Senior Security Engineer | Cloud Security (Azure) · DevSecOps · ISO 27001 · ISO 22301 · ISO 20000 · PCI DSS · SWIFT CSP | Securing Cross-Border Payments
Nigeria
Joined December 2019
- Tweets1.3K
- Following1.5K
- Followers733
- Likes1.3K
Plain words: "least privilege" means each person and each system gets only the access it needs to do its job. Nothing extra "just in case".
Logs you never look at are just storage costs. Pick one alert that matters (new admin created, MFA disabled, big export) and actually send it to someone's phone.
Morning nudge: log out of accounts on devices you no longer use. Old phones and shared laptops remember more than you think.
Security work is mostly asking calm questions about things everyone assumed were fine. That is a skill anyone can learn.
Question: when your app sends an OTP, how long does it stay valid? If you do not know, find out tomorrow.
Question for builders: what is the one part of your app you would least like a stranger to test? That is probably the part to test first.
Founder checklist #4: your production keys are not in your code repository, including the old commits.
Payment webhooks: verify the signature, check the amount against your own records, and make the handler safe to run twice. Skip any one of these and someone eventually gets something for free.
Every security person has heard it: "We have antivirus, so we are fine." Antivirus does not stop your intern from sharing the admin password.
Plain words: "IDOR" means you can see someone else's data just by changing an ID in the request. Simple to find, simple to fix, still everywhere.
Rotate one secret today. Just one. The API key from 2024 that three former interns had access to is a good place to start.
Morning nudge: if you reuse one password across accounts, a password manager is the best free upgrade you can make this week.
Founder checklist #3: when a staff member leaves, one person is responsible for removing their access everywhere, the same day.
If you are launching something that handles money or personal data, I do security reviews for startups: web, mobile, API and cloud. Plain-English findings, fixes included. michaeladeyanju.com
Question for developers: do you test what happens when a user sends the request your app screen would never send?
Attack walkthrough, 3 steps: 1) open your invoice: /invoice/1042 2) change it to /invoice/1043 3) read a stranger's invoice. No tools, no skill, still one of the most common bugs in web apps. Check yours.
Founder checklist #2: you know where your customer data lives. Which database, which backups, which spreadsheets someone exported last month.
Sponsors back the room and never see a finding. That is in the terms before anything else. Room, lunch, prizes, people: that is what helps. Lagos Hack Day (proposed): michaeladeyanju.com/hackday
