The Secure Engineer

Framing the problem Questionnaires are part of the job.

The first course that I attended at engineering school was on engineering ethics.

Nearly everyone uses Google In SecAtScale’s latest Pulse Survey report, 86.5% of respondents reported using Google Workspace as their email and office apps provider.

SOPS is brilliant.

Whether we like it or not, workstations running Linux are commonplace in organisations.

Do you drive?

In your software company… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Has a C-Suite executive questioned the value of the security team's projects in the…

Paul Krugman’s “Productivity isn’t everything, but, in the long run, it is almost everything” applies to companies well.

Ask a software engineer what comes to mind when they think about security, and chances are they will tell you about SQLIs and web shells.

In the context of web applications… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Which of the following can be considered a security boundary?

Tell us… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Do you share passwords with your loved ones?

Tell us… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: true --- ## A VPN encrypts traffic.

In your password, do you have… --- primary_color: "#77b6ea" secondary_color: lightgray text_color: black shuffle_questions: false show_hint: false shuffle_answers: false --- ## Some kind of date?

This article was originally published on GitGuardian’s blog.

Here’s a story about how one of my personal accounts was hacked and how I handled the incident.

The setting Have you read Team Topologies?

The Manifesto The Manifesto for Modern Cybersecurity is a brilliant bit of text.

I’ve noticed in my career that we, security experts, often lose sight of what our organisations’ are trying to accomplish.

I’m sorry Corporate information security trainings are crap.

What do you do to stay secure?

This article was originally published on GitGuardian’s blog.

Choices While working on automating database security, I had to prioritize the security issues to tackle.

A familiar problem In my career, I’ve seen: a 200 people scale-up scramble to rotate all its secrets because they were hardcoded in their big monorepo an industrial company assemble a taskforce of 3 engineers to find all hardcoded secrets in their 3 Source

Intro In a previous blog post, I had benchmarked a few EDR software vendors & selected the one that suited my organisation best: CarbonBlack.

Introduction When I started out my career, I didn’t give much thought to databases.

Context You’re investigating an incident, a bug, what have you, and you’re dealing with lots of IP addresses.

Introduction Working for SaaS scale-ups, I’ve had my fair share of client security questionnaires to fill out.

My organisation recently migrated all its workstations from Windows boxes to MacOS devices.

ℹ️ Disclaimer: These events happened in 2020.

Context I was recently trying to add a few security oriented dashboards to Kibana.

I use Ubuntu 20.04 on most of my machines.

If you ask the devops team running a SaaS service about the biggest weakness in their current production infrastructure, chances are they’ll tell you “monitoring and logging”.

At home, I run 3 machines as small servers, but I haven’t set up a monitoring system.

As a security engineer, I spend most of my working day in a linux CLI environment.

When applying for an IT engineering job, meeting a few people at the target company and answering some technical questions is standard practice.

Say you’re a blue teamer in an organisation of a few thousand people.

This article was originally published on Polyconseil’s tech blog.