Oblique
@oblique.security
๐ค 24
๐ฅ 2
๐ 23
Scale access securely and automatically
pinned post!
Identity management has quietly become the primary security perimeter. But it's a mess โ identity requires constant manual work that security teams burn out from. At Oblique, we're helping organizations make their access controls actually maintainable. Full post:
oblique.security/blog/identit...
loading . . .
Identity management is harder than it should be | Oblique
Identity management is surprisingly hard, as access controls change constantly, and getting them right requires context. We founded Oblique to work on impactful security problems.
https://oblique.security/blog/identity-management-is-hard/
7 months ago
0
6
3
Itโs 2025 and many teams still canโt reliably enforce strong authentication across their app stack. Thatโs the real SSO tax: not paying to have SSO, but paying to enforce it. Read more about how weโre approaching practical enforcement at Oblique:
oblique.security/blog/real-ss...
loading . . .
The real SSO tax | Oblique
The SSO tax shouldn't be about having SSO โ it should be about enforcing it. The value of SSO is to centrally manage access and require strong authentication.
https://oblique.security/blog/real-sso-tax/
about 1 month ago
0
1
0
What you really want to control access to is data, not systems โ so why are we stuck thinking in systems? Our cofounder
@mayakaczorowski.com
shares what she learned researching tiered controls for our latest report on Modern Access Controls.
loading . . .
2 months ago
1
1
0
Authentication failures from the last five years at Okta, Snowflake, and Twitter show very similar attacks, from credential theft, to MFA bypass, to session hijacking. Dive deeper into these incidents and avoid repeating the same mistakes:
oblique.security/blog/authn-f...
loading . . .
What we can learn from real-world authentication failures | Oblique
Recent breaches at Okta, Snowflake, and Twitter help us learn how to prevent authentication failures like credential theft, MFA bypass, and session hijacking.
https://oblique.security/blog/authn-failures/
3 months ago
0
0
0
Don't rely on managers for access approvals โ they don't work, for either security or speed. Instead, get approvals from app owners who actually understand the systems and risks, and automate approvals that are always granted.
loading . . .
3 months ago
1
0
0
We see it all the time: internal security tools โworkโ but hurt to useโso people route around them. We break down why teams underinvest in UX and how to build tools users actually adopt. Treat security like a product.
https://oblique.security/blog/security-ux/
3 months ago
0
0
0
We interviewed IT and security teams on what actually works in access control: shared ownership, data-first controls, enforce at change time, route approvals to app owners or automate, pre-approved groups for JIT access.
https://oblique.security/blog/policies-report/
3 months ago
0
0
0
What *really* works in access control? We asked modern IT and security teams how they define and improve their policies โ in reality, not in theory. Read the report:
oblique.security/blog/policie...
loading . . .
Modern access controls: takeaways on what actually works | Oblique
We interviewed IT and security teams to ask them how they actually define, implement, and improve their access control policies. Get the report to learn more.
https://oblique.security/blog/policies-report/
4 months ago
0
0
0
The biggest scaling challenge for IT and security teams isn't technical โ it's organizational. When you're managing access for thousands of employees and hundreds of applications, you need to know: who owns what? Read more in our latest post:
oblique.security/blog/delegat...
loading . . .
Delegate authority to those with context | Oblique
Business teams have context for access decisions but lack authority. Delegate to those closest to the resources by defining clear ownership for each app.
https://oblique.security/blog/delegate-authority/
4 months ago
0
0
0
You shouldn't build your internal tools in git unless you hate your users. Stop making me learn git. Stop trying to make git happen ๐โโ๏ธ
oblique.security/blog/git-int...
loading . . .
Stop trying to make git happen | Oblique
Internal tools built as code come with version control and audit logs for free, but git becomes a barrier for non-engineers to use these tools.
https://oblique.security/blog/git-internal-tools/
4 months ago
0
0
0
If you're interested in learning more about what's happening in the IAM market โ and who's competing with Okta and why โ then you should read our cofounder
@mayakaczorowski.com
's latest post.
add a skeleton here at some point
4 months ago
0
0
0
Your job title makes a bad RBAC role: what access does a Chief Happiness Officer need, anyways? A role in RBAC should represent what someone actually does in your environment. Your job title is your position, not your job function. Read more in our latest blog post:
oblique.security/blog/rbac-ro...
loading . . .
