In our last blog on tackling the broad topic of how do I protect my company’s sensitive information, we reviewed several ways to get started with this process. Before you can protect your sensitive data or “crown jewels”, you’ve got to know what you have and where it lives. We covered creating an asset inventory […]
Today, we’re going to try and tackle the million dollar question of how to protect your organization’s sensitive data. Keep in mind, this isn’t going to be a single, magical answer. There is no silver bullet when it comes to security, but when it comes to tackling a broad topic like this, we’ll try and […]
Today we’re going to talk about a question that seems to be coming up more and more in the security and penetration testing world, even though it’s been around in the technology and software development world for quite some time. Does it matter if I use an offshore penetration testing company? It doesn’t matter who […]
One of the things you’ll hear us say a lot is that we try to ensure all of our tests are as holistic as possible, to help you truly understand the cyber risk to your organization. But what does that really mean? Are our penetration testers using herbs and essential oils rather than our standard […]
Social engineering attacks hit organizations constantly. In 2018, not only did an average of 83% of organizations see a phishing attempt, there was an increase in credential theft related to phishing attacks of more than 70%. So it’s no surprise that many organizations are trying to figure out how susceptible they are to this kind […]
This blog outlines Triaxiom Security’s methodology for conducting mobile application penetration tests. A mobile application penetration test emulates an attack specifically targeting a custom mobile application (iOS and/or Android) and aims to enumerate all vulnerabilities within an app, ranging from binary compile issues and improper sensitive data storage to more traditional application-based issues such as […]
This blog outlines Triaxiom Security’s methodology for conducting Application Programming Interface (API) penetration tests. An API penetration test emulates an external attacker or malicious insider specifically targeting a custom set of API endpoints and attempting to undermine the security in order to impact the confidentiality, integrity, or availability of an organization’s resources. This document outlines […]
Host compliance audits are known by a lot of different names. Configuration reviews, security reviews, configuration audits, and host checks are just a few names I’ve heard tossed around to describe a review of the level of security of a workstation/server/device. This is done by using a combination of a best practice standard and a […]
Most of the folks looking for penetration testing or information security consulting try and choose a firm that they feel meets their needs the best. One of the ways that prospective clients may do this is by looking for a particular firm that claims to specialize in their industry or vertical. And we’ve even seen […]
The United States government now has an official cybersecurity agency with the creation of the Cybersecurity and Infrastructure Security Agency (CISA). The bill that Trump signed into law on November 16th, 2018 changes the National Protection and Programs Directorate (NPPD) into a standalone agency, moving it out from under the Department of Homeland Security (DHS). […]
