Penetration tests can range from a simple test that takes 1 day to complete up to an assessment with multiple different penetration testing services that takes weeks to complete. A project manager is a vital role during a penetration test to ensure that everything goes smoothly, timelines are met, and ultimately the client gets the […]
One of the most common questions I get asked when people find out that I am a penetration tester is, “How did you get into this field?” More accurately, they are asking how they can get into penetration testing themselves. As a managing partner of a penetration testing firm and a penetration tester myself, this […]
If you are in IT and looking to try to get into information security, the first place to start is by obtaining industry certifications. As I currently have my OSCP, CISSP, C|EH, GSEC, GCIH, PCIP and am working towards my CISA, I figured I was as good as any to review the certifications out there […]
Organizations are starting to realized, given the news regarding data breaches over the past couple years, that your security perimeter can be as strong as Fort Knox, but all it takes is one employee to click on a malicious link and none of that matters. Everything you have done to secure your network and all […]
All good (or in some cases bad) things come to an end. In the ever-changing world of technology, this is even more true. As Microsoft (or any other vendor) works on pushing new technology out, they will often mark older operating systems and applications as “end-of-life.” Some organizations, particularly those with a small IT budget, […]
From time to time, when we see a particular vulnerability that keeps showing up over and over again during penetration testing engagements, we like to write about it and help spread awareness. This can help explain the issue, the subsequent risk it presents to your organization, and how to successfully remediate the issue or at […]
In our last blog on tackling the broad topic of how do I protect my company’s sensitive information, we reviewed several ways to get started with this process. Before you can protect your sensitive data or “crown jewels”, you’ve got to know what you have and where it lives. We covered creating an asset inventory […]
Today, we’re going to try and tackle the million dollar question of how to protect your organization’s sensitive data. Keep in mind, this isn’t going to be a single, magical answer. There is no silver bullet when it comes to security, but when it comes to tackling a broad topic like this, we’ll try and […]
According to a survey conducted by Wombat Security, 76% of companies in 2017 experienced phishing attacks. Not only that, but social engineering is the most prevalent way an organization gets breached. Think about it, you probably spend a lot of time and money shoring up your perimeter security posture. You are diligent about ensuring systems are patched and up-to-date, […]
In this blog, we are going to talk about some of the disadvantages of a bug bounty program compared to a penetration test. Don’t get us wrong, there are many advantages of a bug bounty program, in fact, we just did an entire blog dedicated to the subject. While Triaxiom Security is a company founded […]
