Resources

Blog

The Digital Deciders and The Future of Internet

Recently, the nonpartisan think tank New America published a report called “The Digital Deciders: How a group of often overlooked countries could hold the keys to the future of the global internet." The purpose of this report – authored by Robert Morgus, Jocelyn Woolbright and Justin Sherman – is to survey how nations around the world approach...
Blog

What Type of Vulnerabilities Does a Penetration Test Look For?

Penetration testing is becoming increasingly popular as organizations are beginning to embrace the need for stronger cybersecurity. But there are still too many businesses that don’t fully understand the benefits of regular security testing. Pen testing is vital for any kind of organization with an IT system or website. A recent survey of...
Blog

US charges Iranian hackers for SamSam ransomware attacks

Authorities in the United States have charged two people in connection with a series of notorious ransomware attacks. According to the Department of Justice, 34-year-old Faramarz Shahi Savandi and 27-year-old Mohammad Mehdi Shah Mansouri were the masterminds behind attacks against more than 200 networks since 2015. Unlike normal ransomware attacks ...
Blog

Tripwire Patch Priority Index for November 2018

Tripwire's November 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Microsoft's Internet Explorer, Edge and Scripting Engine. These patches resolve 13 vulnerabilities, including fixes for Memory Corruption, Elevation of Privilege (EoP),...
Blog

Cybercrime: There Is No End in Sight

Whoever said “crime doesn’t pay” hasn’t been following the growth of cybercrime across the globe. A thriving underground economy has evolved over the past decade to become a massive industry. Estimates in the Web of Profit research paper show cybercriminal revenues worldwide of at least $1.5 trillion – equal to the GDP of Russia. If cybercrime was a...
Blog

The Challenges of Managing Third-Party Vendor Security Risk

It’s no longer enough to secure your own company’s infrastructure; you now must also evaluate the risk of third-party vendors and plan and monitor for breaches there, too. Data breaches are reported in the news all the time, and more than 60 percent of them are linked to a third-party. When you’re a business owner, that is a scary statistic. Third...
Blog

Worm Using Removable Drives to Distribute BLADABINDI Backdoor

A newly detected worm is propagating through removable drives to distribute a fileless variant of the BLADABINDI backdoor. In mid-November, researchers at Trend Micro first observed the worm, which the security firm detects as "Worm.Win32.BLADABINDI.AA." They're still investigating the threat's exact method for infecting a system. But after...
Blog

Catching Configuration Changes that Can Lead to Data Exposure

Amazon’s new security issue, which came to light just days before one of its biggest sale events of the year, is making recent headlines. And whilst it probably won’t stop the online retail giant from achieving a profitable Black Friday and Cyber Monday this year, it certainly will make many users stop and think. Though it’s still early in the...
Blog

NIST Framework for Critical Infrastructure Cybersecurity

Four years after the initial iteration was released, the National Institute of Standards and Technology (NIST) released version 1.1 of the Framework for Improving Critical Infrastructure Cybersecurity. The framework was initially developed to be a voluntary, risk-based framework to improve cybersecurity for critical infrastructure in the United...
Blog

German Social Media Provider Fined €20K for Data Breach

A German social media provider received an order to pay a €20,000 fine for a data breach that occurred in the summer of 2018. Knuddels.de (Source: Spiegel Online) On 22 November, the regional data protection watchdog LfDI Baden-Württemberg announced that it had imposed the fine on a local "social...
Blog

Rooted in Security Basics: The Four Pillars of Cyber Hygiene

The term “cyber hygiene” pops up frequently in articles, blogs and discussions about cybersecurity. But what does it really mean? Some say it is an ill-defined set of practices for individuals to follow (or ignore). Others say it is a measure of an organization’s overall commitment to security. Still others – and I am among them – think of “cyber...
Blog

SIM swap! Man charged after million dollar cryptocurrency theft

San Francisco resident Robert Ross first realised something odd was going on when his iPhone lost its signal on 26th October. But his cellphone signal wasn't all that Ross had lost. Within minutes he had also lost his entire $1 million life savings, including the money he had stashed away for his two daughters' college education. According to media...
Blog

Countering Espionage: An Enterprise Risk Management View

I am neither a political scientist nor a historian. However, I am conscious of some certain past events in human history which had political impacts and also influenced the course of history as we know it. Some say such events occurred on the basis of social, political and historical backgrounds and factors, whilst others pointed out to the certain...
Blog

Two Young Men Jailed for Involvement in TalkTalk Data Breach

Two young men received prison sentences for helping to perpetrate a data breach at the UK telecommunications provider TalkTalk. On 19 November, Judge Anuja Dhir QC at the Old Bailey sentenced Matthew Hanley, 23, to 12 months in prison. She handed down a slightly lighter sentence of eight months in jail to Connor Allsopp, 21. Judge Dhir explained...
Blog

IoT Purchasing Checklist

A few weeks ago, I had the opportunity to speak at SecTor on a topic that I’ve been interested in bringing attention to for a while, the shifting IoT market. You can view the entire presentation online; however, I was asked if the checklist that I present was available via any other means. The following is the IoT Purchasing Checklist that I...
Blog

Fuzzing PHP for Fun and Profit

PHP is probably the single most prevalent server-side scripting language on the web. PHP has been the de facto choice for popular blog platforms like WordPress, Joomla and Drupal, which makes it a very attractive target for a wide range of attackers. It is also a very ideal system for demonstrating the power of American Fuzzy Lop (AFL) to identify...