Category: Security

Improving Application Security Through Automated Testing

Improving Application Security Through Automated Testing

Turn Your Software Development Security into a Repeatable Engineering Process Companies have long viewed application security testing as a black art that’s dependent upon a small number of experts wielding arcane tools to find vulnerabilities and develop exploits. However, as the velocity of software development increases, the old way of running security tests becomes less… Read more »

What’s in Your [Security] Wallet?

No, this blog post isn’t about the credit cards or identity theft. It’s about the tools that, as a security professional, you should keep stored in your “security wallet.” Like any tradecraft, security professionals should have a set of tools, in this case, applications, websites, and resources, that they keep on-hand. These items become your… Read more »

Third-Party Vendor Relationships are Risky Business

Third-Party Vendor Relationships are Risky Business

A version of this blog is also posted on the MIST InfoSec Insider site: https://misti.com/infosec-insider-search. We’re surrounded by networks, many not our own. It’s next to impossible to run a business today without network interconnectivity. Even the smallest mom-and-pop shop has a website and hosting provider that connect to at least one computer holding client… Read more »

How to Build Your Own Mobile Application Testing Lab

How to Build Your Own Mobile Application Testing Lab

A key aspect of testing mobile applications is the ability to observe and modify network traffic. Learn how to use a router with modified firmware to perform HTTP/HTTPS-based traffic interception. 3 Methods for Intercepting Traffic 1. ARP cache poisoning Testers can use man-in-the-middle tools such as Bettercap to force mobile device traffic to a proxy… Read more »

Processor Bugs Ring in the New Year

New System Vulnerabilities You Need to Know About Researchers have disclosed vulnerabilities in the way processors are handling memory management while data is traversing the central processing unit of your system. The latest update on these vulnerabilities can be found at this post from Project Zero. Vulnerability Details: What You Need to Know There are… Read more »

Harvesting Cb Response Data Leaks for fun and profit

Carbon Black’s Cb Response product is one of the more popular endpoint detection and response (EDR) tools available in an ever-growing marketspace. However, as a function of how the tool is architected, it is also a prolific data leaker. This threat report blog will help security organizations understand how our vulnerability assessment experts harvested data… Read more »