One of the questions we get most when at hiring events, conferences, trade shows, etc. is how can someone get into penetration testing or break into the industry as a penetration tester? There are many avenues to becoming a penetration tester, but today we will touch on a few strategies to help get your foot […]
We have clients reaching out for a penetration test with a myriad of different drivers for needing to complete the assessment. Sometimes, clients know what they need and why they need it. Other times, they are looking for coaching as to what they should get done and what that particular test will achieve. Today, we […]
Let’s cut straight to the chase. In this blog, we are going to look at two VPN best practices to make sure you are secure in your use of these network tools. Your VPN is the gateway to your internal network, allowing anyone on the Internet who is able to authenticate to directly access your […]
Today, we explore what the Financial Industry Regulatory Authority (FINRA) requires with regards to penetration testing. FINRA is authorized by Congress to protect America’s investors by making sure the broker-dealer industry operates fairly and honestly. FINRA has continued to strengthen their stance and recommendations on cybersecurity as the financial industry has evolved. Does FINRA Require […]
What is the Cybersecurity Maturity Model Certification or “CMMC”? How will the CMMC impact my business and what can I do to plan for the roll-out? What is the timing of the CMMC? Today, we explore all of these items in detail. What is the CMMC? The CMMC will be a new requirement for existing Department […]
What is the difference between HIPAA and HITRUST? That is a great question and something we are frequently asked when working with our healthcare clients and today we will walk through the differences at a high level. What is HIPAA? HIPAA stands for Health Insurance Portability and Accountability Act. In response to HIPAA of 1996, […]
As we continue our series explaining some of the most common web application vulnerabilities we encounter during penetration tests, we arrive at cross-site scripting (XSS). XSS comes in at number 7 on the most recent OWASP Top 10 release, so it is still an issue for a significant number of applications and organizations. Caused by […]
Does SOC 2 require penetration testing or vulnerability scanning? This is a great question and one that we get asked frequently. Today, we will explore the interpretations of the requirements and our recommended approach. What is SOC 2? Developed by the American Institute of CPAs, SOC 2 defines criteria for managing customer data based on […]
As we continue our mini-series addressing some of the most common web application vulnerabilities we see during assessments, we turn our attention to the broad category of authentication weaknesses next. The OWASP Top 10 identifies this category as number 2 on its list, meaning it is obviously well known and prevalent. So then why are […]
As we continue to try and share knowledge we’ve gained in our time performing penetration testing, we’re going to focus on another common web application vulnerability I keep running into. Authorization bypass is number 5 on the OWASP Top 10, further demonstrating that this continues to be a common issue plaguing web applications. The biggest […]
