Matt Topper

Dad. Founder @UberEther Identity and Access Management geek. Always curious.

[Ryan Hurst @rmhrisk]

As an industry, we transitioned from no focus on security to expecting an underfunded and under-tooled discipline to handle the topic for an entire organization.

From there, we started to shift the responsibility to produce and deploy software securely back onto developers and operators.

We did this without providing them the tools or training to perform these jobs effectively.

We’ve also neglected creating and deploying the kind of tools that enable an organization to assess if their SDL and overall security programs are effective, instead focusing on tactical tools without considering their effectiveness.

At the same time, we’ve continued to rely on blind faith that vendors are doing the right thing and have failed to hold them accountable for repeated mistakes.

In essence, we have regressed back to where we started, with voices in the corner screaming about how we need to be making informed decisions to mitigate threats proactively instead of chasing the latest novelty.

We can’t have it both ways. Either security teams continue to exist, work closely with the product and operations teams, and grow proportional to the teams they support, or we build the kind of products that allow security teams to assess what’s happening at scale, augmenting developers with expert systems that enable them to access the knowledge to design and build secure systems from the get-go.

We must stop papering over issues and make the right thing the easy thing.

[Matt Topper @topperge]

@rmhrisk Your local WPA could probably give you a place
https://t.co/yQ6QpwHGIr

[Matt Topper @topperge]

@_ChezDaniela @Dave_Maynor Isn't that the Microsoft approach? Sorry to we messed up. Pay us more for those E5 licenses so you can tell us the next time it happens.

[Matt Topper @topperge]

@rmhrisk I'm sorry sir, we do zero trust in this org. I don't need to know where the root of trust is established.

[Matt Topper @topperge]

@HackingDave Just put in a 7-11 on the corner and make that part of the exercise program.

[Matt Topper @topperge]

Bubbles, anchors, and end links. This is why I can't sleep tonight.

[Matt Topper @topperge]

@lorenc_dan Also, are they going to mention the key used expired in 2021? I haven't seen anything in the write ups saying they fixed that issue yet.

[Matt Topper @topperge]

@lorenc_dan So sadly true, the response to customers has been "See, we told you that you should have been paying for E5 licenses. Do you want to write that check now?

[Matt Topper @topperge]

@arynncrow Hopefully it was don't in a medical facility and you didn't wake up in a bathtub full of ice. Glad everything turned out OK. Maybe we can find a way to get @tomsegura to sign your appendix?

[Matt Topper @topperge]

@jgrantindc No denial here

[Matt Topper @topperge]

@elinesterov We can't cross populate these communities soon enough

[Matt Topper @topperge]

@rmhrisk I know who to invite to the next DoD TEM. What do you think @evan2645 ?

[Matt Topper @topperge]

@MalwareJake @BrianVarnerVA This is what normally ends up happening but it's one of those fun questions for the auditors that don't suck. All 3 of them. I kid, I kid.

[Matt Topper @topperge]

@BrianVarnerVA @MalwareJake It's a debate that I've seen regularly. If it's the same identifier for the account but a different credential is it was same account? Comes around the same discussions with step up auth, MFA, passkeys, etc.

[Matt Topper @topperge]

@lorenc_dan I actually posted something similar in the @idpro_org slack channels as a perfect exercise between the IAM and SOC teams.

[Matt Topper @topperge]

@SMB_Attorney And the accountant in the corner just shyly nodded in agreement

[Matt Topper @topperge]

@ian_infosec It smells like Sarbox in here...

[Matt Topper @topperge]

@rmhrisk It's incredible how many threat models can be thrown out the window with a ball peen hammer. Also much easier approach if the target is work from home. Sometimes I hate that my brain works this way.

[Matt Topper @topperge]

@mquintin257 @USWNT @kelleymohara Probably looking at Vlatko and thinking about how much better they will be when Kelly's the coach.