This blog is a brief introduction to a living document/guide I maintain for people who face higher than average cyber security risks. The document brings together practical, tested recommendations designed to help protect individuals who may be targeted by hostile or persistent actors. It covers core security hygiene, secure communication choices, smartphone hardening, advanced Android [ ]
TLDR Israel has been recognised by major international bodies and human-rights organisations as committing genocide. Yet global corporations especially in tech and cybersecurity continue to fund, partner with, or procure from Israeli companies that have direct or indirect ties to the IDF and the machinery of occupation. This is not neutrality; it is [ ]
I’m often asked by students and those thinking about a move into cyber security: How do I break into the field? My answer hasn’t really changed over the years, but I get asked often enough that I figured it’s worth putting into a quick* blog post. I’ll give you a sense of how I think [ ]
Over the past year or so, I ve come across the occasional remark or comment about InfoSec teams and phishing simulations; typically how they re run extremely poorly. Most recently I came across this thread on Twitter and thought I would share my thoughts on phishing simulations and the effectiveness of them; based on my own experiences [ ]
A mouthful of a title but in this blog, I ll try to answer this question based on my own understanding and experiences deploying WebAuthn. Firstly, if you don t know what Web Authentication is (commonly referred to as WebAuthn), it might be worth having a quick read of my previous blog post as the WebAuthn standard [ ]
In this post, I will be going through some of the essential Branch Protection Rules you should have on all* of your GitHub repositories. GitHub is constantly releasing new updates all the time but my recommendations stand as of January 2022. I ve also added some gotchas I ve tripped over discovered whilst deploying such rules across [ ]
Web Authentication, or WebAuthn is a standard for strong user authentication and is a core part of the FIDO2 specification. I m not going to go into too much technical detail about the spec in this blog because there already exists a plethora of awesome documents and demonstrations which explain WebAuthn better than I ever could; [ ]
I want to start by saying that this article is not only for security professionals. If you have the power to influence positive change at your organisation then this article is for you. With that said, let s begin Take a minute to visit your corporate website and look for a security or responsible disclosure page [ ]
I wrote this blog to help organisations better prepare for and run successful bug bounty programs. The blog touches on my personal experiences as a program owner of both good and badly run programs as well as being on the other side of the fence as a bug bounty hunter. This blog ended up being [ ]
Today I am open-sourcing SlackPirate; a tool I developed over the last couple weeks, designed to enumerate and extract sensitive/interesting/confidential data from a Slack Workspace. Red teamers can use this during an assessment to extract sensitive information which can significantly contribute to the discovery/recon/enumeration phase of the assessment by analysing data such as credentials,…