Sparc Flow @sparcFlow

H4cker, author of How to Hack Like a Pornstar https://t.co/VvRLVM6MUB & How to Hack Like a Ghost https://t.co/DXpFnQ3rYR https://t.co/IrQjsNwxGV sparcflow.com Joined February 2017

Tweets

406
Followers

3K
Following

112
Likes

574

Sparc Flow @sparcFlow

8 hours ago

In security, doing the work is hard. Proving you did the work to a skeptical auditor/regulator ? 100x harder. That’s why compliance devolves into checkboxes and process theater.

evan j @ejcx_

11 hours ago

In security, doing the work is hard. Proving you did the work to a skeptical auditor/regulator ? 100x harder. That’s why compliance devolves into checkboxes and process theater.

1 0 2 473 0

0 0 0 131 0

In a world of ever-smarter AI models, I don’t get MCPs. Why build & maintain two APIs when the model can read the docs and call the one you already have? The future belongs to smarter models, not more plumbing.

1 0 3 139 0

Tetsuo @tetsuoai

2 days ago

C makes it easy to shoot yourself in the foot. assembly makes it hard to miss.

36 85 1K 171K 344

Download Video

Sparc Flow @sparcFlow

2 days ago

AWS tip: Use VPC Endpoints (vpce). ✅ Restrict IAM policies to your endpoint ✅ Spot attempts coming from outside your infra ✅ Save $$ on egress traffic Protection + detection + cost reduction.

0 0 2 118 0

Sparc Flow @sparcFlow

3 days ago

Cybersecurity isn’t just about walls, it’s about funnels. Good hardening doesn’t block everything, it forces attackers down a path you control. That path should be full of traps.

1 3 6 376 1

Sparc Flow @sparcFlow

a week ago

Replace CEO with CISO and CFO/Marketing with Compliance and it would be perfectly true for Cybersecurity as well….or any field for that matter. Can’t lead and consistently build decent strategies without care and expertise.

DHH @dhh

a week ago

224 537 6K 339K 1K

0 0 5 366 1

Nathan McNulty @NathanMcNulty

a week ago

Insane because Microsoft uses a tool like dnstwist to find lookalike domains in Defender for Office 365... but you have to pay for it The good news is this tool is FREE, so everyone can and should monitor for lookalike domains: dnstwist.it github.com/elceef/dnstwist

7h3h4ckv157 @7h3h4ckv157

a week ago

199 829 10K 864K 1K

Download Image

4 104 523 41K 539

Download Image

Sparc Flow @sparcFlow

a week ago

The most powerful security principle i know : defense in depth. i.e, at least two or more security layers on any threat path. * Password + MFA for employees * Bearer/Oauth Token + IP whitelisting * WAF + Static code analysis + rootless prod environment * VPN + app authentication…

1 0 7 346 2

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 435K 1K

Sparc Flow @sparcFlow

2 weeks ago

Let’s talk about npm and package registries. How do you deal with infected dependencies ? * L1: dependabot/renovatebot to wait 7 days before pulling a release * L2: disable lifecycle scripts if possible * L3: CI running in a tight env with egress filtering, auditd/falco, job…

0 0 2 179 0

Sparc Flow @sparcFlow

2 weeks ago

SOC should spend more time on detection engineering and siem tuning than on treating alerts. Yet somehow we normalized an army of juniors treating noise 24/7 and then wonder why they missed that one signal that one time

0 0 6 307 0

Sparc Flow @sparcFlow

2 weeks ago

Biggest snake oil business in Cybersecurity : training and awareness. * You learn nothing new (people click on links, duh). * Proposed countermeasure do not work (can’t learn digital forensics in 2h a year). * Mandated by many regulations so nobody questions it anymore And the…

0 0 7 246 0

Sparc Flow @sparcFlow

2 weeks ago

Passkey/webauthn truly work as a mitigation against credential phishing only when 100% enforced with no alternatives. Can’t work at scale in customer oriented saas because of the obvious UX issues. But in an enterprise environment ? There is no excuse not to enforce it…

0 0 6 257 0

Sparc Flow @sparcFlow

3 weeks ago

Almost every Cybersec budget disagreement is, at its core, a Risk appetite or Risk perception disagreement. And that’s okay. Go where your perception is aligned with that of the execs.