Security culture · Best practices · No excuses
🤡

Don't Be A Clown

Clowns skip the basics. Professionals don't.

Every breach, leak, and outage has a clown behind it — someone who cut corners, ignored best practices, or thought "it won't happen to us." Don't be that person.

↓   scroll to learn the acts   ↓
The Acts

Classic Clown Moves
— and how to stop

ACT 01
🎪
Weak Passwords
"password123" is a punchline, not protection
DO THIS INSTEAD ▸
Use a password manager + strong unique passwords
Generate 20+ character random passwords for every account. Use a manager like Bitwarden or 1Password. Enable MFA everywhere. One clown moves the whole circus.
Identity & Access
ACT 02
🎠
No MFA
A password alone is a single locked door with no chain
DO THIS INSTEAD ▸
Enable multi-factor authentication everywhere
Use an authenticator app (TOTP) over SMS where possible. Hardware keys (YubiKey) for high-privilege accounts. MFA stops over 99% of account takeover attacks.
Authentication
ACT 03
🎭
Secrets in Code
Committing API keys and passwords directly in repos
DO THIS INSTEAD ▸
Use secret managers and environment variables
Never hardcode credentials. Use .env files locally (gitignored), and Vault / AWS Secrets Manager / GitHub Secrets in production. Rotate exposed keys immediately.
Secrets Management
ACT 04
🤹
Everything is Admin
Giving every user and service root or admin access
DO THIS INSTEAD ▸
Principle of least privilege
Grant only the permissions a user or service actually needs — nothing more. Use IAM roles, RBAC, and scoped service accounts. Review and prune access quarterly.
Access Control
ACT 05
🎈
No Patching
Running software years out of date "because it works"
DO THIS INSTEAD ▸
Automate patching and dependency updates
Enable auto-updates on OS and critical software. Use Dependabot or Renovate for dependencies. Have a defined SLA: critical CVEs patched within 24h, high within 7 days.
Vulnerability Management
ACT 06
🎶
Click Everything
Opening every link and attachment without thinking
DO THIS INSTEAD ▸
Think before you click — verify before you act
Check sender addresses carefully. Hover links before clicking. Confirm urgent requests via a second channel. If a message creates pressure or urgency — that's the red flag.
Phishing Awareness
ACT 07
🦜
Trust the Robot
"The LLM said it was secure" — pasted straight to prod
DO THIS INSTEAD ▸
Treat AI output like any untrusted input
LLMs are tools, not oracles. Review, test, and validate everything they produce. Never pipe an unsanitised LLM response directly into a database, shell, or user-facing page. It's the new injection vector — treat it accordingly.
AI Safety
ACT 08
🎩
Ship the Vibe
Copy-pasting AI-generated code without reading it. "It looks right."
DO THIS INSTEAD ▸
AI code gets the same review as human code
Every AI-written line passes through the same PR, linting, and review pipeline. If you can't explain what the code does, you don't ship it. AI can generate bugs at scale — don't help it.
Code Review
ACT 09
🫧
Prompt Leak
Pasting proprietary code, API keys, or PII into a public chatbot
DO THIS INSTEAD ▸
Never expose secrets or IP to public AI services
You wouldn't paste trade secrets into a public forum. Don't paste them into ChatGPT either. Use enterprise tenants with data controls, or self-hosted models. Sanitise prompts — LLMs train on what you give them.
Data Protection
ACT 10
🕶️
Shadow AI
Employees using random AI tools with zero governance or visibility
DO THIS INSTEAD ▸
Govern AI tools like you govern any other IT
Maintain an approved list of AI services. Define what data can and cannot be shared. Block unauthorised services at the network level. Shadow AI is the new Shadow IT — if your team uses it, you're responsible for it.
Governance
ACT 11
🎪
"We Have Backups"
Never tested a restore. "The backup job says success."
DO THIS INSTEAD ▸
Run restore drills quarterly
A backup you've never restored is a belief system, not a safety net. Run full restore drills — pick a random server or DB and restore it to a sandbox. Document the process. Time it. If it fails, fix it before you need it.
Disaster Recovery
ACT 12
🎟️
Ship the Defaults
Default credentials, ports, configs straight to production
DO THIS INSTEAD ▸
Rotate and harden defaults before deployment
Change every default password, port, admin path, and config value before anything touches production. Defaults are public knowledge — attackers scan for them first. Use hardened baseline images. Automate the hardening step in your CI/CD pipeline.
Hardening
─ The Manifesto ─

Security is not a
feature — it's a habit

Clowns treat security as an afterthought, a checkbox, or someone else's problem. It isn't. Every developer who ships without sanitising input, every admin who skips MFA, every user who reuses passwords — they're all wearing the same big red nose. Security isn't the job of one team. It's baked into everything: how you write code, how you manage access, how you respond at 2am when something breaks. Do it properly. Every time. No exceptions.

The Commandments

Do It Right —
Every Time

I

Encrypt everything in transit and at rest

TLS 1.2+ for all traffic. AES-256 for data at rest. No exceptions for "internal" services — lateral movement is real.

II

Log, monitor, and alert

Centralise logs (SIEM). Alert on anomalies. If you don't know what normal looks like, you won't notice when it changes. Review alerts — don't just collect them.

III

Test your backups — not just your backups

An untested backup is a belief system, not a safety net. Run restore drills. Ensure backups are offsite, versioned, and — ideally — immutable.

IV

Validate all input. Trust nothing.

Every form field, API parameter, and file upload is an attack surface. Sanitise and validate server-side. Parameterise queries. Never trust what the client sends.

V

Have a response plan before you need it

Define your incident response runbook in advance. Know who calls who. Know how to isolate, contain, and communicate. A breach with a plan is manageable. Without one, it's a circus.

VI

Treat AI output as untrusted input

Never pipe an LLM response directly into a database, shell, or user-facing page. Every AI-generated string is a potential injection vector. Sanitise, validate, and verify — just like you would with any user-supplied data.

VII

Never feed sensitive data to a public model

Proprietary code, customer PII, internal architecture docs, and credentials don't belong in chatgpt.com. You wouldn't paste trade secrets into a public forum — don't paste them into a chatbot either. Use enterprise tenants with data controls, or self-hosted models.

VIII

Govern AI like you govern any other IT

Shadow AI is the new Shadow IT. Maintain an approved list of AI tools. Define what data can and cannot be shared. Block unauthorised services at the network level. If your team is using it, you're responsible for it.