I was a teacher before I was an auditor. Today GitHub caught me making the same mistake I warn clients…
Melissa W. — Detection Engineer | IAM & ITDR Analyst | SOC & GRC Specialist | Python SIEM Automation (120m→30m) | DORA & NIS2 Compliance | Triple MSc CS/DS/AI | W-8BEN Approved Contractor (Remote CET/EST)
I was a teacher before I was an auditor. Today GitHub caught me making the same mistake I warn clients about.
Got an alert: "Codeanywhere authorized to access your account."
I had clicked "Login with GitHub" earlier, then closed the tab. Forgot about it. GitHub did not.
My hunter tool would have flagged this:
[!!!] DORA ALERT [RISK: 4.5/10]
Location: Unknown (OAuth flow)
Network: Codeanywhere
Action: New third-party authorization
I revoked it in 30 seconds. Unused access is unnecessary risk.
Same lesson I taught with the ant farm: check your trails. Whether it is ants in Kitimat or OAuth tokens in GitHub, the principle is the same – review, verify, clean up.
I apply the same controls to myself that I build for clients. Unused third-party access gets revoked within 24 hours.
What is sitting in your GitHub authorized apps right now that you forgot about?
#Cybersecurity #OAuth #DORA #SecurityHygiene #BlueTeam
5 reactions · 1 comments
Topics: #blueteam, #cybersecurity, #securityhygiene, #dora, #oauth
Comments
Laurent H.: Love this 🙌 , the best security pros are the ones who hold themselves to the same standard they set for others.