Recent content on The Secure Engineer
Framing the problem Questionnaires are part of the job. They’re part of how our industry works. Organisations need to make sure that their vendors are trustworthy enough to do business with, and questionnaires are the industry agreed-upon way to do so, alongside compliance frameworks obviously. The problem is that questionnaires are often too generic. Customising questionnaires for each…
The first course that I attended at engineering school was on engineering ethics. Ten whole hours on this topic, with a retired nuclear engineer. As a 20 year old, I did not fully grasp the importance of the topic, and frankly I did not pay much attention to what was being said. One idea stuck though: we, engineers, have an ethical responsibility towards our users, coworkers, organisations and…
Nearly everyone uses Google In SecAtScale ’s latest Pulse Survey report , 86.5% of respondents reported using Google Workspace as their email and office apps provider. And 34.1% of respondents reported using Google Workspace as an identity provider. It’s understandable. Google Workspace (abbreviated as GWS from now on) has great pricing and features. Starting at 6.80€/u/mo , you get…
SOPS is brilliant. The first commit was made on August 14th 2015, by Julien Vehent, who was working at Mozilla then. It quickly gained popularity thanks to its simplicity and ease of use, and it’s still going strong 10 years later. Why it’s great SOPS builds on top of third-party key management systems such as AWS KMS or Google Cloud KMS to encrypt & decrypt data keys, that are…
Whether we like it or not, workstations running Linux are commonplace in organisations. We all have stories of an engineer who is allowed to use an unmanaged Linux machine, or a team whose work cannot be done using the organisation’s usual computers. Whatever the reason, Linux workstations are not likely to vanish from our businesses any time soon. But they still pose a risk to the…
Do you drive? How many cars have you sent to the scrapyard because of a crash? I’m willing to bet you’ve never crashed a car. And if you have, well you’re still here to talk about it, so it probably wasn’t too serious. You’re probably a reasonably careful driver. Chances are you don’t need car insurance. Imagine the money you’d save by skipping on car…
In your software company… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Has a C-Suite executive questioned the value of the security team's projects in the last 3 months? 1. [ ] Yes 1. [x] No ## Has the CEO criticised the security team for not bringing in enough customers or helping with…
Paul Krugman’s “Productivity isn’t everything, but, in the long run, it is almost everything” applies to companies well. Companies seek efficiency and productivity. No organisation wants to spend more money or effort than it absolutely has to. That of course applies to companies’ security function. Security must be provably efficient. In Corporateland, KPIs reign…
Ask a software engineer what comes to mind when they think about security, and chances are they will tell you about SQLIs and web shells. Security is a circus, and we all want to see the attractions. — Stefano Zanero While these topics are definitely exciting and fun to find and think about, the reality of building secure systems goes beyond the shiny realm of ; DROP TABLE users; . For systems to…
In the context of web applications… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Which of the following can be considered a security boundary? Check all that apply. - [ ] Rate limiting - [x] Network-level separation between datastore assets and application runtime assets - [x] Segregation…
Tell us… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: true --- ## A VPN encrypts traffic. But on what parts of the journey? Check all that apply. - [x] On the local WiFi network - [ ] Between your ISP and your Internet Service Provider - [x] Between your local network and the VPN exit node - [ ] Between…
Tell us… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Do you share passwords with your loved ones? > Your family members can make mistakes too! 1. [ ] Yes 1. [x] No ## Do you reuse passwords across multiple sites? > Using different passwords for each service limits the blast radius in case a…
In your password, do you have… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Some kind of date? eg. 1982, 2002-12-30, 19/07 etc. 1. [ ] Yes 1. [x] No ## A first or last name? Could be a family member or a famous person 1. [ ] Yes 1. [x] No ## A place name? Could be a city, country, street,…
This article was originally published on GitGuardian’s blog . It’s been now 2 years since I started working for the Owl, and my goal has not changed since: provide the best security guardrails that allow for maximum velocity. Over the past 12 months, we’ve had plenty of challenges, and successes too! Today I’ll be sharing with you the highlights of our year. The elephant is still in the room…
Here’s a story about how one of my personal accounts was hacked and how I handled the incident. What happened? On the morning of May 10th 2024, I received an email from Microsoft. I thought this was very odd, because I don’t really use Microsoft services. At first I suspected a phishing attempt. I checked the sender’s email address, the links included in the email, the…
The setting Have you read Team Topologies ? Continuous Delivery ? You haven’t? Well, stop everything you’re doing right now, go get these two books, read them (you can thank me later), and then come back. One of the key concepts in Team Topologies is the flow of change. Let’s call it flow. In a software production organisation that practices continuous delivery , flow is the…
The Manifesto The Manifesto for Modern Cybersecurity is a brilliant bit of text. We believe modern cybersecurity, especially for digital companies with cloud-native operations, requires a different mindset and operating model such that: Assume compromise, but expose no single point of compromise. Track everything since you cannot protect what you can’t see. Engage everyone for there is power in…
I’ve noticed in my career that we, security experts, often lose sight of what our organisations’ are trying to accomplish. Compliance heads will get entirely absorbed in controls, frameworks and audits, sending out proof requests faster than any team could handle. Tech heads would get tied up in knots whenever they saw an 8.2 CVSS vulnerability or 0.5%of their SIEM logs being dropped.…
I’m sorry Corporate information security trainings are crap. They are . If you’ve never endured that dull pixelated video where a voice actor coming right out of Dora The Explorer condescendingly tells you to check the link before clicking, congratulations to you. May we all be so lucky. Analysing the mediocrity Let’s put weekly fake phishing campaigns aside for a second.…
