About Application Security skill | Skills modeled threats, inventarized attack vectors designed security pipelines deployed WAFs and IDS did audits, pentests and compliance checks What I did with it
modeled threats, inventarized attack vectors
designed security pipelines
deployed WAFs and IDS
did audits, pentests and compliance checks
Related Experiences What I did
Surveillance and corroboration
Penetration testing
Research and analytics
Deception and exploiting trust
Background checks on slow days
What I achieved
Had seven different personas with perfectly crafted legends and almost kept my sanity
Found a mole in a client’s sales department and brought him to justice
Investigated a couple of embezzlements
Gained 4 kg watching people do nothing exciting
Sorted a lot of garbage
What I learned
How to think like a bad guy: seeing liabilities, opportunities, attack vectors and how to counter them
How to do open-source intelligence (OSINT), gather/hoard and analyze information
How deeply unprotected we all are on a physical level, and how often we focus on cybersecurity and forget that concierges can be bribed
You always have to say “competitive intelligence” instead of “corporate espionage” for legal reasons
What I did
Developed a system that allowed investors to buy and sell shares in various non-traditional assets
In short, you could “IPO” your business, website, or even a cow, if you wanted. Any income source.
We had dividends, splits and merges, direct exchange between assets and a lot of other machinery for all the roles
Something like modern tokenization, but centralized and in the pre-Bitcoin era
The founder came with this raw idea and I brought this project to production, solo
What I achieved
Made a fully working product with many ideas ahead of their time (we even had proto-passkeys!)
Chose a perfect time to quit
What I learned
How to build systems working with money
What to do when your client decides to build a Ponzi scheme based on your beautifully crafted exchange system, and gets himself in prison for fraud
How to spot exploitable parts of systems
Update available — reload Reload