One of the age-old battles in information security is balancing the trade-offs between usability vs. security. We recently had a conversation with a client where this was brought up as a concern for implementing security controls we were recommending. The client said, “sure I can lock down this website such that no IP can get […]
In today’s blog, we are going to explore the concept of Black Box vs. White Box testing. There are a lot of terms thrown around when it comes to security, and it is easy to get confused, especially when different sources use different definitions for each term. Not to worry, we’ll explore black box, gray […]
Penetration tests can range from a simple test that takes 1 day to complete up to an assessment with multiple different penetration testing services that takes weeks to complete. A project manager is a vital role during a penetration test to ensure that everything goes smoothly, timelines are met, and ultimately the client gets the […]
In a lot of organizations we work with, something as simple as changing the password policy from a minimum length requirement of 8 to 14 is anything but simple. They have to get approval, organizational buy-in from top management, and then deal with hundreds of help desk tickets and frustrated employees once the change is […]
In today’s blog, we are going to take a look at how to make a better wordlist. When performing password attacks, whether online or offline, wordlists are a much better approach than a traditional brute force. Even with an offline password attack using a machine designed to crack passwords efficiently, a brute force of just […]
As companies prepare for the January 1st, 2020 implementation of the California Consumer Privacy Act or CCPA, we have been fielding quite a few questions surrounding the new regulation and its requirement for “reasonable security”. One of the most often asked questions is “Does the CCPA require penetration testing?” Today we dive deeper into the […]
Many times we have organizations come to us that have never had security assessments or penetration testing performed before. Maybe they have a new compliance requirement that is pushing them to get some testing done, or maybe they keep hearing more about the benefits of penetration testing and feel they need to jump in and […]
The reason most companies conduct a penetration test is to uncover vulnerabilities so that they can remediate or mitigate them, ultimately improving security posture. But in order to do that, one of the key components following any penetration test is the transfer of knowledge from the penetration test team to the organization’s defenders. And taking […]
In information security, there are generally two “sides.” The Blue Team, or defenders, are comprised of those who are trying to protect a network. They are made up of SOC analysts, firewall administrators, etc. Their job is to ensure the network is secure and operational. The Red Team, or attackers, conversely attempt to hack or […]
In a previous blog, we explored what Red Team engagements are and what types of organizations we would recommend them to. If you have not yet checked that blog out, give it a quick read here. In this blog, we are going to dive a little deeper into the subject and cover some of the […]
