Security Infrastructure↗
Secrets, PKI, and Advanced Data Protection
Vault and OpenBao protect operational secrets. PKI establishes machine identity. Vectis protects sensitive application data. These are related problems, but they require different boundaries and controls.
I help teams design, implement, and operate the infrastructure around them:
- Secrets management: Vault OSS, Vault Enterprise, and OpenBao architecture; HA/DR, storage, auto-unseal, authentication methods, policies, dynamic secrets, upgrades, and migrations.
- PKI: certificate authority design, issuance, rotation, revocation, and lifecycle automation with CFSSL, OpenSSL, and related tooling.
- Advanced data protection: Vectis architecture and integration for encryption, tokenization, masking, protected search, integrity, and digital signatures.
- Cryptographic architecture: algorithm and library selection, randomness, key derivation, key rotation, and protocol boundary review.
- SDLC integration: short-lived credentials, policy as code, and removal of static secrets from repositories and pipelines.
- Threat-model review: assets, trust boundaries, assumptions, failure modes, and residual risks.
- Operational support: implementation, upgrades, documentation, and support defined within the scope of the engagement.
A migration from Vault to OpenBao can make sense when licensing, governance, or an open-source strategy justifies it. It is not a default answer. The right design depends on what the system must protect, who operates it, and how it is expected to fail.
A review reduces uncertainty. It does not guarantee security or compliance.
Operational Simplicity - Kanso↗
Kanso makes operational friction visible and gives teams a way to measure its cost. The work begins with evidence and a defined system boundary, not a promise of savings.
- Training on friction detection, classification, and quantification.
- Setup of the Friction Ledger for the system in scope.
- Facilitation of the first Friction RCA.
- A baseline Kanso Index using a consistent team, system, period, and cost basis.
- Periodic reviews adapted to the Lite, Core, or Full implementation level.
The result is a working measurement process and a set of countermeasures the team can evaluate over time.
Open Source Consulting↗
I help teams evaluate where open-source tooling can reduce licensing costs without replacing them with greater operational risk.
- Assessment of the current stack to identify licensing costs that could be reduced or removed with an open-source alternative.
- Migration planning and execution, including Vault-to-OpenBao migrations and comparable migrations elsewhere in the stack.
- Network and host-level controls with pf or iptables when their capabilities match the operational requirements.
- Evaluation of a candidate open-source project for maturity, maintenance activity, and license terms before adoption.
- Support and operational hardening once a tool is adopted — community software still needs someone accountable for it in production.
The goal isn’t open source as a default position — it’s matching the license, support, and control trade-offs to the constraints you actually have. Sometimes the right recommendation is to keep paying for what you have.
Workflow↗
problem -> conversation -> scoped proposal -> delivery -> handoff- You describe the problem, its context, and the constraints around it.
- A short conversation establishes whether the work is a good fit.
- A scoped proposal defines deliverables, assumptions, boundaries, and limits.
- The engagement produces a review, plan, integration, or operational baseline.
- The handoff records decisions, documentation, and residual risks.
Contact↗
A message is enough: liesware@protonmail.com
Most engagements start from a symptom, not a clean specification.
Disclaimer↗
Vectis and Kanso are open source, and that will not change. What I offer commercially is time, judgment, implementation work, and support within an agreed scope.