focuses on a harder operational problem: changing keys, error signals and delegation in a global system that no organisation can…
IETF
DNSSEC Recovery Runs on Clocks No Signer Controls Alone
The private key is unusable. The zone is still answering, and yesterday’s signatures still validate. That is not recovery; it is borrowed time. A new DNSOP draft explains how to use that interval without destroying the trust that remains. Its harder lesson is institutional: the…
CASE FILE
A DNS Failure Drew 51 Queries. The Cause Was Still Unresolved
APNIC Labs sent several kinds of “no” from an experimental authoritative DNS service. Definitive negatives drew roughly four queries per test. `SERVFAIL` drew 51.73 and silence 83.46. Those are measurements of received traffic—not a verdict on which resolver layer multiplied it.
IETF
A captive portal needs an expiry date for its idea of a device
An address can legitimately pass from one terminal to another. The access system has to retire the old association, not merely recognize the address again. That small distinction connects network admission, accounting and privacy.
North America Cloud Services Trends
Zscaler gives its smaller-business push a channel route
Its Carahsoft expansion pairs standard bundles with repeatable deployment work. Dedicated enterprise sellers show where that model stops.
IETF
A Self-Signed Delegation Update Proves a Key, Not Its Authority
A DNS message can prove that its sender holds a private key and still leave the decisive question unanswered: who entitled that key to alter a child’s delegation? A DNSOP proposal for rapid child-to-parent updates makes that distinction explicit. Its lasting value will depend on…
CASE FILE
The Purge Was Accepted. The Downstream CDN Still Said No
Revision 20 of an IETF working-group draft follows a cache-control request past the reassuring `201 Created` response. In a CDN cascade, a later rejection has to return as data inside another provider’s status resource—and the provider that refused may remain unnamed.
IETF
A firewall’s speed belongs to a particular configuration
Two reports can describe the same appliance without showing that its protection and performance were achieved together. The missing connection is often the configuration between the tests.
Creators
Roy Arends and the hard work of changing the DNS safely
Roy Arends helped write the 2005 specifications that made modern DNSSEC interoperable. Two decades later, his work at ICANN centres on a harder operational problem: changing keys, error signals and delegations across a global system that no institution can update by command.
ICANN
ICANN’s UA Guidelines Give AI Two Jobs. One Metric Cannot Measure Both
An AI assistant can suggest a better email validator. An AI-powered service can also reject the very address that validator was meant to admit. Those are opposite positions in the same control loop. ICANN’s Universal Acceptance working group now says its final guidance was…
CASE FILE
A Registry-Lock Quorum Counts Approvals, Not Independent Authority
Two approval messages can look like two-person control while both are recoverable through the same compromised mailbox. A proposed EPP registry-lock extension can count authorising contacts; the harder task is proving that the authorities behind those contacts were genuinely…
CASE FILE
The ICMP Error Named a Node. It Did Not Prove Which One
Revision 05 of an IETF draft makes node context harder to omit when an ICMP source address cannot do the diagnostic job alone. It also exposes a less comfortable truth: a more informative error can carry less of the packet that triggered it, and neither piece is authenticated.
History
The Broadcast Packet That Carried Its Own Guest List
One UDP datagram approached a remote subnet as a broadcast, yet it carried a private instruction inside its IPv4 header: these hosts may listen; the others must stop. Selective Directed Broadcast Mode tried to make the packet itself serve as a temporary membership list.
CASE FILE
Every Outer Bundle Was Delivered. The Inner Bundle Still Had Not Been Received
Bundle-in-Bundle Encapsulation gives a delay-tolerant network two journeys to observe. The outer bundles can reach their configured endpoint one by one, each with a valid delivery report, while the bundle carried inside them never reaches the Bundle Protocol Agent. The new DTN…
CASE FILE
The Firewall Matched the Return Flow. The Source Still Was Not an Identity
A new SPRING working-group draft proposes a neat repair for a stubborn SRv6 middlebox problem: put the service SID in the outer source address so the two directions form the pair a stateful firewall expects. The packet may then pass. What the address proves, however, has changed.…
CASE FILE
The Algorithm Name Matched. The Hash Receipt Did Not: RFC 9861
KangarooTwelve and TurboSHAKE give operators fast, extendable cryptographic output, but the label on a library call is only the beginning of the evidence. Reproduction depends on the exact function, byte stream, domain or customization input, output length and execution path that…