The National Credit Union Administration or “NCUA” was established to “provide, through regulation and supervision, a safe and sound credit union system, which promotes confidence in the national system of cooperative credit.” As one could imagine, IT infrastructure and the information security program is one of the critical pillars that are required to be audited. […]
Throughout our assessments, we get the opportunity to work with a wide variety of clients and see a ton of different web applications. When performing web application penetration testing in particular, there are a number of issues that we notice over and over again, regardless of the development language, application architecture, etc. If we see […]
There has been a lot of talk recently with regards to the potential implementation of a US Cyber Civilian Reserve. Think of this as something comparable to the Civil Air Patrol and Coast Guard Auxiliary, but for cyber experts. The thinking is that these folks can be called upon for immediate action for municipalities, schools, […]
Shadow IT is a somewhat recent and fancy term that has been given to any software, hardware, or technology in general that is used within an organization outside the purview of the IT department. Anything that isn’t sanctioned and centrally controlled by the organization’s IT department or that they don’t know exists would fall into […]
After receiving a seemingly innocent call from your “IT department” to help test a new company portal, you worked with the developer on the phone and diligently followed his prompts as quickly as possible so you could get back to work on this memo your boss wanted. A few hours later, it dawns on you. […]
On September 24th, 2019, Senate Bill S.315 aka the “DHS Cyber Hunt and Incident Response Teams Act of 2019” was passed unanimously. The legislation seeks to amend the Homeland Security Act of 2002, authorizing DHS’ National Cybersecurity and Communications Integration Center (NCCIC) to permanently operate cyber hunt and incident response teams that can aid federal […]
We discussed last week that open source intelligence, or OSINT, is one of the most important phases of an assessment for a penetration tester. It is this part of a test where an engineer is gathering background information about an organization that is publicly available, ranging from the business they are in, to the types […]
There is no question that administrators need an account with elevated permissions so they can effectively manage and care for the domain and users. For this blog, let’s call that account the “Superman” account. However, security best practice is increasingly calling for administrators to have a second account that they use to perform their daily […]
On August 3, 2018, Governor John Kasich signed Senate Bill 220, also known as the “Ohio Data Protection Act“. Unfortunately, this caused some confusion for businesses operating in Ohio, so today, we will discuss the act and how it may apply to you. This act IS NOT meant to lay forth a minimum security requirement for businesses in Ohio. In fact, […]
Penetration testing requests for proposals (RFPs) or requests for quotes (RFQs) can be a great way to bid on and potentially win penetration testing projects as a business. Many pen testing vendors rely on capturing business solely, or mostly, through RFP submissions. Most RFPs are for government entities such as local municipalities, state run schools, […]
