Executive Summary Financial, healthcare and other personal / private information is a treasure trove for criminals and the proliferation of online records (payment, healthcare, etc.) and data sharing between entities (e.g., web portals for accessing healthcare records, payment portals for both B2B and B2C payment processing, etc.) gives these criminals countless opportunities to find data […]
Tag: penetration test
Is your organization meeting the PCI DSS v3.2 requirements for quarterly and annual testing?
What is PCI DSS? PCI DSS is the Payment Card Industry Data Security Standard. It is used to establish a security baseline for merchants who process, store or transmit payment card data. If you accept credit cards, PCI DSS applies to you. Are there consequences for failing to maintain PCI Compliance? The short answer is […]
The best place to get started on the red team?
The blue team.
The blue team.
One question that I get a lot, whether it’s from students, current or hopeful IT folks or just curious folks who wonder how one gets into this line of work, is “How do / can I get started hacking?” or “How do / can I get started on the red team?”. I’ve heard tons of […]
Pen tests and baby pictures
I had a conversation a few days ago that highlighted an interesting similarity between offensive security and, oddly enough, baby pictures. The conversation was with a photographer who worked extensively with families (family portraits, baby pictures, etc.). The photographer mentioned that they offer a package for parents to get pictures of their babies at newborn, […]
Critical Infrastructure, Energy and More – The growing dangers of IoT
The Internet and the Internet of Things (IoT) has revolutionized the way that the world does business. I don’t mean things like Facebook, Twitter and all of those cat videos that everyone seems to be obsessed with, I mean the cool things that the Internet has enabled us to do (or do better). Connecting offices […]
Knowing what you don’t know. Some lessons learned from Equifax and WannaCry.
It seems like we’re seeing report after report in the news about so-called ‘cyber attacks’ in organizations that, it seems, should have known better or done a better job at protecting themselves (and our data). What didn’t they know that led to the attack (and subsequent breach)? What could they have done to have prevented […]
The Cyber Defense Certainty Act, Active Defense or Hacking Back?
The Active Cyber Defense Certainty Act seeks to “…provide a defense to prosecution for fraud and related activity in connection with computers for persons defending against unauthorized intrusions into their computers, and for other purposes“. The [draft] bill seems well intentioned but overly ambiguous, leaving a lot of room for abuse (and for other purposes […]
Don’t forget the doors, physical controls are important too!
We talk a lot about technical controls but a recent engagement reminded me that physical controls are just as important and, if the physical controls fail or aren’t implemented, technical controls generally fall easily (if an attacker has physical access to an asset, most bets are off). The Gig: The engagement was a penetration test […]
A top-down approach to cyber security will not work, and here’s why
Recent computer / network security breaches combined with the fact that it’s an election year in the US has led to asignificant amount of focus on [information] security and technology and interesting responses from [mostly] politicians on what the appropriate solution should be. One of the solutions that I have heard tossed about in the […]
Massive DDoS against high profile websites highlight flaws in IoT
The Internet of Things (IoT) is the nickname / moniker that’s been given to the now prolific network of ‘smart’ and ‘connected’ devices like thermostats, cameras, DVRs, toasters, refrigerators and the like making their way into homes and businesses across the planet. It’s made the news quite a bit lately (so much that the IoT […]