namez @_anzrm

Software Engineering does not need a unified Security Platform. They need Security to stop acting like they are a special case. They need Security to grow up and get with the program.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

This is not to say you should not get a baseline, but it should not be done manually, and your time is better spent training developers to identify poorly designed code.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

Likewise, manually security reviewing the whole code base was for a time when the codebase sat idle for a period long enough to do so. They were probably shipping on 5.25in floppies at that time too.

1 0 0 0 0

View Details

If your developers test each other's code, and this freaks you out, you should look deeper. If there is a formally trained tester on the team, they have simply optimized their time to be most effective.

1 0 0 0 0

View Details

namez @_anzrm

4 years ago

@djjackalope @_pronto_ someone may ask 'Why Valerie Valdes?' ... because cats.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

@djjackalope @_pronto_ My Recommended reading: Cory Doctorow - Attack Surface Kimberly Unger - The Extractionist Corey J. White - Repo Virtual Martha Wells - Murderbot Diaries Valerie Valdes - Chilling Effect

1 1 1 0 0

View Details

namez @_anzrm

4 years ago

Securing APIs may seem complicated because training materials and trainers do not indicate the difference between browser-based attacks and direct attacks. Know your Trust Boundaries first!

0 0 1 0 0

View Details

namez @_anzrm

4 years ago

Well... I think that @SnykSec should just go ahead and buy @BrightAppSec now so we can get on with our lives :D

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

How Pentesting is perceived is a funny thing. Few recognize how it adds value. If you have all kinds of automated tests screaming at you to fix basic things, having a human kick the dead horse is a waste of money.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

Anyone else think the only reason APIs are such a buzz word in AppSec is because: ! No one understands trust boundaries! ... and that 'anyone can be a dog on the Internet' (you cannot depend on a client to be nice, even if it is your own)

0 1 0 0 0

View Details

namez @_anzrm

4 years ago

Trust boundaries are not hard to understand. If you have a REST service, it MUST treat all calls as potentially hostile because anyone who can type can talk HTTP(S), with or without your custom app or even a browser.

0 0 1 0 0

View Details

namez @_anzrm

4 years ago

If I am honest, the EDM crowd in SLC is not what I expected. I did not expect them to be like my raver friends in Lake Oswego from 20 years ago, but... unexpected... we will just say that.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

@LadySqrrl @shehackspurple I agree, Eureka was satisfyingly upbeat. I just recently started watching Stitchers which has some of the same actors and is feeling somewhere in between Eureka and Scorpion

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

@shehackspurple Cyber Mage by Saad Z Hossain was a fun listen too.

0 0 0 0 0

View Details

namez @_anzrm

4 years ago

@shehackspurple I randomly chose to listen to the book Zeroes by Chuck Wendig, the technical aspects are fully accurate and entertaining. They do an excellent job at explaining that there are a lot of different types of hackers, and each one has a role.