Secure Coding Trainer, Best-selling author of Alice and Bob Learn Secure Coding & Alice and Bob Learn Application Security. #AppSec she/her 🌻
Canada - West Coast 🍁
Joined June 2017
- Tweets61.1K
- Following2.4K
- Followers50.3K
- Likes107K
And your right to privacy shouldn't depend on whether an organization makes a profit.
🎥 twp.ai/Ilw6w4
#Privacy #Canada #CrimeStoppers #CyberSecurity
7/7
I made a video explaining what happened with Crime Stoppers, the gaps in Canadian privacy law, and why I think our lawmakers need to address them.
Because I've been saying this for years:
**You can't have privacy without security.**
6/7
Information that, if exposed, could literally put someone's life in danger.
And yet our privacy protections can depend on where an organization operates and what activities it conducts.
5/7
Think about that for a moment.
Domestic violence shelters. Victim support organizations. Addiction recovery services. Charities helping vulnerable children.
These organizations can hold some of the most sensitive personal information imaginable.
4/7
It turns out that Canada's federal privacy law, PIPEDA, generally doesn't cover nonprofits when they're conducting noncommercial activities.
Now, some provinces, including BC, have their own privacy laws that DO cover nonprofits. But protections vary across Canada.
3/7
After the massive Crime Stoppers data breach, Canada's federal privacy commissioner and Ontario's privacy commissioner indicated that they don't have the authority to formally investigate the Crime Stoppers organizations involved.
WHAT?!?!
2/7
I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously.
1/7
ALT A close-up of a serious-looking Tanya Janca on the left appears beside a red-and-black graphic about privacy and crime tips. Large text reads “CRIME STOPPERS,” “BREACH:,” and “WHO PROTECTS CANADIANS’ PRIVACY?” with a Canada maple leaf, “CRIME TIPS” and “CONFIDENTIAL” folders, and a glowing red padlock.
🎥 twp.ai/E5Guxq
**Secure coding is essential. But securing the entire software supply chain is essential too.**
#SoftwareSupplyChainSecurity #AppSec #SecureCoding #PHP
8/8
For example, updating a container base image in your repository doesn't mean your running application has been fixed. You still need to rebuild, redeploy, and verify.
I made a video explaining the recent PHP2Shell vulnerabilities and what developers need to know.
7/8
We need to know what we're running, understand what we depend on, keep those components updated, and verify that security fixes actually make it into production.
6/8
But what happens when the vulnerability isn't in your code?
What happens when it's somewhere else in your software supply chain?
That's why we need to think about securing the **entire software supply chain**, not just the dependencies listed in our package manager.
5/8
We spend a lot of time teaching developers how to validate input, implement authorization, use safe APIs, and avoid introducing vulnerabilities into their applications.
And we should! Secure coding is incredibly important. (Obviously I care about this a lot)
4/8
It includes the programming language runtime, frameworks, build tools, container images, infrastructure, and all the other components we depend on to build and run our applications.
3/8
When we talk about securing the software supply chain, people often think about open-source libraries and third-party dependencies.
But our software supply chain is SO much bigger than that!
2/8
You can write perfectly secure application code and STILL end up with a critical security vulnerability.
That's one of the most important lessons from PHP2Shell, and it's a perfect example of why **software supply chain security** matters so much.
1/8
ALT Smiling woman in a red top stands beside bold text reading “YOUR CODE IS SECURE. PHP ISN’T.” over a purple code-themed background. A cracked PHP logo with a red warning triangle and exclamation mark appears in the lower right.