Such a simple question, but it has many different answers, all of which can be important to your understanding of web application security. The Open Web Application Security Project (OWASP) is a non-profit organization with a simple mission: Improving the Security of Software. The organization is open to anyone, receiving contributions from security professionals and […]
There is no question that administrators need an account with elevated permissions so they can effectively manage and care for the domain and users. For this blog, let’s call that account the “Superman” account. However, security best practice is increasingly calling for administrators to have a second account that they use to perform their daily […]
Many times we have organizations come to us that have never had security assessments or penetration testing performed before. Maybe they have a new compliance requirement that is pushing them to get some testing done, or maybe they keep hearing more about the benefits of penetration testing and feel they need to jump in and […]
The Center for Internet Security (CIS), in collaboration with the SANS Institute, developed the CIS Top 20 Critical Security Controls (CSC) to help organizations prioritize their efforts in information security and protect their organization from the most common attack vectors. These controls are grouped into three broad categories. Basic controls are the starting block for […]
In this blog, we will look at one of the attacks we use on almost every internal penetration test, pass the hash. Many times, to make managing devices easier and because this account is rarely used, IT Teams will set the local administrator account to the same password on all devices across the organization. The […]
After performing penetration tests for a myriad of companies over the last decade, there is one thing that stands out above all others…. People suck at making passwords. At first I thought “how hard can it be?” But after working with company after company, and trying to improve their password security, I have realized that […]
Each year, Verizon provides a Data Breach Investigation Report (DBIR) which looks at the trends from the past year’s data breaches. Verizon builds this report using 73 data sources, with a combined total of 41,686 security incidents. By looking at the trends, we can see what’s happening in the information security landscape and try to […]
The 2013 Target data breach is one of the most infamous attacks in the past decade. Attackers gained access to the point-of-sale (POS) terminals and stole the credit card information for up to 40 million customers during the peak of the 2013 holiday season. This attack cost Target over $300 million dollars in actual expenses, […]
In today’s blog, we are going to explore the concept of a Demilitarized Zone (DMZ) in computer networking. Specifically, what is a DMZ and what does it protect your organization from? Second, we will explore what makes a DMZ so important and why so many compliance regulations require one. With that, let’s jump right into […]
All good (or in some cases bad) things come to an end. In the ever-changing world of technology, this is even more true. As Microsoft (or any other vendor) works on pushing new technology out, they will often mark older operating systems and applications as “end-of-life.” Some organizations, particularly those with a small IT budget, […]
