Devsecurely

Our sole purpose is to make security concepts accessible for all developers | We taught 320+ developers how to secure their applications.

[Devsecurely @devsecurely]

You need to realize that hackers don't see websites the way others do - a thread

Here's what an ordinary person sees when they subscribe to a charity. They only see the user interface and are restricted by it:

[Devsecurely @devsecurely]

@EiiKwesiKay Look at this masterpiece:

https://t.co/ssnQ3xSkhV

[Imed Bounab @imaibou]

A Fortune 500 company. A 6-figure security budget.

Vs. a 14-year-old and one leaked API key.

🎬 API: The Big Leak

[Devsecurely @devsecurely]

@imaibou The scene where everyone celebrated a pull request merge. That happens in our office all the time!

[Devsecurely @devsecurely]

@imaibou When I realized the importance of skills, it became easy to improve all aspects of my life.

I was able to just identify the skill I was missing to achieve a certain goal.

Then it became a matter of finding the right learning material, reading it and practicing.

Easy peasy.

[Devsecurely @devsecurely]

@imaibou Fascinating origin story!

[Devsecurely @devsecurely]

@imaibou I can't agree more on the "simplifying tech concepts" part.

If you build incredibly complex solutions, but you can't explain them clearly to your superiors, then it's like it never happened.

[Devsecurely @devsecurely]

@imaibou I can't even begin to count how many websites I compromised because of these silly passwords

[Devsecurely @devsecurely]

Don't give them much to attack in the first place!

[Imed Bounab @imaibou]

In your opinion, which goal is easier to score against?

The big one on the left obviously!!

The most efficient way to protect your IT infrastructure is to reduce the attack surface.

If you don't need to expose a service on the internet, don't expose it.

[Devsecurely @devsecurely]

@imaibou The discipline part hits hard.

Sometimes you get tired of a particular project and don't feel motivated to continue.

You need to learn to keep pushing until you reach the finish line.

[Devsecurely @devsecurely]

@imaibou Let's connect!

[Devsecurely @devsecurely]

@imaibou Never trust user input

[Devsecurely @devsecurely]

Restrict the attack surface to reduce the risk of getting hacked !

[Imed Bounab @imaibou]

Don't leave the door to your safe open.

You should restrict access to admin interfaces. Yes, even when they require login.

You shouldn't give hackers the opportunity to try and guess the correct credentials.

Only allow the admin's IP address to access the service

[Devsecurely @devsecurely]

@imaibou With great power comes great responsibility

[Devsecurely @devsecurely]

Exactly! Why would you not do it?

It's easy, free, and has a lot of advantages.

[Imed Bounab @imaibou]

It's a very bad idea to not have HTTPS.

Hackers can:
- See what your users do on your website
- Steal your users' cookies and passwords
- Change the website content and replace it with scams

Also, modern browsers will not open your website and will show a big warning instead

[Devsecurely @devsecurely]

This must be one of the rare cases where getting hacked was a good thing 😅

[Imed Bounab @imaibou]

My website got HACKED back in 2011.

I lost all my users and all that work was for nothing.

I then started to learn everything I can about cybersecurity and became a penetration tester.

Now I teach developers about cybersecurity

Lets #connect and make internet a safer space!

[Imed Bounab @imaibou]

In soccer, the goal is the surface area defined by the goalposts.

The goalkeeper knows exactly what to defend.

You should identify all the websites you own that are accessible on the internet.

Clearly define the attack surface you need to defend.

[Devsecurely @devsecurely]

@calvinochieng_ I love these motivational posts. They get me pumped!

[Devsecurely @devsecurely]

@EiiKwesiKay That's true. Small actions give you a huge momentum that converts into huge wins

[Devsecurely @devsecurely]

@calvinochieng_ @EiiKwesiKay Same for me!

[Devsecurely @devsecurely]

@calvinochieng_ I've heard good things about tweethunter

[Devsecurely @devsecurely]

@acrosettdev Those lines compound and make huge projects over time 😁