The last month has been the loudest of my career. Every team I know is absorbing the same wave at the same time, and the group chats where we usually compare notes have gone quiet because nobody wants to put any of it in writing. So let's put it in writing here. What actually bought your team time this week?

For us it was boring and old. Rate limiting by source range on the customer login, plus a token deny list we kept one week longer than we thought we needed. Nothing clever about it, but the noise stopped by lunch.

@Cambridge Avenue Did the pressure move somewhere else once you closed the login? Password resets, the mobile API, anything like that?

It moved to password resets for about two hours and then it stopped. Rotating the exposed service accounts before anyone could replay the stolen tokens is what ended it.

One thing nobody warned us about is how much of the work is communication. The technical fix took an afternoon. Telling four hundred people their passwords were fine but their sessions were not, in words that didn't start a panic, took three days and two rewrites of the same short message.

We've started treating every credential as already stolen and designing around that assumption. It sounds grim, but it actually simplified things, because the controls that survive stolen credentials are the ones worth building.

What keeps coming back to me is that the attackers aren't clever, they're patient. They run the same handful of techniques against everyone and simply wait for one to be open. So the honest question for this room is which of those techniques is still open in your environment, and what is actually keeping it open?

For anyone still building their own checklist, the OWASP Top Ten is the sanest starting point.

Small thing that helped us this week. We wrote down every decision we made during the incident while it was still fresh, including the ones we regret, and it's already more useful than the post mortem will be.

Same here.

How are you doing , you all?

Discovered that a major Nigerian fintech lost over ₦3.5 billion to cybercriminals this week.

And they didn't report it to NDPC.

Anyone knows what the enabling factor could have been to give the hackers access to that much money?

Kaspersky reported on 2 November that attackers are using an AI tool called Link hidden. to move through education networks in Africa and Latin America.

In the case they wrote up, the way in was a compromised SQL Server, the intruders waited about two weeks, and once the AI tool started it took three to four days to reach domain admin.

Has anyone here checked who can reach their SQL servers, or set alerts for unexpected domain admin logons? I would like to hear what is working for you.