Adam Lewis

Tonight the vampires and the witches cry. Lasher makes the wind blow, and the thunder sounds like something remembering something. #RIP @AnneRiceAuthor

@simandsec I watched your talk. It was great!

@DarkAndNerdy Excellent news!!! So happy for you and your family 😀

Quick cancer update for the Twitter verse. Bone marrow biopsy results are in. When I started in May my sample was 40% cancerous cells. This last biopsy has that down to 1%. Close to complete remission. 💪🏿

@DivineOps @JackWelchMBA Many, many, many congratulations Sasha! This was hard earned and a significant life achievement, enjoy every minute of this! 🎈🎉🎊

Hey Twitter, it’s graduation day 👩‍🎓🎉 ⁦@JackWelchMBA⁩

@DivineOps Congratulations Sasha! Wear the cap and gown. You have all the other days in your life too wear the other stuff. Getting an MBA is a great achievement, walk across that stage as it is meant to be! 🙂

Hi friends, My MBA graduation is next week! 🎉🥳🎊 So I am pondering an important question 👇

@DivineOps The best line from the 2003 film Lost in Translation, following an awkward dinner date: "What kind of restaurant makes you cook your own food?" 😂

Apparently, I’m supposed to cook my own food 🤭🤩 #kubecon

@DivineOps Physical cash is one of the last true forms of anonymity that we enjoy in an otherwise all-connected world. #privacy #justsaying 🙃

Ok I had to find physical cash 💵 😅 to pay for a very crappy cup of coffee But on the bright side my badge is glowing! 🌟 #thotcon

@DivineOps Yes. Skin on. And garlic. LOTS of garlic. 😋

Are you very particular about how mashed potatoes should be made? 🥔

@nicoleperlroth @FT @McKinsey Very well deserved. Definitely one of the best written cyber books. cc: @CyberSecCanon this one should make your list, if it hasn’t already!

I can't begin to describe how hard it was to write THIS book. This kind of recognition was truly beyond my field of vision. Thank you judges, @FT @McKinsey and authors for putting pen to paper in this most incredible of years. It is truly an honor to be in your company. #BBYA21

@nicoleperlroth Over hyped only in the sense that industry still isn’t doing a great job patching against all the known vulnerabilities. 😳

Tell me again how zero days are overhyped.

@KimMaida See my Twitter handle.

What’s the earliest username you remember having? No judgement! No shame!

@DivineOps I saw a good one of the Joker’s smile a while back. Awesome and disturbing at the same time 😂

Hey humans What's your favorite funny / geeky mask? 😷 Sci-fi / science / tech references appreciated 😊

@allanfriedman Excellent timing. Had my first hot chocolate of the season on a crisp day on the Chicago river walk yesterday. 🙂

Cool and wet dog walk —> first hot coffee of the season.

@DivineOps The struggle is real.

Clicked on the wrong bookmark 4 times in a row 🤦‍♀️

@lsitaraman @manicode I delegate my authorization to a client to perform CRUD on my protected resources on a resource server, bootstrapping said client with a JWT. Later I change my mind and want to revoke that delegated authorization. That is one reason. There are many others.

@manicode ?? Why ? Isn’t this always ( supposedly) stateless ?? Seriously what am I missing ??

Even short-lived JWT’s need to be revoked sometimes. #fightMe

@manicode @TrialByTruth @sec_tigger @madplatt @DinisCruz @psiinon @txs @c0dmtr1x @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop I use the term risk tolerance. I agree few have an ‘appetite’ for risk, and a risk budget seems a bit weird too, because your budget may or may not align with your risk. But in our professional life and personal life, we all have a tolerance for risk, which varies.

@TrialByTruth @sec_tigger @madplatt @DinisCruz @psiinon @lewiada @txs @c0dmtr1x @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop I respectfully don’t think risk budget is a good term. It implies your spend which never relates to security posture. Measuring security culture, something several of the insurance companies are doing, is more accurate. It’s about behavior over spend, IMO.

Assertion: SAST is a waste of resources, my experience is >90% false positives. Money & time is better invested in SCA and DAST that provide high fidelity / actionable findings. @manicode @gmfpanda @xmoxxen @_mwc @sec_tigger @0xfde @vanderaj pls help me begin this conversation

@manicode @niallm @DivineOps @sec_tigger @madplatt @TrialByTruth @DinisCruz @psiinon @txs @c0dmtr1x @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop Culture eats process and tools for breakfast. People are greater than process, process is greater than tools.

@niallm @DivineOps @sec_tigger @madplatt @TrialByTruth @DinisCruz @psiinon @lewiada @txs @c0dmtr1x @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop The longer you wait to fix a software bug the more exponentially expensive it is to fix so says every software study on this topic. More important than budget is security culture and behavior. Security culture is what insurance companies are measuring not your budget.

@sec_tigger @c0dmtr1x @TrialByTruth @madplatt @DinisCruz @psiinon @txs @manicode @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop Totally agree with this. SAMM is a fantastic program framework, but like all frameworks it needs to be used to build the next set of enablement. Sort of like how ASVS can satisfy certain security practices in SAMM, so could we have something else that speaks to tooling in SAMM

@c0dmtr1x @TrialByTruth @madplatt @DinisCruz @psiinon @lewiada @txs @manicode @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop BSIMM and OpenSAMM (and others) are inherently generic. Which is a great baseline, but to be most efficient / effective you need to tailor this to your specific context. And yeah, part of that program mapping includes (maybe) tool customization - based on that context.

@c0dmtr1x @sec_tigger @TrialByTruth @madplatt @DinisCruz @psiinon @txs @manicode @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop +1 for SAMM

@sec_tigger @TrialByTruth @madplatt @DinisCruz @psiinon @lewiada @txs @manicode @gmfpanda @xmoxxen @_mwc @0xfde @vanderaj @owasp @wardleymaps @swardley @opensecsummit @oneraindrop For appsec program in general I would use bsimm or opensamm so not sure there is further need for a map, I thought this was more specifically about guidance for scanning tool usage?

@_nat @_nat_en Welcome to 2012. 🤓

Wow. Twitter finally supporting OAuth 2.0 after almost 10 years!