When going through one of our security gap analyses, we are often asked to clarify why the interviewee is being asked if they have an asset inventory in place. Asset inventories are more than just a spreadsheet to track your hardware. According to the HIPAA Security Rule Crosswalk to NIST, managing assets enables “the organization to […]
How do I fill out a vendor security assessment questionnaire? As company’s are beginning to become more security focused and realize that suppliers/vendors represent potential security threats, we are constantly being asked how to fill out a supplier assessment related to information security. While we think this is great for the security industry, it often […]
Is there such thing as an “approved” penetration testing company? This is something we get asked quite often. Unfortunately, there is no overall industry accreditation that is required for firms to be able to conduct penetration testing. There are, however, certain designations that firms can receive for certain types of audits that may require penetration […]
Spoiler alert! In this blog, I will not be giving you a silver bullet for security or tell you the exact MFA solution you should use for your for small business. Rather, we will look at the key things you need to consider when purchasing and implementing multi-factor authentication (MFA). Before we get into the […]
Recently, we were asked by a client “what MFA is the best for an SMB?” We liked that question and thought others would benefit, so we decided to add it to our list of blog topics. Before writing that blog however, we decided we first needed a quick review of what multi-factor authentication (MFA) is […]
We get asked this almost as much as how often should we get a penetration test completed. There are many motivators and moving pieces that can drive the timing of a penetration test. Generally, if you’re asking “when should my company schedule a penetration test” the answer is “now”! Coming up with a regular schedule […]
We often get asked for references for our work. As you would expect, if you are hiring someone to hack your company or determine where your security vulnerabilities lie, you want to make sure they can be trusted. As part of the screening process, we highly recommend that you vet penetration testing partners via professional […]
Update: Amazon has removed their requirement for an AWS Penetration Testing Request Form to be completed prior approval for penetration testing on most services as of March 2019. This means the form explained in this article is no longer necessary to submit prior to having a penetration test performed. For all the details and a […]
Many of our clients are getting penetration tests not only to improve their security posture, but also to use the results to satisfy a client’s requirements or integrate the results into their sales materials. We get asked quite often how other organizations handle communicating penetration testing results, while avoiding divulging sensitive information. Below, we highlight […]
Information security and corporate network defense is tough. In a constantly changing and advancing industry, it can be hard to figure out where to start when you’re trying to build or improve a corporate security program. Standards and benchmarks are not a sexy or exciting topic, but when you need a starting place to figure […]
