In our previous segment (Bridging Your Gaps – Part 1), we covered network segmentation and egress filtering.  Now let’s focus on some of the gaps that can directly lead to access to your sensitive data. Social Engineering and Browser Security The attackers in the Lockheed Martin breach of 2011, leveraged social engineering along with stolen… Read more »

As part of our “Bridging Your Gaps” presentation series, we cover some of the more common gaps that we see and exploit while performing penetration testing for our clients. These gaps have also been leveraged in many of the high profile breaches that occurred during 2013-2014, so this helps to highlight the importance of addressing… Read more »

We (the Internet) are about 48 hours into the active response of the OpenSSL HeartBleed vulnerability (CVE-2014-0160). While there has been a lot of news on the topic and a few limited discussions on dealing with the threat, only a handful of articles are approaching the discussion on how to prioritize the threat posed by… Read more »

We are almost to the end of another year, and it has been a busy one for us here at DirectDefense.  In addition to performing our normal engagements, such as performing network and application penetration tests, we have also enjoyed a lot of positive feedback from our presentation series – Catch me if you Can. During… Read more »

From time to time, application developers implement strong security controls. A “strong control” might not capture exactly what we will be talking about today, but it does pose a huge problem for most application scanners. We have all seen a wide usage of one-time tokens in applications (aka nonce values) that are used to deter… Read more »

So the topic of your password policy is still weak is nothing new. Just doing a quick search for the phrase “your password policy is stupid” or “your password policy sucks” will result in numerous presentations and articles on the subject. While each of these articles and presentations have their merits, they all seem to… Read more »

Hi There – First, apologies for the lack of updates as of late. We have been swamped, but I saw this news article last week about the new FDA recommendations for Cybersecurity for Medical Devices and Hospital Networks, and could not let this go. If you read my last blog entry – Top Five Security Threats to… Read more »

Last month a new omnibus HIPAA privacy and security rule was released that increased the number of items to be audited as well as the potential penalties if compliance is not adhered to. You can read the new rules here – http://www.hhs.gov/news/press/2013pres/01/20130117b.html What is interesting to note is while the requirements or things to audit for… Read more »

So like many, it is that time of year to look back on the year’s events and reflect on things, while looking forward to the coming new year. What is interesting in our industry is the fact this is the time of year that everyone does their “Top 5,10,15, 20” events/gadgets/moments blogs/news articles about security… Read more »

So I was approached by several friends in the managed services and security operations services fields, last year, with questions about discovering an attacker that is already inside a corporate network. Specifically, both had recently had clients go through internal penetration tests and only had limited success in identifying the hacking attempts. After talking with… Read more »