Category: Security

CSRF

CSRF in the Age of JSON

The Complexities Created by Using JavaScript Object Notation to Transfer Data Among the web application vulnerability tests that we perform at DirectDefense is an application security assessment for CSRF. CSRF, or Cross-Site Request Forgery, is an attack that takes advantage of the predictability of requests and browsers’ automatic submission of session cookies to perform unintended… Read more »

We are here

We Are Here to Help

Free Cybersecurity to Combat Threats Posed by COVID-19 Don’t miss an event that could be putting your organization’s security at risk. During this time of heightened cybersecurity threats, we are offering a FREE 30-day trial of ThreatAdvisor. Built on the knowledge of security consultants and penetration testers with more than 50 years of experience in… Read more »

The Security Attacks of 2019: A Year in Review

Revisiting the Security Threats That Marked 2019 and How They Were Managed Wow, what a year it has been! Security attacks in 2019 were marked by a resurgence of Ransomware attacks, business email compromise (BEC) attacks, and the discovery of painful blind spots in existing security programs for our new, and in some cases older,… Read more »

Information Security Predictions for 2019

Assessing the Successes (and Failures) of Organizations’ Implementations of Security Orchestration and Automation Response Solutions As 2018 comes to a close, we must look at the information security and managed services trends already established this year, and those on deck for 2019. To get things going ahead of the new year, we thought we would… Read more »

What’s in Your [Security] Wallet?

No, this blog post isn’t about the credit cards or identity theft. It’s about the tools that, as a security professional, you should keep stored in your “security wallet.” Like any tradecraft, security professionals should have a set of tools, in this case, applications, websites, and resources, that they keep on-hand. These items become your… Read more »

Third-Party Vendor Relationships are Risky Business

Third-Party Vendor Relationships are Risky Business

A version of this blog is also posted on the MIST InfoSec Insider site: https://misti.com/infosec-insider-search. We’re surrounded by networks, many not our own. It’s next to impossible to run a business today without network interconnectivity. Even the smallest mom-and-pop shop has a website and hosting provider that connect to at least one computer holding client… Read more »

Processor Bugs Ring in the New Year

New System Vulnerabilities You Need to Know About Researchers have disclosed vulnerabilities in the way processors are handling memory management while data is traversing the central processing unit of your system. The latest update on these vulnerabilities can be found at this post from Project Zero. Vulnerability Details: What You Need to Know There are… Read more »