namez @_anzrm

hacker/maker lifestyle - I love knowing how things work, although I usually take a non-destructive approach. MTAMO Joined August 2022

Tweets

31
Followers

10
Following

43
Likes

34

namez @_anzrm

a year ago

I got the word; I will be in Orlando in November... Looking forward to rain and tech ppl! ...will drop the link when the schedule goes up...

0 0 0 8 0

namez @_anzrm

3 years ago

Software Engineering does not need a unified Security Platform. They need Security to stop acting like they are a special case. They need Security to grow up and get with the program.

0 0 0 0 0

namez @_anzrm

3 years ago

Securing APIs may seem complicated because training materials and trainers do not indicate the difference between browser-based attacks and direct attacks. Know your Trust Boundaries first!

0 0 1 0 0

namez @_anzrm

3 years ago

Well... I think that @snyksec should just go ahead and buy @BrightAppSec now so we can get on with our lives :D

0 0 0 0 0

How Pentesting is perceived is a funny thing. Few recognize how it adds value. If you have all kinds of automated tests screaming at you to fix basic things, having a human kick the dead horse is a waste of money.

0 0 0 0 0

namez @_anzrm

3 years ago

Anyone else think the only reason APIs are such a buzz word in AppSec is because: ! No one understands trust boundaries! ... and that 'anyone can be a dog on the Internet' (you cannot depend on a client to be nice, even if it is your own)

0 1 0 0 0

namez @_anzrm

3 years ago

Trust boundaries are not hard to understand. If you have a REST service, it MUST treat all calls as potentially hostile because anyone who can type can talk HTTP(S), with or without your custom app or even a browser.

0 0 1 0 0

namez @_anzrm

3 years ago

If I am honest, the EDM crowd in SLC is not what I expected. I did not expect them to be like my raver friends in Lake Oswego from 20 years ago, but... unexpected... we will just say that.

0 0 0 0 0

namez @_anzrm

3 years ago

Job sites like @LinkedIn are missing out if they do not recognize "Application Security Engineer" or "Development Security Engineer" or "Software Engineer in Security" or "Secure Software Engineer"

0 0 1 0 0

namez @_anzrm

3 years ago

Does your C Suite think the AppSec team is DOING the security instead of them being Assurance and Governance? Has anyone tried renaming the department "Application Security Assurance and Governance"?

0 0 0 0 0

namez @_anzrm

3 years ago

I imagine an LPA cycle grunts out Level 2 Finish, just sayin'

0 0 0 0 0

namez @_anzrm

3 years ago

...now if only I could make beer from Internet hops...

0 0 1 0 0

namez @_anzrm

3 years ago

hey @owasp for the new API Top 10: my biggest concern is that people think there is an enormous difference in security exposure between a Web API and a Web Page. Data is all. ATEOTD it is all HTTP. ! Trust Boundaries are more important than interface method.