We’ve talked in a previous post about how host compliance audits are a great way to get a low-level, detailed understanding of your hardening practices and security on a system-by-system basis. But it may not be clear exactly how this type of analysis is done and what your testing team would need to perform a […]
We’ve talked previously about why an incident response tabletop exercise can be a useful tool for your security program. But taking a step back, let’s take a closer look at what makes an incident response tabletop exercise successful. While a tabletop exercise can be a great way to step through your incident response process on […]
On the journey to building a security program, or evolving the one you’ve currently got in place for your organization, there are a number of controls you’ve got to consider. Some of those controls, like the ones we talk about here, are either contingent upon other controls already being in place or require a significant […]
In our article last week on how to get started when building a security program, we covered a lot of the foundational aspects you should be considering when trying to start an information security program for the first time or build a more organized roadmap to mature your current security program. You may be doing […]
Building a security program for an organization can be overwhelming. If you don’t have anything in place for managing information security, you’re probably already behind the curve. Information security is quickly becoming a baseline requirement for organization’s of all sizes, from mom and pop shops to start-ups to Fortune 500s. Large organizations are being increasingly […]
As we’ve discussed previously, a host compliance audit is an assessment of the configuration of a particular system (workstation, server, or network device) or set of systems. The configuration settings are compared to published security standards, industry best practice, and the security engineer’s experiences to highlight potential vulnerabilities and misconfigurations that result in risks to […]
A host compliance audit is a type of security assessment that involves the manual inspection of a workstation, server, or network device by a trained security engineer in order to evaluate the configuration, hardening, and security controls applied to the target. Using a published best practice standard, like the Center for Internet Security (CIS) benchmarks, […]
A password spray or password spraying attack is one of the most useful items in a penetration testers toolbox. This style of attack is used on almost every single external and internal penetration test. And if penetration testers are using it, you know that means hackers and malicious actors out there are using it as […]
One of the primary reasons many organizations are looking to have a penetration test performed is because someone they want to do business with wants some assurance that they are secure. So in the interest of forming this new business relationship, they’ll go out to try and get a penetration test performed as soon as […]
A crucial part of maturing your overall incident response capabilities is dry-running the process through what are known as “tabletop exercises.” Imagine security meets Dungeons & Dragons-style role playing. In all seriousness, incident response tabletop exercises are a great opportunity to practice your incident response process in a realistic scenario, from the documentation to the defined […]
