Senior Security Engineer | Cloud Security (Azure) · DevSecOps · ISO 27001 · ISO 22301 · ISO 20000 · PCI DSS · SWIFT CSP | Securing Cross-Border Payments
Nigeria
Joined December 2019
- Tweets1.3K
- Following1.5K
- Followers733
- Likes1.3K
Plain words: an "API key" is a password for software. Treat it like one. Do not paste it in chats, screenshots or public code.
Quick check for founders: if an employee left today, how many systems would still let them log in tomorrow? If you need more than a minute to answer, start there.
Morning nudge: if your phone has updates waiting, install them today. Most of them are security fixes, not new emojis.
Most security careers do not start with hacking. They start with someone curious enough to ask "what happens if I change this number?"
A pentest report nobody reads is an expensive PDF. Ask for findings your developers can reproduce in five minutes, with the fix next to each one.
How account takeovers usually start in Nigeria: not a hacked password, but a SIM swap or a "send me the code you just got" message. Is your recovery flow stronger than your login?
Built a thing: SecTools.ng
Free cybersecurity tools, no sign-up. Career path finder, CV reviewer and interview coach if you are breaking in. Report generator and risk explainer if you are already in.
Try one, tell me what breaks. sectools.ng
Founder checklist #1: every admin account has its own login. No shared "admin@" password passed around on WhatsApp.
Fintech founders: the transfer limit on your app screen is a suggestion. The limit on your server is a control. Attackers do not use your app screen.
Nigerian tech meeting: "Is it secure?" "Yes, we used a strong password." "Which one?" "The company one. Everybody knows it."
Plain words: "access control" just means the app checks, on every request, whether this person is allowed to do this thing. Not once at login. Every time.
Monday fix: open your admin panel in a private window, logged out. If you can see anything except a login page, that is your first ticket this week.
Good morning. Before the first meeting today: check your email has two-step verification on. Then have your tea.
New week, new launches. If yours touches money or personal data, get a second pair of eyes on it first. DMs open. michaeladeyanju.com
New week tomorrow. One security thing to do Monday morning: turn on MFA for every admin account you have. Just that.
Best part of security work: the moment a developer says "oh, I see it now." Worth more than any finding.