@techbash.bsky.socialWe're only 16 days away from workshop day at TechBash 2026! We have five workshop tracks to choose from when you register for 4 days. More info at techbash.com
#devconference #techevent #ai #dotnet #kubernetes #webdev #threatmodeling #communication #poconos #kalahari
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Email validator uses a catastrophic regex that pegs CPU on long inputs [RESPONSE] Dev/management: It's only email addresses. That's basically public. #threatmodeling #infosec
@sydseter.comThat’s the correct statement of the rule, and the admission of breach, together with a justification through peer conduct. Social proof, in a log file, from a system with no social life.
Have a great week building your AI agents instructions! 💪🧑💻👩💻😉👍
#AI #agentic #threatmodeling #threatmodelling
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Vendor binary is downloaded at build time with no checksum verification [RESPONSE] Dev/management: MVP. We'll harden it once we have product-market fit. #threatmodeling #infosec
@sydseter.comBurned out development teams and people sleeping during threat modeling sessions.
The realities of doing security is not that pink as we want to portray it, and our tools and processes not that smooth.
#cornucopia #security #awarness #games #threatmodeling #threatmodelling #appsec
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Lambda functions store API tokens as plaintext environment variables [RESPONSE] Dev/management: If we're still around in five years, we'll worry about it. #threatmodeling #infosec
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Session tokens are generated with Math.random() [RESPONSE] Dev/management: Sandra in legal said it's fine. #threatmodeling #infosec
@lunarisdigital.bsky.socialThreat Modeling scheitert selten am ersten Workshop. Entscheidend ist, ob das Modell weiterlebt. TMT vs. Threat Dragon im Praxischeck: lunaris.digital/blog/article... #threatmodeling #cybersecurity
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: UART debug interface is exposed on production hardware [RESPONSE] Dev/management: If hackers can get this LLM API key, they can do way worse anyway. #threatmodeling #infosec
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Login error message reveals whether the email address has an account [RESPONSE] Dev/management: We see the same browser fingerprint, so it's the same user. #threatmodeling #infosec
@bjoerngroenewold.bsky.socialThreat Modeling erst nach Launch? Das kostet Zeit und Geld. Sicherheit muss in der Planung anfangen – mit echten Checklisten nach BSI und OWASP. Praxis statt Theorie für 2026.
#ITSicherheit #ThreatModeling
(KI-generiertes Bild)
@awscmblogposts.bsky.social✍️ New blog post by mgbec
Message To Communicate — Threat Modeling our A2A Workflows
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Application logs include full credit card numbers and CVVs [RESPONSE] Dev/management: GDPR doesn't apply to staging. #threatmodeling #infosec
@sydseter.comTurns out, the polish airlines have misplaced all my luggage and equipment that I brought with me except these decks so now I have this and nothing else. I am becoming a more and more like a courier every day. This won’t go well.
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: All engineers share one service account whose credentials predate the company [RESPONSE] Dev/management: We expire all sessions on a password change. That covers it. #threatmodeling #infosec
@sydseter.comGet your tickets now for Germany OWASP Day: owasp.glueup.com/event/german...
#owasp #security #games #cornucopia #appsec #threatmodeling #threatmodelling
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Lambda functions store API tokens as plaintext environment variables [RESPONSE] Dev/management: No customer has ever asked us about this. #threatmodeling #infosec
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Backups have not been test-restored since the runbook was written [RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk. #threatmodeling #infosec
@sydseter.comCybersecurity awareness training during Cybersecurity Awareness Month is boring as hell.
And research shows it's not working (source: www.cybersecuritydive.com/news/cyberse...); games, on the other hand, do work (source: www.researchgate.net/publication/...)
@cynicalthreatmodel.bsky.social[THREAT] Identified threat: Admin console allows password-only login with no MFA option [RESPONSE] Dev/management: We're moving to zero-trust. That'll fix it. #threatmodeling #infosec