What do you do to stay secure? What tools do you use to stay safe online? Everytime I run a security training session, I get asked this sort of question. I try to provide a short answer tailored to the organisational context, the person’s needs, and understanding of IT. To me though, staying secure online means owning my data. Fair warning, I’ll be using the word “data”…
This article was originally published on GitGuardian’s blog . I joined GitGuardian in July 2022, one year ago. Since then, I’ve worked hard on improving existing security processes & building defense mechanisms. Now is a good time to reflect on GitGuardian’s security team’s achievements and failures over the past year. I hope this post can shed some light on how our team does things and help…
Choices While working on automating database security , I had to prioritize the security issues to tackle. Controlling user & app access was a priority, but fine-grained RBAC was not. Yet, the databases I was working on had plenty of juicy PII and sensitive information. So I had to find a solution. Community effort Terraform is a brilliant tool that I try to use whenever possible. I used it to…
A familiar problem In my career, I’ve seen: a 200 people scale-up scramble to rotate all its secrets because they were hardcoded in their big monorepo an industrial company assemble a taskforce of 3 engineers to find all hardcoded secrets in their 3 Source Code Management systems, and establish an action plan to fix the situation. a development shop scurry 2 senior engineers to encrypt…
Intro In a previous blog post , I had benchmarked a few EDR software vendors & selected the one that suited my organisation best: CarbonBlack . With the contractual details sorted out, it was time to deploy the agent to my organisation’s fleet of workstation. Had I wanted to deploy CarbonBlack with the Jamf MDM , it would have taken me a few hours of reading the fancy manuals to set…
Introduction When I started out my career, I didn’t give much thought to databases. To my junior eyes, big security problems were in the webservers, the code, not really in the database. Now, imagine you’re a young startup. You want to go fishing for clients and hire a few developers. They grab a DB engine, sprinkle code on top, and voilà , you’ve landed a customer. They’ve…
Context You’re investigating an incident, a bug, what have you, and you’re dealing with lots of IP addresses. You’d like a way to find out where is that IP address from so you can get a rough idea of who’s who. A whole host of websites allow you to geolocate IP addresses ( iplocation.net for instance). But that’s not fast enough, and probably won’t scale if you…
Introduction Working for SaaS scale-ups, I’ve had my fair share of client security questionnaires to fill out. Every single one of these questionnaires included a question similar to: Do your employees/admins use MFA? If I answer “no”, all hell breaks loose the client gets uneasy and starts asking all sorts of questions. If I answer “yes”, I get a satisfied,…
My organisation recently migrated all its workstations from Windows boxes to MacOS devices. The Windows fleet was equipped with a remotely managed anti-virus software. We needed to maintain a similar level of protection, so I had to select the security agent that would be deployed on the new Mac fleet. I spent a few days testing security software for Mac, and I’ll be sharing with your my…
ℹ️ Disclaimer: These events happened in 2020. All names, dates, company names and technical details have been changed. Some events have been omitted for clarity. Today, I’ll tell you all about a security “incident” that I had to deal with a while ago at work. On a random September afternoon, Daniel, a colleague, rings me up. He tells me that a privileged user account on our B2B…
Context I was recently trying to add a few security oriented dashboards to Kibana. I was fortunate enough to find the dashboards online in JSON form, so all I needed to do was feed them into Kibana, and be done with it, right? Difficulties Well, no, not quite. The ELK stack I was working with had logs from a production environment and a staging environment, and I needed a set of dashboards for…
I use Ubuntu 20.04 on most of my machines. It ships Gnome by default, and I’m pretty used to it. However, the default backgrounds in Ubuntu 20.04 are quite boring to say the least. I tried finding an app that automatically changes backgrounds for me, but most seemed bloated, and had to run constantly in the background, consuming resources. So I did it with a cronjob, using a locally stored…
If you ask the devops team running a SaaS service about the biggest weakness in their current production infrastructure, chances are they’ll tell you “monitoring and logging”. When the pressure to deliver is high on a devops team, as with any team, projects that do not directly contribute to serving stakeholders are put on hold, ergo the previous answer. That means that the…
At home, I run 3 machines as small servers, but I haven’t set up a monitoring system. Honestly, I probably never will. So I did the next best thing: a nice MOTD. Inspiration A friend who’s also an IT engineer showed me this reddit post , and the associated Github repo . These two articles were also quite useful ownyourbits.com article and linuxconfig.org . Scripts RAM usage 1 2 3 4 5 6…
As a security engineer, I spend most of my working day in a linux CLI environment. So I’d like to have the fastest & least resource hogging tool for the job. I did some research, and found two interesting takes on the issue, one on lwn.net and one on danluu.com . After reading that, I decided to try out xterm, so I ran xterm . As you could see, there’s a slight size and color issue. I…
When applying for an IT engineering job, meeting a few people at the target company and answering some technical questions is standard practice. Things get a bit more interesting when you have to present a security roadmap to all the company’s technical leads. A few months ago, I applied to a security engineering role at a French scale-up, let’s call it ACME. I went through the first…
Say you’re a blue teamer in an organisation of a few thousand people. Unless you’re in a kubernetized , SaaSified and cloudified startup, you’re likely to have an Active Directory running. An AD and its accounts are a prime target for attackers, so how do you go about insuring your assets are a bit safer? Eliminating weak passwords is a start. AD accounts are a target Context In…
This article was originally published on Polyconseil’s tech blog . As we migrate our IT systems to the AWS cloud, it is imperative for us to be able to monitor their health and security. AWS does provide a range of tools for logging, however they feel fragmented and balky at times. Looking through logs in the dedicated AWS services was awkward at best, frustrating at worst, and definitely…
Whoami I’m a security & data privacy enthusiast specialising in building security for tech startups. How to contact me Feel free to reach out through LinkedIn . Cookies There aren’t any! Licensing The contents of this blog are licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License , unless stated otherwise. If you’d like to use the works published…