Senior Security Engineer | Cloud Security (Azure) · DevSecOps · ISO 27001 · ISO 22301 · ISO 20000 · PCI DSS · SWIFT CSP | Securing Cross-Border Payments
Nigeria
- Tweets 1,442
- Following 1,506
- Followers 733
- Likes 1,334
Saturday morning nudge: clear out old apps from your phone. Fewer apps, fewer things that can go wrong.
10
One month of security posts done. If even one team turned on MFA because of it, that is a good month.
24
If your product handles money or personal data and you have never had it tested, November is a good month to start. Web, mobile, API, cloud. Plain-English report. michaeladeyanju.com
1
3
69
What security question do you wish more founders asked before launch? Best answers get a reply from me.
23
Security Consult with Michael retweeted
AO3 is doing what every security engineer dreams of being able to do after a breach. finding evidence of a breach and getting to say “we are taking everything offline for 2-4 WEEKS to ensure it’s completely clean and do a full investigation” is unheard of with for-profit companies.
43
3,180
36,629
402,452
Founder checklist #13: you know how a customer would report a security issue to you, and someone actually reads it.
1
35
Security Consult with Michael retweeted
I have been debating for months with fellow security people who say AI hacking will not be a big deal.
My argument has consistently been that so much of the fruit is not just low-hanging, but sitting on the ground. That the internet is powered by fragile software, managed by regular people who make mistakes. And that extraordinary harm can come from exposing our flawed systems to more scrutiny.
This is a case in point. Billions in losses from one guys laptop.
How many similar situations do you think there are in the world? Across all our systems globally. That have trillions of dollars and in fact the entire economy running through them?
And that’s just misconfigurations! That’s not even counting AI finding new stuff.
The only reason things were stable before is because there were a tiny number of attackers and far too much surface area to cover. AI just changed all the math.
This has only just begun.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
16
15
109
12,309
Security Consult with Michael retweeted
If you’re a backend developer working on KYC, bookmark these resources.
Dojah documentation — identity verification integrations
Prembly documentation — identity and compliance APIs
Smile ID documentation — identity verification integrations
NDPC — data protection requirements
OWASP API Security Top 10 — API security risks
NIST Digital Identity Guidelines — identity proofing and authentication
Study document verification, liveness detection, consent, audit logs and secure handling of identity data.
A working verification API is only one part of a reliable KYC system.
4
11
82
2,639
I taught myself cybersecurity on ₦25 midnight data. No roadmap. No one to call.
So I wrote the map: 5 phases to your first security job, plus a 1:1 call with me when you get stuck.
Grab a copy: selar.com/5ixt87ac77
25
Loan and wallet apps: watch for one person running many accounts. Same device, same bank account, same address pattern. Identity checks at signup save you from fraud at payout.
26
Friday mood: closing the laptop, knowing every admin account has MFA. Sweeter than small chops.
1
148
Plain words: "zero trust" means no request is trusted just because it comes from inside your network. Every one gets checked.
1
2
57
Friday fix: check which staff still have access to the production database. "Just in case" access is how small mistakes become big incidents.
25
Friday morning nudge: review who has access to your shared drives. People who left months ago often still do.
24
Security people are not paid to be paranoid. They are paid to be specific about which risks matter.
31
Cybersecurity Awareness Month ends in two days. The attackers did not get the memo that it was only a month.
24
Question: if your main developer was unreachable for a week, could anyone else rotate your production keys?
1
2
69