We measure against industry standards, advise how to align with security standards, and train staff to effectively understand and practice information security
Birmingham, AL
- Tweets 435
- Following 158
- Followers 548
- Likes 22
Saying let's do security is like saying let's do health. It's too big to start. What happens after Susie in accounting gets compromised? That's a question you can actually answer. @kamakauzy @techspence
offsec.blog/your-employee-go…
1
1
416
Our password list is 180GB. With mutation rules that is about 4 quadrillion permutations. We have cracked 20+ character passphrases built from Bible verses and popular songs on a gaming PC.
offsec.blog/we-cracked-your-… @techspence
3
9
65
22,512
1/ Attackers didn't get more capable. We just kept adding things for them to attack.
OWASP built a framework around the opposite idea: what can you delete that erases the attack path entirely? We call it Subtractive Security. Here's the breakdown. 🧵
1
117
6/ Free ways to start on AD this week: run PingCastle, Purple Knight, Locksmith, ADeleg, ADeleginator, and ScriptSentry. Then delete what they flag instead of just tracking it.
For web apps: pull a software bill of materials and ask what's actually still in use.
1
15
7/ Before you secure something, ask if it needs to exist at all. Full breakdown of the framework and where to start in this episode. offsec.blog/subtractive-secu…
12
1/ A service account and a domain admin had the exact same password. The only difference between their two names was "svc_" tacked on the front.
Here's how that happens constantly on internal pen tests, and how to stop it. 🧵
1
1
281
3/ Service accounts are dangerous by design: overprivileged, often with local admin across dozens of servers. Crack one, get local admin, find a scheduled task running as domain admin. That path is common, not rare.
1
29
Start with planning and strategy. Identify the specific problem you want to solve before thinking about tools.
offsec.blog/episode-187-avoi…
1
338
Why “More Tools” Isn’t Always Better
Hear real talk about optimizing what you have before chasing the next shiny security product. @kamakauzy @techspence
1
2
220
Full Episode: Your Security Team Might Be Trapped in an Echo Chamber
offsec.blog/episode-180-cybe…
1
113
Storytime with @nekomancerzzz and @kamakauzy as they go through the OWASP Top 10.
1
3
117
Watch or listen to the full episode (179).
offsec.blog/episode-179-owas…
65
In Episode 171 of The Cyber Threat Perspective, @techspence and @kamakauzy break down how AI is fundamentally shifting offensive security, from "one-shot" app builds to orchestrated agent-driven tests.
1
3
2,697
Full Episode offsec.blog/episode-171-the-…
93