Security Defending from Forced Browsing…good reasons not to just hide restricted content Secure coding to protect against forced browsing. Strong defences from forced browsing require controls such as Role Based Access. Here we explain how to mount a good defence!
Talks From Builder to Breaker - 26th November 2019 - (ISC)2 North East England From Builder to Breaker - 29th August 2019 - BSides Manchester (Youtube) Red Teaming: a view from the field
Security Hooking a Browser with the Browser Exploitation Framework (BeEF) A quick guide to starting BeEF and running commands against a hooked browser
Security Proxmark 3, Cloning a Mifare Classic 1K Cloning a Mifare Classic 1k card using the Proxmark 3
Agile Why do we Perform Secure Code Reviews Why do we use secure code reviews, instead of just a generic code review?
Security When Should we Perform a Secure Code Review? Working in an agile environment we need to consider what we do and how important it is that we do it. We want efficiency, but not at the expense of quality. So when
Agile Who can perform a Secure Code Review? You need to pick the right person for a job. Here's how to find the right person for a secure code review.
Agile Agile Secure Code Review - References A list of references that have been useful when writing about Secure Code Reviews. I haven't found much yet! FxCop OWASP Code Review GuidePluralsight course on the OWASP Top 10Visual Studio Code Analysis
Security API Throttling API request throttling limits the number of requests that can use your API. “Madness” you say, “intentionally stop requests from reaching my API?”
Security Defence Against SQL Injection How do you defend against SQL Injection? Have you only got one or two defences in place? Cover yourself from multiple angles and perhaps help your overall security stance too!
Security Adding Depth to Security with Input Validation Input validation is a simple yet powerful part of defence in depth. Discover how it helps improve the security of any service.
Security Defence in Depth Meets the Software Development Life-cycle Security in software development can get time consuming. Thinking about it in an Agile way can save time and may even be better...
Security Authentication vs Authorisation, know the difference Authentication vs Authorisation is one of the real basics of security, we've all got to start somewhere!
Security The Intricacies of IP Whitelisting What is an IP Whitelist? An IP whitelist restricts incoming traffic so that it may only arrive from an IP address or list of IP addresses. Traffic from any other address is ignored
Security The Security of Champions This is the third blog (first one here, second one here, third on here) from a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the
Security Security degrades over time This is the third blog (first one here, second one here) from a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the world café conversational
Security Application security, design it in, or wedge it in at the end?? ...security is rarely considered part of a minimum viable product.
Security Is your business unwilling to add security features to software? I recently took part in a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the world café conversational format to discuss a number of topics.
Security My Path to CSSLP A guide to how I got the CSSLP Certification, containing resources I used and what I experienced along the way.
Efficiency Don't forget the small things. Little things in software development are important, sometimes really important. Little things can seem so small that they don't deserve attention, tiny little tasks that can take seconds to do. If however these
Agile 3 Ways to Switch Off Code Analysis Code analysis is a useful tool. The ability to stop code analysis in visual studio and from the command line can be important and save a lot of time. Here's how to do it.
Visibly Relaying Information I’m a big fan of visibly displaying information instead of simply attempting to use words. For example, I could explain the AND (&&) operator as equating to True only if the
OOGlossary Polymorphism Dictionary: “The condition of occurring in several different forms” Wikipedia: “from the Greek roots "poly" (many) and "morphe" (form, shape, structure)” and “the ability in computer programming to present
CleanCode Code as a means of knowledge exchange The dictionary defines the word Code as: “a system of words, letters, figures, or symbols used to represent others, especially for the purposes of secrecy.” Hopefully when I write software my code lacks
