Post

Kevin Riggle did security at Akamai, Stripe, and Lyft before starting his own consultancy. He argues at MicroConf that most cybersecurity advice is written for computers we stopped using twenty years ago. Here's what to do instead. 🧵

Threat 2: spearphishing. An email from "you" to your admin — wire this account, can't talk now. The fix isn't 2FA. The fix: → A standing agreement that money never moves by email → Known invoices auto-approve → For everything else, you log in and approve

Threat 3: credential stuffing. That Minecraft dump gets run against your login form. Fix by rate limiting your auth endpoints — user and API both. Most teams do one and forget the other. Otherwise, you're doing it mid-attack (yikes).