CISO at @sardineai. Treasurer of @OWASP Board of Directors. (he/him) qatta' mIghtaHghach.
Phoenix, AZ
Joined July 2009
- Tweets 8,305
- Following 139
- Followers 776
- Likes 17,402
Free @owasp education: "Hacking APIs for Beginners" taught by @InsiderPhD
Register here (free):
lightning.owasp.org/schedule…
3
3
The irony is PCI requires devs be trained annually regarding secure coding.
There is NO requirement to train them on “PCI”.
2
1
2
I agree. If the policies, processes, and tooling make compliance invisible, there isn't much to say other than follow/use/audit the policies, processes, and tooling to remain PCI compliant.
1
1
5
I think it's a symptom of how people find their way into the industry. I wouldn't want OWASP to become a gatekeeping signal, but do encourage those who don't know about OWASP to join their local chapter -- it's free! And global!
owasp.org/chapters/
1
1
Haven’t tried it, but we were looking at @HelloLanding
hellolanding.com
1
Me: When are you coming home? The kids and I miss you.
Wife: I’m doing a writing retreat.
Me: But you hate writing. And it’s been 2 months.
Wife: I love it now.
1
I taught my kids that they have the right to say “no” to anyone, including me.
The authoritative style of parenting demands obedience, and it sets kids (especially girls) up for abuse by those in authority.
I wonder if it’s also true for GPA? Do students with the highest GPA not do as well psychologically and ethically?
1
1
Easy enough to fix. I present to you the OWASP Top One:
1. All the vulns in the universe — past, present, and future.
Protect against that and don’t let me down.
2
4
If you're building IoT, IIoT, ICS devices, this @ABAesq talk about insurance looks interesting.
They're covering Cyber, General Liability, Product Liability, Tech E&O, Property, Crime, and D&O policies.
americanbar.org/events-cle/m…
1
4. Websites that ask/require users for credentials to other websites, such as to import financial information, to allow a potential employer to dig through your social media account, and similar.
Do you really trust that website with your banking password?
1
1
This next one is not really something the Security team pushes onto users in so much as it is something the product team wants and Security often loses the fight to prevent it. So calling it out, because it's super dumb and we should stop allowing it.
1