Gavin Johnson-Lynn

Security

CVSS for Dev Teams

Penetrations test results (hopefully) contain CVSS scores. Here are some thoughts on how a dev team should look at them.

Efficiency

Choosing a Keyboard

Deciding on the right keyboard as someone with an office job. Here are the key points about choosing a keyboard - I decided on a Durgod Taurus K310

ApiTop10

OWASP API Top 10: Broken Object Level Authorisation

Understand how broken object level authorisation attacks work against an API, why they work and what the potential impact is..

Security

Defending from Forced Browsing…good reasons not to just hide restricted content

Secure coding to protect against forced browsing. Strong defences from forced browsing require controls such as Role Based Access. Here we explain how to mount a good defence!

Talks etc

The Rise of the API...Evolving Security to Match the Web - 10th December 2020 - TechUG OWASP Top 10: API Security Playbook - 25th September 2020 Pluralsight Secure Coding: Broken Access Control - 24th April 2020 - Pluralsight From Builder to Breaker -

Security

Hooking a Browser with the Browser Exploitation Framework (BeEF)

A quick guide to starting BeEF and running commands against a hooked browser

Security

Proxmark 3, Cloning a Mifare Classic 1K

Cloning a Mifare Classic 1k card using the Proxmark 3

Agile

Why do we Perform Secure Code Reviews

Why do we use secure code reviews, instead of just a generic code review?

Security

When Should we Perform a Secure Code Review?

Working in an agile environment we need to consider what we do and how important it is that we do it. We want efficiency, but not at the expense of quality. So when we think about secure code reviews we shouldn't assume they always

Agile

Who can Perform a Secure Code Review?

You need to pick the right person for a job. Here's how to find the right person for a secure code review.

Security

Agile Secure Code Review

Performing secure code reviews in an agile environment.

Agile

Agile Secure Code Review - References

A list of references that have been useful when writing about Secure Code Reviews. I haven't found much yet! FxCop OWASP Code Review GuidePluralsight course on the OWASP Top 10Visual Studio Code Analysis < Back to the main article

Security

API Throttling

API request throttling limits the number of requests that can use your API. “Madness” you say, “intentionally stop requests from reaching my API?”

Security

Defence Against SQL Injection

How do you defend against SQL Injection? Have you only got one or two defences in place? Cover yourself from multiple angles and perhaps help your overall security stance too!

Security

Adding Depth to Security with Input Validation

Input validation is a simple yet powerful part of defence in depth. Discover how it helps improve the security of any service.

Security

Defence in Depth Meets the Software Development Life-cycle

Security in software development can get time consuming. Thinking about it in an Agile way can save time and may even be better...

Security

Authentication vs Authorisation, know the difference

Authentication vs Authorisation is one of the real basics of security, we've all got to start somewhere!

Security

The Intricacies of IP Whitelisting

What is an IP Whitelist? An IP whitelist restricts incoming traffic so that it may only arrive from an IP address or list of IP addresses. Traffic from any other address is ignored before any further processing. This is useful because you can immediately

Security

The Security of Champions

This is the third blog (first one here, second one here, third on here) from a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the world café conversational format to discuss a number of topics. I

Security

Security degrades over time

This is the third blog (first one here, second one here) from a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the world café conversational format to discuss a number of topics. I lead a table

Security

Application security, design it in, or wedge it in at the end??

...security is rarely considered part of a minimum viable product.

Security

Is your business unwilling to add security features to software?

I recently took part in a meeting of the North-East England chapter of (ISC)2, where security experts from the region used the world café conversational format to discuss a number of topics. I lead a table discussing secure software development and an unwillingness

Security

My Path to CSSLP

A guide to how I got the CSSLP Certification, containing resources I used and what I experienced along the way.

Efficiency

Don't forget the small things.

Little things in software development are important, sometimes really important. Little things can seem so small that they don't deserve attention, tiny little tasks that can take seconds to do. If however these tasks a repeated over and over again, that time can add

Agile

3 Ways to Switch Off Code Analysis

Code analysis is a useful tool. The ability to stop code analysis in visual studio and from the command line can be important and save a lot of time. Here's how to do it.