Post

Kevin Riggle did security at Akamai, Stripe, and Lyft before starting his own consultancy. He argues at MicroConf that most cybersecurity advice is written for computers we stopped using twenty years ago. Here's what to do instead. 🧵

Threat 1: password reuse. Your bookkeeper could use the same password on a Minecraft forum that they use for the bank. The fix is a password manager. That's it. Riggle's notes the 1990s advice was wrong, and that writing them down on paper still beats reusing them.

Threat 2: spearphishing. An email from "you" to your admin — wire this account, can't talk now. The fix isn't 2FA. The fix: → A standing agreement that money never moves by email → Known invoices auto-approve → For everything else, you log in and approve

Threat 3: credential stuffing. That Minecraft dump gets run against your login form. Fix by rate limiting your auth endpoints — user and API both. Most teams do one and forget the other. Otherwise, you're doing it mid-attack (yikes).