Lisi Hocke
LightNews LightNews
banner
lisihocke.bsky.social
Lisi Hocke
@lisihocke.bsky.social
1.3K followers 390 following 350 posts
security engineer, holistic tester, quality enabler, agile experimenter, sociotechnical symmathecist, team glue. volleyball player, game lover, story escapist. she/her.

https://www.lisihocke.com
https://mastodon.social/@lisihocke
https://linktr.ee
Posts Replies Media Videos
lisihocke.bsky.social
Joined very interesting sessions at #SoCraTes2025 today and gave two myself. "Building Secure Enough Products - Bumps & Boosters" led to an impactful experience exchange of what holds us back & what helps us move in good directions. 💡

1/2
Photo of flip chart showing the following list of gathered bumps holding us back when it comes to building secure enough products: Authentication and authorization: boring and annoying, complicated and easy to mess up Knowledge: where to even start, lack of imagination what attackers might do "We had more important things to do" Implied trust Poor observability: complex, what to consider malicious "Let's hide this - we can't use the paper trail" Unclear incident response process: what now when the heat is on Insecure defaults Regulation: just ticking boxes, overinterpreting what is sensitive data Third party tools: no insights, so many supply chain attacks Performance drops: additional auth requests Poor usability of security features: people find workarounds Photo of flip chart showing the following list of gathered boosters helping us move forward when it comes to building secure enough products: Authentication and authorization: enabler for features Check and update dependencies through tools Knowledge sharing: helpful security team, security champions, threat modelling Awareness by example: CTFs, cheat sheets Use helpful security products - trustworthy ones Define "secure enough" and risk appetite Use metrics for the win: show progress, motivation Regular external penetration tests Do security testing yourself first Regular fire drills and dry runs for emergency cases Regulation: what data do we really need? Security features supporting user experience: SSO Iterate Standardization: don't reinvent the security wheel Competitive advantage: customers expecting level Zero trust: guardrails, limit blast radius Celebrating success stories: reinforce good practices
July 18, 2025 at 4:37 PM
lisihocke.bsky.social
Finally, the workshop day of #SoCraTes2023. Originally, I intended to join the #CodeRetreat as it was an awesome experience last year. Then @realn2s@infosec.exchange offered to co-facilitate a workshop together on "Painless Security" - couldn't resist! It ended up being quite insightful. 1/2
Flipchart notes from workshop "Painless Security" given by Claudius Link and Lisi Hocke at SoCraTes 2023, part one. "Painless Security", framed as a title. Sticky notes with six agenda items: welcome and agreements, our connection to security, what's painful, how to reduce the pain, deep dive of your choice, what's next. All items are checked besides the deep dive being marked as on hold. Agreement: We keep confidentiality. Collection of points from the initial conversation how people connect with security, nine items: Missing out - shouldn't we know that? Assume breach Information knowledge sharing The department of "no" For due diligence Legal and GDPR Legacy "code" Security versus communication Trust boundaries Part 2a. Two headings: "What's painful?" and "How to reduce the pain?" Heading "What's painful?", 29 items listed in no specific order: Fear Security theater More effort Poor user and developer experience Cross-team collaboration and dependencies People issue Security always comes last Future problem UX QA Detection Not more people are invested Procedural problems Changing permissions Scary to ask questions Seeing issues yet no real pain perceived ... until suddenly pain is super high Incidents Complex system Multiple levels or layers Prevention, detection, reaction Security experts missing, distant, condescending Paranoia Vast area of expertise and lack of knowledge Secrecy Communication gaps, no shared language Outdated dependencies Alert fatigue Overwhelming: never finished Can only know system is insecure, not the other way around Continued in next image. Part 2b. Heading "How to reduce the pain", 34 items: Get security advice early on! "Shift left" security Put security considerations more to the start (like TDD) Anti-personas Ask any questions channel Have a good developer experience and involve the whole team Getting ahead of the wave Dependencies: automate Fun Hack the Box team Pentesting by ourselves or externals Red versus blue events Education: e.g. WebGoat or Hack the Box Everybody should know some tools Secure code warrior Hack your own system Table top exercises Host CTF sessions Make security more experiencable Security "katas"? For example: JuiceShop Examples: collection of real stories Bug bounty Coordinated disclosure Security.txt Knowledge sharing Security meetups Security without jargon Security champions program Threat modeling Drive-by versus targeted Risk assessment, e.g. excluding scenarios, accepting risks actively Don't obfuscate for security Split systems into secure-ish & secure Part 3. "What next?", framed as a cloud. 10 sticky notes listing takeaways to try. I would like to introduce semi-regular security sessions into my team. Hack the Box / CTF / JuiceShop / WebGoat but also threat modeling. Maybe for a start 30-60 minutes a week after the daily? Sneakily or explicitly? Security (experience) exchange AskAppSec: Security without jargon, examples collection, host CTF Collect examples Make it fun Offer my security experience to colleagues Create security exercises from EMS system Security RPG? P&P? Board game? Write an adventure Security team as tool smith
August 28, 2023 at 9:00 PM
lisihocke.bsky.social
Facilitated an experience exchange together with Claudius Link on security for devs (& everyone) gathering ideas. 💡 Joined an interesting session on documentation as code and enjoyed lots of games in the evening in wonderful company. 😊 2/2
Notes for the session "security for developers and everyone" given by Claudius Link and Lisi Hocke at #SoCraTes2023, part one. Provide good code examples Bake security in by default Standardize Double-check defaults Help figure out priorities Assess risks Risk appetite Keep dependencies up to date Manage technical debt which is security debt Be able to respond quickly Sketch figure with thinking bubble saying "Log4j anyone?" Sell: deliver value faster Plan for mistakes and recovery Validate input and care for output Have restorable backups Hire experts Get external person to point out the problem Effort to demonstrate misuse / exploit Capture actual flags Enforce multi-factor authentication Avoid ivory towers for InfoSec Security champion program Mindset change Notes for the session "security for developers and everyone" given by Claudius Link and Lisi Hocke at #SoCraTes2023, part two. Secure operations Secure code: "no" known security bugs Secure workflow (e.g. open S3 bucket) Secure use
August 25, 2023 at 11:19 PM