Who writes this.
Notes on product security from an engineer who does the job from the inside.
Written by Joseff Lewis.
Tonos publishes notes on product security: prioritising vulnerabilities, running champion programmes, reviewing designs while they are still drafts.
The notes are written by Joseff Lewis, a product security engineer and penetration tester with more than six years across Engine by Starling, Mastercard, Revolut, WithSecure and Synopsys.
Author background
- A secret-scanning gate that blocks the merge and tells the engineer how to fix it, so leaks are fixed in the pull request instead of a backlog.
- A vulnerability prioritisation framework based on SSVC, adopted as an engineering standard. Triage by likelihood of exploitation and business impact.
- A security champions programme, made by engineers for engineers.
- Security review of architecture decision records at draft stage, now run by a whole security team.
- Years of continuous penetration testing of applications, from first build to decommission.
Joseff Lewis · Author
tonos τόνος · /ˈtəʊnɒs/ · Greek · noun
The tension by which a thing holds together. In Stoic physics, the degree of tension that turns matter into structure. Also the accent mark: the small mark that changes what a word means.
- Author
- Joseff Lewis
- Based
- Brighton
- Views
- The author's own, not those of any employer.
Say hello.
Questions about a note, or a topic worth writing up.