Tales From the Road: Who’s in the Driver’s Seat of Your Physical Security?
07.27.22DirectDefense conducted a physical security test at a utility company and was able to have their run of the business – and a Tesla.
07.27.2207.27.2207.27.22
Tales From the Road: BESS and SCADA Network Assessment — Is Your MQTT Traffic Secure?
07.13.22DirectDefense assessed the security of MQTT traffic – the transfer of data to a SCADA system, ultimately controlling critical infrastructure.
Apex Labs – DirectDefense’s Greg Leonard to Instruct SANS Institute Secure DevOps Course
06.01.22Students will learn the fundamentals of DevOps and how DevOps teams can build and deliver secure software. In a time when the drive for technology efficiencies has left security in the dust, organizations focused on developing code are now starting to realize the true importance of what secure DevOps means. DevOps security or DevSecOps is… Read more »
Tales From the Road: What Effective Endpoint Security Looks Like
04.20.22Well-configured endpoint security is critical to protect against a ransomware attack or a security breach, and requires some extra attention.
The Emotional Toll of Incident Response Events
03.31.22Navigating the 5 Stages of Grief Following an Incident Response Event Are you a victim of a data breach and are you feeling signs of grief? You’re not alone. As an incident response professional, I have met many different types of corporate staff, from the IT staff to the C-suite. Unfortunately, it was probably on… Read more »
Assessing Microsoft’s Social Engineering Attack
03.25.22Breaking Down Microsoft’s Response to the Lapsus$ Gang’s Social Engineering Compromise Microsoft has done an excellent job in explaining the social engineering breach that originated against them from the Lapsus$ group. In their recent blog post, they detail the Lapsus$ attack and how access was obtained, as well as provide some decent recommendations to enhance… Read more »
Tales from the Road: The Anatomy of Password Attacks
03.16.22It’s time to rethink your password policy to prevent modern password attacks. If you think your company’s policy of requiring passwords to have a minimum length of eight characters, in addition to other complexity requirements, is sufficient to effectively prevent modern password attacks, think again. Our client, a global corporation with business units in more… Read more »
Tales From the Road: Got Critical Infrastructure?
03.08.22Avoid these three pitfalls that are inherent to most SCADA systems that manage critical infrastructure. A multinational corporation enlisted the services of DirectDefense to perform a security assessment of the organization’s newly-developed battery energy storage control (BESS) that would enable the company’s vendors and integrators to manage the voltage and power output for massive batteries.… Read more »
PolicyKit Vulnerability Exposed After 12 Years: Why You Need to Patch Your Linux Today
01.26.22Security company Qualys has uncovered a dangerous PolicyKit vulnerability. Learn how to remediate and patch Linux.
Planning PCI in the Cloud
01.05.22What PCI Compliance for Cloud Data Looks Like: Challenges and Maintenance Moving to the Cloud is not as simple as “Just put it in the Cloud and we won’t have to do PCI.” The Cloud can reduce PCI Scope but it can also add to the complexity of maintaining PCI compliance. As we will discuss,… Read more »
