Disclaimer I’m writing this blog to share my path and experience building a Threat Intelligence capability. All views, ideas, and thoughts expressed are my own and do not represent in any way the opinions of any entity whatsoever with which I have been, am now, or will be affiliated. …

I started my ex-pat life in Ireland a few months ago. It was my first trip since the COVID 19 outbreak; the last country I visited was Guyana in February 2020 previous to the outbreak. I went to Guyana to give some training on Incident Response provided by the Organization…

I’m a big fan of Threat Modeling. In his training material, Adam Shostack has done a great job simplifying this topic by defining and answering 4 simple questions. I encourage you to attend his LinkedIn training material. And yes, I also have the book, Threat Modeling Designing for Security

The Open Web Application Security Project, or OWASP for short, included in the OWASP Top 10 2013 the Unvalidated Redirects and Forwards. According to OWASP, "Unvalidated redirects and forwards are possible when a Web application accepts untrusted input that could cause the web application to redirect the request to a…

As a non-native English speaker, I’ve been surrounded by fears, founded- and sometimes unfounded fears when writing. You may argue why then I do not write on my native language , but that is not the point. I believe that thinking and writing in another language definitely shape your character…

First steps with Flask and Static Code Analysis with Semgrep This week I spent a bit of time learning something new. Flask has been on my list of things to learn for a while. So the time came and I attended some of the Pluralsight courses on this topic. One…

Package download metrics are easy to manipulate Disclaimer: I reported this issue to the Microsoft Security Security Response Center (MSRC), but according to their assessment ( which I agree with), the report would not meet the definition of a security vulnerability. I’ve been very keen to understand what is security…

HTTP HEAD is an interesting and powerful HTTP method. HTTP is by far, the most efficient, large, and complex system that exists. As explained by Jon Flanders in his book RESTful .Net “The success of the Web can be attributed in part to luck and timing, but some of the…

SAST or Static Application Security Testing or sometimes refer as Static Source Code Analyzer is a security mechanism in which source code vulnerabilities are detected early during the Software Development Life Cycle. The truth of the matter is that writing secure code is damn hard, and manual code review is…