Why your RBAC roles aren't actually roles | Oblique
A role in RBAC should represent what someone actually does in your environment. Your job title makes a bad RBAC role: it's your position, not your function.
https://oblique.security/blog/rbac-roles/
4 months ago
0
0
0
Comms groups map to how people actually work, and often, access groups don't (but they should). But comms groups always become access groups. It's not a matter of if, but when. Read more in our latest post:
oblique.security/blog/comms-a...
loading . . .
Comms groups inevitably become access groups | Oblique
Comms groups map to how people actually work, and often, access groups don't (but they should). Comms groups always become access groups. It's not a matter of if, but when.
https://oblique.security/blog/comms-access-groups/
4 months ago
0
0
0
Check out our cofounder
@mayakaczorowski.com
's post on
@frankw.bsky.social
's Frankly Speaking on how modern security teams are scaling. Read the post for the new commandments of security teams:
franklyspeaking.substack.com/p/the-new-co...
loading . . .
The New Commandments of Security Teams
Guest post by Maya Kaczorowski
https://franklyspeaking.substack.com/p/the-new-commandments-of-security
5 months ago
0
3
1
Check out the latest from our cofounder
@ericchiang.bsky.social
to learn about a neat Go type trick to avoid query injection in SQL builders.
add a skeleton here at some point
5 months ago
0
1
0
Over the past 60 years, we've gone from reusing the same password everywhere to advanced biometric authentication like FaceID. Dive into the history of authentication in just 2 minutes!
loading . . .
5 months ago
0
2
0
Authentication has evolved from simple passwords to federated systems with passwordless logins, with a constant push and pull to balance security and usability. Deep dive into the evolution of authentication in our latest blog post!
oblique.security/blog/history...
loading . . .
The evolution of authentication, from passwords to passkeys | Oblique
Authentication has evolved from simple passwords to federated systems with passwordless logins, continuously balancing security and usability.
https://oblique.security/blog/history-of-authentication/
5 months ago
0
0
0
Instead of minting long-lived API keys, you can use GitHub Actions' OpenID Connect support for workload identity. Here's how we authenticate config-as-code workflows in Oblique without secret management headaches. Better security + Better developer experience ๐
oblique.security/blog/github-...
loading . . .
Authenticating GitHub Actions without API keys | Oblique
Instead of minting long-lived APIs keys and warning users โkeep this secret,โ let's use GitHub Action's OpenID Connect support instead.
https://oblique.security/blog/github-actions-identity/
5 months ago
1
3
1
Check out this interview with our co-founder
@mayakaczorowski.com
on finding and solving problems that have real security impact - like why access management is a perennial issue for organizations.
thesecuritywing.com/making-iam-l...
loading . . .
Making IAM Less Painful: A Security PM's Journey to Founding Oblique Security
TL;DR: I sat down with Maya Kaczorowski whoโs building Oblique Security. I chatted about her early beginnings studying math and cryptography to building security products at Google Cloud, GitHub, and ...
https://thesecuritywing.com/making-iam-less-painful-a-security-pms-journey-to-founding-oblique-security/
6 months ago
0
2
0
Most access request justifications are useless. "Please give me access" doesn't give you any context, it's just someone trying to get back to work.
oblique.security/blog/justifi...
loading . . .
Good justifications write themselves | Oblique
Organizations ask users to fill out justification fields when requesting access, but these are useless explanations. Your authorization system should already have the context it needs.
https://oblique.security/blog/justification-fields/
6 months ago
0
0
0
IT teams are afraid of removing access โ what if something breaks? Even if you don't know why someone has access, you should be able to figure out if they're using it. Removing unused access isn't risky โ never removing access is. Read more in our latest blog post:
oblique.security/blog/chester...
loading . . .
Chesterton's fence doesn't apply to access controls | Oblique
IT teams are scared to remove access they don't understand, leading to sprawling entitlements. Removing unused access isn't risky โ never removing access is.
https://oblique.security/blog/chestertons-fence/
7 months ago
0
0
0
Identity management has quietly become the primary security perimeter. But it's a mess โ identity requires constant manual work that security teams burn out from. At Oblique, we're helping organizations make their access controls actually maintainable. Full post:
oblique.security/blog/identit...
loading . . .
Identity management is harder than it should be | Oblique
Identity management is surprisingly hard, as access controls change constantly, and getting them right requires context. We founded Oblique to work on impactful security problems.
https://oblique.security/blog/identity-management-is-hard/
7 months ago
0
6
3
you reached the end!!
feeds!
log in