In this blog, we are going to look at red team engagements. We will answer the question of what is a red team engagement, clarify how they work, and cover what type of organizations we recommend them to. Usually, this type of assessment isn’t going to be the best course of action for an organization […]
In this blog, we will explore some of the most common tools used by penetration testers when performing an assessment. A penetration test is designed to emulate an attacker trying to breach your network or gain access to sensitive data. So while some of these tools cost money, all are readily available on the Internet. […]
In this two-part blog series, we are looking at what you can expect after a penetration test. More specifically, what basic steps should you follow once you receive the report to start fixing the vulnerabilities uncovered. In the previous installment, we took a look at understanding the penetration testing report and coming up with an […]
So you have finally taken the plunge and had your first penetration test completed. Or maybe this is a yearly requirement, but for some reason you still aren’t getting the results you expected. Maybe you are running into hurdles securing your environment. For many, having a penetration test completed is an eye-opening experience that will […]
After performing penetration tests for a myriad of companies over the last decade, there is one thing that stands out above all others…. People suck at making passwords. At first I thought “how hard can it be?” But after working with company after company, and trying to improve their password security, I have realized that […]
Passwords are commonly one of the biggest weaknesses we find when performing a penetration test. It seems that no matter what password policy you have in place, users will still use Comany123, Spring2019, or a keyboard pattern for their password. An attacker can easily guess these and gain access to sensitive resources or even your […]
A penetration testing proposal or quote for penetration testing services serves two primary purposes. The first, obviously, is to provide a price for the requested services and clearly define the scope that those services will cover. Second, and maybe less obvious, is that a proposal acts as your first chance to begin vetting the penetration […]
In 2018, the last two states (Alabama and South Dakota) passed data breach laws. This means that as of January 2019, all 50 states now have a data breach notification laws requiring businesses to report data breaches affecting their organization. Similarly, a number of states (like New York did for financial companies) are beginning to […]
The first time getting any type of penetration test as an organization can be intimidating. You’re not sure about the process, you’re not familiar with the company doing the testing, and you may not even be sure on what success looks like. Today, we’ll explore 5 tips for your first penetration test to help you […]
Organizations have varying levels of concern when it comes to a penetration test. Many of them have been through this process many times before, have had a multitude of different tests performed, and are not concerned in the slightest that testing will cause any sort of disruption. On the other side of the spectrum, some […]
