This is officially blog number 300! Just to have some fun and learn a few lessons, let’s look at the movie ‘300’ and see if there are any lessons learned we can apply to information security. While this is more of a fun blog than anything else, there a few nuggets we can take away […]
Today’s security quick tip is brought to you by some API penetration tests I’ve completed over the past few weeks. One of the things I’ve noticed more and more as organizations are developing and implementing APIs as part of their overall application infrastructure is the presence of “greedy” or overly verbose JSON objects in HTTP […]
Back in September, we wrote a blog on the importance of using two separate accounts for administrators, one user-level and one administrative. If you haven’t read it yet, it does a great job of explaining why it is necessary and why it’s a security best practice. The lower-level user account should have limited permission and […]
Today, we look at 2 dangers of shared accounts. Many compliance requirements, for example PCI DSS, require users to have unique accounts and prohibits the use of shared accounts. However, rather than blindly complying with the requirement, let’s take a look at why this is important. First, shared accounts have shared passwords. In other words, […]
In today’s blog, we are going to take a look at a key concept in information security: nonrepudiation. Simply put, nonrepudiation is the assurance that someone cannot deny an action they took. This can apply to an email, for example. If the sender sends the message with a digital signature, this proves that the sender […]
The users who are in your domain administrators group have the keys to the kingdom. With few exceptions (non-Windows systems), they can access any system and any file in your network. This includes the privacy information, HR information, and intellectual property that you are trying to protect. As such, the domain administrators group must be […]
Let’s cut straight to the chase. In this blog, we are going to look at two VPN best practices to make sure you are secure in your use of these network tools. Your VPN is the gateway to your internal network, allowing anyone on the Internet who is able to authenticate to directly access your […]
APIs, or application programming interfaces, allow different platforms, apps, and systems to connect and share data with each other. They are used by IoT devices, mobile applications, traditional web applications, and almost every website that communicates directly with other applications. As a result, it is no surprise that the use of APIs has grown immensely […]
The National Credit Union Administration or “NCUA” was established to “provide, through regulation and supervision, a safe and sound credit union system, which promotes confidence in the national system of cooperative credit.” As one could imagine, IT infrastructure and the information security program is one of the critical pillars that are required to be audited. […]
Such a simple question, but it has many different answers, all of which can be important to your understanding of web application security. The Open Web Application Security Project (OWASP) is a non-profit organization with a simple mission: Improving the Security of Software. The organization is open to anyone, receiving contributions from security professionals and […]
