Our last post in the “Turn It Off!” blog series discussed some of the most common and yet unnecessary features that can make your environment more vulnerable, including JBoss JMX consoles, server banners and the Apache HTExploit. These risks are often encountered by our Vulnerability and Exposure Research Team (VERT), even on well-defended networks and many of which have been around for quite...

You see that USB stick in your hand? The one that your anti-virus software claims is squeaky-clean and free of any malicious code? Well, maybe it’s not quite as simple as that.

Download a Python based detection script for CVE-2014-0224 here.

I have done is the most comprehensive meta-analysis on the security world’s view of VPN split tunneling. Will it change my IT team’s mind? Let’s find out…

This guide assumes that the reader has a NETGEAR branded wireless router and knows it’s address on the network. If you have forgotten the administrative password for your device, it may be necessary to perform a factory reset as outlined in this NETGEAR knowledge base article and then to login with the default password. Please note that while...

Tripwire has announced the results of an extensive analysis of security vulnerabilities in Small Office/Home Office (SOHO) wireless routers.

To minimize wireless attacks, here are six basic router tips anyone should include in their security strategies/training protocols.

In preparation for my upcoming talk at BSides SF about finding vulnerabilities, I would like to share today some insights regarding two common types of vulnerabilities which leverage web browser in two unique ways. The goal of these vulnerabilities is quite different however. One is used to run untrusted code while the other is used to hijack authentication. The combined effect of these issues...

The next item to tackle is the overall security architecture – and this includes several things. But let me first state the disclaimer that of course it is imperative that the correct governance and policies are in place and that technology can’t replace those things. But, it is also clear that however sophisticated, no paper document or process design will block an attack in the meantime until...

With the Target data breach, many are wondering how criminals can profit from the use of the stolen credit cards. Here's how they do it.

“We live in a world where we’re ceding a lot of our power to other companies,” said Bruce Schneier (@schneierblog), security blogger and author of “Liars and Outliers” in our conversation at the 2013 RSA Conference in San Francisco. Schneier was referring to companies such as Google and Facebook that control our data as well as companies that control our devices, such as Apple. “These companies...

When most people think of penetration testing, they think of a simulated external attack where the tester tries to break into a network remotely. Companies focus most of the security spending and policies on keeping hackers out remotely, from firewalls and other security hardening appliances, software and tools. However, given the proliferation of mobile devices in the workplace and use of Wi-Fi...

Tips from six CSOs/CISOs from varied industries who have actually applied risk-based security management to their business.

Last week, I sat in on a briefing by a guy who calls himself “Four” who happens to be involved in intrusion detection for Facebook. He shared some interesting perspective at the Black Hat conference through a discussion of ”Intrusion Detection Along the Kill Chain.” The information Four presented is based on the work done by Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin, Ph.D of Lockheed...