Resources

Blog

The Top 10 Tripwire Blogs of 2018

It's been a fantastic year on The State of Security blog. We've seen a real plethora of high-quality articles and here are my 10 favorites! A Google Cloud Platform Primer with Security Fundamentals | By Ben Layer Though less well-known than Microsoft Azure and Amazon Web Services, Google Cloud Platform currently makes up five percent of the cloud...
Blog

Doxxing: What It Is How You Can Avoid It

Doxxing means publishing private information about someone online to harass or intimidate them. It has ruined reputations and caused untold distress to hundreds of people. On occasion, doxxing has resulted in injury or even death. Being doxxed can have serious consequences for your safety and privacy. How can you prevent it? Doxxing and...
Blog

How to Add HTTP Security Headers in WordPress

If you own a WordPress site, then you should be careful about your website security. To successfully run a blog, business or online store, you need to make sure your website is totally safe. Customers visit your website, purchase products and pass sensitive information like passwords, credit card details etc. If there is a place to infiltrate to...
Blog

Phishers Bypassing 2FA to Compromise Google and Yahoo Accounts

Phishers are bypassing common forms of two-factor authentication (2FA) in a campaign targeting hundreds of Google and Yahoo accounts. In a new report, Amnesty International uses several attack emails sent to it by Human Rights Defenders (HRDs) spread across the Middle East and North Africa to analyze the campaign. A typical attack email in this...
Blog

Tripwire Patch Priority Index for December 2018

Tripwire's December 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Microsoft's Internet Explorer and Scripting Engine. These patches resolve nine vulnerabilities, including fixes for Memory Corruption and Remote Code Execution (RCE)...
Blog

Latest Version of Tripwire IP360 Now Certified To Meet Most Current Common Criteria Certification Standards

Tripwire has demonstrated its ongoing commitment to meeting U.S. government and internationally recognized security standards by achieving the most current Common Criteria standards for its latest version of Tripwire IP360’s 9.0.1, specifying the certification as “Evaluation Assurance Level 2 augmented with Flaw Remediation” (EAL2+). VM and SCM for Federal Agencies Tripwire IP360 and Tripwire's...
Blog

Using ATT&CK As a Teacher

Over the past few years, I've had the pleasure of welcoming interns on our security research team. One of my goals was to pass on knowledge of security to these folks and pique their interest in (a career in) security. The goal of any teacher is to pass on their knowledge to the younger generation, in essence creating a miniature version of...
Blog

NASA Notifies Employees of Potential Data Breach

The National Aeronautics and Space Administration (NASA) has warned its employees of a data breach that might have compromised their personal information. On 18 December, the agency's Human Resources Messaging System (HRMES) sent out a message to all employees informing them of a potential security...
Blog

Don't Let DNS Flag Day Become Your DNS Doomsday

News Flash: Your DNS might be broken, and you don’t even know it. But wait? How could I not know my DNS is broken? Well, the answer lies in the history of the DNS standards and what has become the cobbling together of features within authoritative and recursive DNS server software. It all started going south about 19 years ago with the introduction...
Blog

Malware Using Memes Posted on Twitter as C&C Service

Researchers have observed a new threat using malicious memes posted on Twitter to receive command-and-control (C&C) instructions. Trend Micro observed that the malicious activity begins after a threat detected as "TROJAN.MSIL.BERBOMTHUM.AA" executes on an infected machine. As of this writing, the Japanese multinational digital security firm had not...
Blog

How Do You Measure Your Investment in Security?

When evaluating enterprise security tools for their effectiveness, it can be challenging to find the right model for best calculating your Return on Security Investment (ROSI). Just a few years ago, the potential cost attributed to a security breach was likely to be primarily related in the assessed financial cost into a business’ reputation, with...
Blog

Office 365 Phishing Attack Using Fake Non-Delivery Notifications

A new phishing attack is using fake non-delivery notifications in an attempt to steal users' Microsoft Office 365 credentials. SANS ISC Handler Xavier Mertens discovered the attack while reviewing data captured by his honeypots. The attack begins when a user receives a fake non-delivery notification from Microsoft such as the one shown below: ...
Blog

5 Key Components Every Company Should Have in Their Privacy Policy

As a business owner, you’re no stranger to the myriad moving parts that keep the day-to-day business going. In all the bustle, it can be easy to overlook important tasks such as creating a privacy policy because you’re unsure where to start or which elements to include. Earlier this year, the EU’s GDPR—the General Data Protection Regulation—went...
Blog

What Is Smart Metering? Uses, Benefits and Dangers

Utilities can be a pricey monthly expense for many households and businesses, with the average cost for households in America coming in at over $420 every month. Getting on top of utility usage, especially electricity—which typically constitutes the largest part of that monthly expense—can help save money, but it can also help conserve resources and...
Blog

'Tis the Season to be a Prudent Shopper

Holiday shopping is in full force – 'tis the season to be shopping, some would say. Unfortunately, during seasonal times such as Thanksgiving, Christmas and New Year’s Eve, while we are preparing to spend time with family and friends, we must be vigilant when shopping and doing holiday business online. Malicious cyber actors know that e-commerce...
Blog

Unlocking Android phones with a 3D-printed head

Not everyone is a fan of it, but it's hard to argue convincingly that facial recognition isn't going to play a role in the future of technology. The newest Apple iPhones and Android smartphones have built-in facial recognition features that can unlock your device, but you would be wrong to think that the reliability and accuracy of the features is...