What we cover at RedRock Inc
RedRock Inc is a technical blog, not a consultancy. I'm Steven Garcia, and the site publishes open content — articles, guides and reviews — across three defined areas. Here you'll find a breakdown of what we cover, what we don't, and how our content can (and cannot) help you.
Security architecture analysis
Who it's for: DevSecOps teams, software architects and security engineers working on financial systems — whether at a fintech, an Australian bank or the Australian Securities Exchange (ASX). The content assumes a working knowledge of networks, Linux and TLS protocols.
Who it's not for: anyone without a technical background who is after a general-manager-level explanation. We don't write "5 tips to secure your data" — we write about mTLS certificate rotation in an Istio service mesh.
What you'll get: in-depth articles (2000-3000 words) with code examples, architecture diagrams and references to standards such as the NIST CSF and OWASP. Every article states the standard it is built on, so you can check it yourself.
What you won't get: a commercial pentest service, automated vulnerability scanning or a ready-made compliance report. If you need a formal security assessment of your organisation, you'll need to engage an accredited consultancy — we don't provide that service.
How the work happens: I choose a topic, research it in depth (reading RFCs and standards, and running experiments in a lab environment), write a draft, then go back over it with a technical accuracy check. Average time from idea to publication: two weeks to a month.
Cost: all content is open and free. No premium subscription, no paywall, no sponsored content.
Trading infrastructure reviews
Who it's for: backend engineers working on trading or clearing systems, researchers of critical infrastructure, and software engineering students interested in real-time systems architecture.
Who it's not for: traders looking for trading strategies, analysts looking for share recommendations, or anyone interested in "how to make money from the ASX". We look at exchanges as software systems — not as investment platforms.
What you'll get: technical reviews of trading platforms (Eurex T7, CME iLink, Nasdaq INET), protocol analyses (FIX, FAST, SBE) and explanations of matching engine, order book management and clearing architectures. All reviews are based on public documentation.
What you won't get: access to an exchange's internal documentation, information that hasn't been published officially, or anything that resembles industrial espionage. We work only with information that is publicly available.
How the work happens: reading the technical specifications the exchanges publish themselves, comparing platforms and, sometimes, building a proof of concept in a local environment to understand how a protocol actually behaves rather than how it behaves on paper.
Cost: free, like everything else on the blog.
Practical cryptography guides
Who it's for: developers who need to embed encryption in their product, architects planning PKI, and infrastructure managers who need to understand the difference between an HSM, a KMS and Vault. The content suits anyone who already knows what AES and RSA are but isn't sure how to choose a cipher suite or manage key rotation.
Who it's not for: anyone looking for "encryption in one click" or magic solutions. Correct cryptography needs understanding, and we don't try to shortcut that. If you need encryption and no one on your team understands it, hire a cryptography consultant rather than relying on a guide you found online.
What you'll get: practical guides with code — choosing cipher suites, implementing TLS 1.3, key management with HashiCorp Vault, working with HSMs (physical and cloud), and explanations of FIPS 140-3 and PCI DSS in the context of cryptography.
What you won't get: a security review of your specific implementation, a penetration test of your PKI, or a sign-off that your encryption is "safe". No guide can replace a specific test of your own system.
How the work happens: I build a test environment (usually Docker + Vault + OpenSSL), try the implementation, document the steps, then write the guide. Every code sample is checked to confirm it runs.
Cost: free. The code is available, the explanations are open.
What RedRock Inc does not do — under any circumstances
- Not investment advice, not share analysis, not buy or sell recommendations — neither directly nor indirectly
- Not pentest services, vulnerability scanning or red team engagements
- Not compliance audits, and not preparation for SOC 2, ISO 27001 or PCI DSS
- Not incident response — if you are in the middle of a security incident, contact a professional IR team
- Not selling products, tools or software licences
- Not structured courses, workshops or corporate training
- Not sponsored content, sponsors or affiliate links