As we’ve discussed previously, a host compliance audit is an assessment of the configuration of a particular system (workstation, server, or network device) or set of systems. The configuration settings are compared to published security standards, industry best practice, and the security engineer’s experiences to highlight potential vulnerabilities and misconfigurations that result in risks to […]
A host compliance audit is a type of security assessment that involves the manual inspection of a workstation, server, or network device by a trained security engineer in order to evaluate the configuration, hardening, and security controls applied to the target. Using a published best practice standard, like the Center for Internet Security (CIS) benchmarks, […]
Recently, we were asked by a client “what MFA is the best for an SMB?” We liked that question and thought others would benefit, so we decided to add it to our list of blog topics. Before writing that blog however, we decided we first needed a quick review of what multi-factor authentication (MFA) is […]
A crucial part of maturing your overall incident response capabilities is dry-running the process through what are known as “tabletop exercises.” Imagine security meets Dungeons & Dragons-style role playing. In all seriousness, incident response tabletop exercises are a great opportunity to practice your incident response process in a realistic scenario, from the documentation to the defined […]
We get asked this almost as much as how often should we get a penetration test completed. There are many motivators and moving pieces that can drive the timing of a penetration test. Generally, if you’re asking “when should my company schedule a penetration test” the answer is “now”! Coming up with a regular schedule […]
We can file this away as a million dollar question for technology leaders and executives. While there is no right or wrong answer to this question, we recommend an annual security assessment that includes penetration testing. There are also actions that can be take throughout the rest of the year between assessments to help secure […]
In this blog, we will explore three steps you can take to make your firewall more secure. Your perimeter firewall is your first line of defense against attacks. And while it is not a silver bullet, making sure it is as secure as possible should be a top priority for your security team. Having performed […]
A firewall configuration review is a great way for your organization to assess the security of one of the most pivotal pieces of technology in your organization. While any security professional will tell you just having a firewall doesn’t make you more secure and that it doesn’t perform any type of “silver bullet” functionality to […]
An Internal Penetration Test is conducted from within your network, taking the perspective of an attacker that has already gained a foothold by some other means (whether that is direct exploitation of a public facing system or via social engineering) or a malicious insider. This assessment uses a combination of automated and manual exploitation techniques […]
A normal security program will incorporate vulnerability scans and penetration tests to help measure the effectiveness of their security controls, but oftentimes doing a more detailed review of their key security devices is overlooked. The most important of these security devices is usually the firewall. A firewall configuration review takes a deeper dive into the […]
