Czym jest ten słynny DevSecOps? Kogo zatrudniają działy bezpieczeństwa? Jak rozwijać swoje umiejętności na początku ścieżki zawodowej w IT Security? Na te i inne tematy możecie poznać moją opinię w podcaście, który powstał dzięki gościnie Adama Haertle oraz Adama Lange. Link do nagrania poniżej: https://www.youtube.com/watch?v=FCL7KKNhrX4

Introduction Everyone I’ve ever talked to who was given a responsibility of managing security of their company was always extremely busy, leaving very little time for self-education - I’ve been in the same boat for years. Which is very unfortunate, because nothing can expedite your journey like learning from the experience of your peers. NIST … Continue reading NIST Cybersecurity Framework v1.1 – Shortened →

It didn't happen once or twice, that I fooled myself into thinking that I can build the very thing that I aka my organization needs. Even when I in fact was able to, it doesn't mean I should've done so. See, when you're growing an organization and you happen to have your own software engineering … Continue reading The fallacy of building vs buying →

Regardless whether you're creating and selling software or you're just using it to run your daily operation, you are an IT company. Show me a business which doesn't require technology as an essential element of its strategy and I'll show you what you're missing. If you've been listening closely to the things taking place in … Continue reading Security perimeter, budgeting and technical debt →

While studying new material in private time I like to take notes to memorize things better and have neat reference material for the future. I often end up polishing some of my notes on a specific subject and releasing it to the infosec community, and I've found such a piece of work from last year … Continue reading Security Principles of Google Cloud Platform →

A couple of weeks ago I was asked by my colleague to give him some clues and tips on how to become a Cloud Security Architect, as that's the venture he wants to follow and he knows I've been in architect-alike roles for a while. Knowing how much fulfillment one can get from a good … Continue reading Useful training and mindset for becoming a Cloud Security Architect →

Całkiem często pojawia się w polskim community pytanie odnośnie tego jak poradzić sobie z certyfikacją Offensive Security Certified Professional, więc uznałem, że troszkę wypada dorzucić swoje trzy grosze biorąc pod uwagę to, że w ciągu ostatnich 3 lat rekrutowałem kilkadziesiąt osób do różnych działów cyberbezpieczeństwa i sporo z tych osób próbowało swoich sił właśnie z … Continue reading [PL] Jak przygotować się do zdania certyfikatu OSCP →

Hello Friends, I want to share with you a blogpost I created as an attempt to bring some more clarity to the concepts that are [finally] getting more attention of the public. I’m a solid believer that the potential of the tribe can be tapped into it’s full extent only if all the members of … Continue reading 13 basic steps to start a practical implementation of DevSecOps at your organisation →

Niedawno na Facebookowej grupie "Testowanie Oprogramowania" pojawiło się ciekawe pytanie: Próbuję się przekwalifikować z testera manualnego na pen testera. Zmieniłam teraz pracę i jako pierwsze zadanie jako nowy penetration tester zostało mi polecone zbudowanie laba. Narazie nie wiem jak zabardzo to ugryźć. Ogólnie dopiero formujemy security team więc wszystko jest jeszcze bardzo płynne. Docelowo lab … Continue reading Własny LAB do nauki pentestów – jak zacząć →