What’s in Your [Security] Wallet?

No, this blog post isn’t about the credit cards or identity theft. It’s about the tools that, as a security professional, you should keep stored in your “security wallet.” Like any tradecraft, security professionals should have a set of tools, in this case, applications, websites, and resources, that they keep on-hand. These items become your… Read more »

Third-Party Vendor Relationships are Risky Business

Third-Party Vendor Relationships are Risky Business

A version of this blog is also posted on the MIST InfoSec Insider site: https://misti.com/infosec-insider-search. We’re surrounded by networks, many not our own. It’s next to impossible to run a business today without network interconnectivity. Even the smallest mom-and-pop shop has a website and hosting provider that connect to at least one computer holding client… Read more »

How to Build Your Own Mobile Application Testing Lab

How to Build Your Own Mobile Application Testing Lab

A key aspect of testing mobile applications is the ability to observe and modify network traffic. Learn how to use a router with modified firmware to perform HTTP/HTTPS-based traffic interception. 3 Methods for Intercepting Traffic 1. ARP cache poisoning Testers can use man-in-the-middle tools such as Bettercap to force mobile device traffic to a proxy… Read more »

Processor Bugs Ring in the New Year

New System Vulnerabilities You Need to Know About Researchers have disclosed vulnerabilities in the way processors are handling memory management while data is traversing the central processing unit of your system. The latest update on these vulnerabilities can be found at this post from Project Zero. Vulnerability Details: What You Need to Know There are… Read more »

Harvesting Cb Response Data Leaks for fun and profit

Carbon Black’s Cb Response product is one of the more popular endpoint detection and response (EDR) tools available in an ever-growing marketspace. However, as a function of how the tool is architected, it is also a prolific data leaker. This threat report blog will help security organizations understand how our vulnerability assessment experts harvested data… Read more »

Finding Gaps Within Your Endpoint Protection Solution

With CIA Hacking Methods Leaked, Should You Worry?

The news that WikiLeaks released hundreds of documents revealing the CIA’s methods for hacking into smartphones and other Internet-connected devices has received global attention. So, what does the average person need to do to protect themselves if they are an Apple, Android or smart home gadget user? Some vendors have been proactive in publicly disclosing… Read more »