The Penetration Testing Execution Standard or “PTES” is a standard consisting of 7 stages covering every key part of a penetration test. The standard was originally invented by information security experts in order to form a baseline as to what is required for an effective penetration test. While this methodology is fairly dated and has […]
Having recently passed the OSCP, I was looking for my next certification. I spent several weeks weighing the different options. Should I look to take my overall penetration testing skills to the next level and pursue Offensive Security’s new OSEP (Offensive Security Experienced Penetration Tester) course or pursue a more specialized path i.e. one dedicated […]
Since the introduction of Android Nougat, users no longer have the ability to add user or admin supplied CA certs without using a rooted device. Because of this, android penetration testing is effectively impossible without taking some necessary steps to proxy traffic to Burpsuite. This tutorial will provide instruction on how to bypass this restriction […]
Risk assessments are a way of reviewing your assets, the threats to those assets, any vulnerabilities or conditions that leave them open to those threats, and what you are doing to mitigate the risk to those assets. What comes out of that analysis ultimately is an understanding of your residual risk, or how likely is […]
A common term used in many different industries is authentication. In information security specifically, authentication is the process of determining if a person is who they say they are. Usually, this process is completed prior to giving that person access to something, so you can envision authentication as a guarded gate before a person is […]
Recently, we were asked by a client what VAPT meant. VAPT is an acronym for Vulnerability Assessment and Penetration Testing. This is a broad term which can refer to many different types of security testing, so we’ll dig a bit deeper into different services that could be referred to as VAPT, with the goal of […]
In today’s blog, we will be discussing social engineering attacks in the age of COVID-19. Social Engineering is a popular vector for attackers and with the rise of remote work due to the pandemic, companies’ IT security departments need to be increasingly vigilant. As many of our readers are no doubt aware, social engineering attacks […]
A cyber security risk assessment can take many forms. In order to determine what sort of assessment is best suited, you first need to define your goals and work backwards to determine the type of assessment required. Today, we will discuss some of the different ways to assess cyber security risk . Below are common […]
In this blog, we are going to take a look at the Haddon Matrix to see how it can be used to help us in information security. The Haddon Matrix does not come from the security space, or really IT at all, but rather it is a term used in Injury Prevention. It has since […]
Incident response tabletop exercises are a great way to mature your overall security posture. As with most mock exercises, the more thought and effort you put into the execution, the more you will ultimately get out of it. Today, we explore tips to help improve your next incident response tabletop exercise. 1. Treat it Like […]
