The EhsanLab blog
Notes from the field.
Practical writing on security, quality and compliance in Saudi Arabia and the GCC, from the engineers who do the work.
ComplianceLatest
The first 72 hours after a personal data breach under the PDPL
Saudi controllers have 72 hours to notify SDAIA after becoming aware of a personal data breach. The hour-by-hour decisions you make, and the work you did before, decide whether you can.
Read articleLatest
ASEhsanLab AppSec Teamin Cybersecurity
Securing generative AI features with the OWASP LLM Top 10
A chatbot or RAG copilot inside a banking app is a new attack surface running on old failure modes. The OWASP LLM Top 10 names them; here is how we design and test around the ones with no clean fix.
ASEhsanLab AppSec Teamin Cybersecurity
API authorization, object by object
Broken object level authorization is the finding we raise most often on API engagements, and one of the few you can design out for good rather than patch endpoint by endpoint.
STEhsanLab Security Teamin Cybersecurity
Mobile banking app security with the OWASP MASVS
A banking app runs on a device the customer, and sometimes an attacker, fully controls. MASVS v2 gives you eight control groups to check; here is what each means for a Saudi wallet or banking app.
QEEhsanLab Quality Engineeringin QA Testing
Stop retrying flaky tests and start reading them
A test that passes on the second try found something and was then told to be quiet. How to measure flakiness, quarantine it properly, and catch the product races that blanket retries hide.
STEhsanLab Security Teamin Cybersecurity
Ransomware resilience: backups that actually restore
Attackers go after your backups before they encrypt anything, and when they succeed the ransom gets paid and recovery costs multiply. Design the backup as a target, then prove it restores.
QEEhsanLab Quality Engineeringin Quality Engineering
DORA metrics for quality leaders
Test counts and coverage percentages tell leadership almost nothing about delivery. DORA's five metrics connect the work your test automation does to outcomes a CTO already tracks.
QEEhsanLab Quality Engineeringin Quality Engineering
Load testing for payday: model arrivals, not users
Most load tests model a fixed number of users looping. Payday traffic arrives at a rate instead, and that difference is what breaks systems at the worst possible minute.
CAEhsanLab Compliance Advisoryin Compliance
SAMA CSF Level 3 is an evidence problem
Technically strong teams still fall short of Level 3, and so do teams with thick policy binders. In both directions the gap is evidence that a control is documented, approved and monitored.
ASEhsanLab AppSec Teamin DevSecOps
Security scanners in CI: what should break the build
Adding scanners takes an afternoon. The gating policy is the hard part: block on everything and someone comments the gate out, block on nothing and the findings pile up unread.
No articles match that yet.