Everywhere you look the past few days you read about OpenSSL. Recent news reported two vulnerabilities (CVE-2022-3602 and CVE-2022-3786) listed as ‘critical’ and initially comparable to the vulnerability Heartbleed. Since the initial reporting, these CVEs have been downgraded to ‘high’ so they are no longer the ‘Heartbleed’ status, but none-the-less, they are still important.  There…

As Penetration Testers (aka pentesters) we dig into the networks, applications, and devices of our clients. We dig deep to uncover security risks that stem from misconfigurations, software vulnerabilities, coding deficiencies, business logic flaws and more.  Our job is to see the unseen, think like an attacker, and identify the opportunities that attackers will leverage…

An attacker is inside your network right now. If that is true, how would you know? Many technologies are in place to protect the gateways or the network edges, and logs document the traffic moving across these gateways. But, what about the attackers that make it successfully into your network past the gateway defenses? Perhaps…

In the age of sophisticated phishing attacks and credential harvesting, multi-factor authentication (MFA) is a crucial part of any security program. It is often trivial for attackers to gain access to a user’s credentials through password spraying or phishing campaigns. Even though most organizations educate users regarding phishing threats, a percentage of employees will still…

The landscape of technology has changed drastically over the past two decades. Companies trying to do it all themselves is a thing of the past. SaaS, PaaS and IaaS are all the rage and organizations are adopting solutions to run many aspects of their businesses. With this evolution comes risk. Even as companies look to…

Many organizations have rolled out multi-factor authentication (a must) and other controls to protect their networks. Email threat detection is deployed and URL rewriting in place. Investments are made in antivirus, EDR, and threat detection solutions; vulnerability scanners are used to scan for known risks. Even with all the layers, technologies cannot protect your organization…

Recently there have been vulnerabilities out in the wild that have had security teams racing to patch systems and gather an inventory of their assets. We believe in being proactive. As with working out – It is easier to stay in shape and form good habits to keep you there then to get in shape.…

Our troops do not go into battle without the proper training, knowledge, or practice under their belts. They learn their roles. They practice as a unit. They learn about their opponents.  They perform test runs. They plan for all feasible scenarios.  The landscape of security today requires a similar tactic. Not only do security teams…

Do you have backups in place? Simple yes or no answer, or is it? In the past, backups were not necessarily seen as a security issue, but ransomware changed that. Backups, and the security of those backups, is now more important than ever. Backups have become Information Security’s best friend. But is simply having a…

It used to be that employees stayed at a company for a long time. People did the same job for years, and you could go to someone in-house and ask where something was or how it was done. Good, bad or indifferent, there was a ‘way’ things got done. In today’s day and age, with…

Everyday there are new cyber threats facing organizations. Often when an article makes its way to mainstream media, there is a flurry of action and response. This is often well intentioned, but many times is a poor use of resources. So how do we determine what is real and what is hype? The first answer,…