In 2015, Tripwire partnered with FIRST Robotics to bring on summer interns from local high schools. Our goal was to teach the students about various aspects of information security on both the offensive and defensive side. The goals I set out for our interns in 2015 were a bit lofty, to say the least. I had planned on teaching them about the various...

Looking at the cyberthreat landscape, millions of new devices come online every day. But there’s a shortage of qualified cybersecurity workers to protect those devices once they come online. Additionally, in almost every case, it takes minutes or less to compromise them. Simply running more vulnerability scans to collect more data and generating more...

It’s hard to believe that in such a relatively short period of time, smartphones and other mobile devices, such as tablets, have become so tightly woven into both our personal and work lives. And unlike desktop or laptop computers that are usually company-owned, personally-owned mobile devices are often filled with company related apps, data, email...

Today’s VERT Alert addresses 14 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-689 on Wednesday, September 14th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy...

Confidentiality, Integrity and Availability – those are the three pillars of the CIA triad model for information security. Here's something you might not have known: in reverse order, those same pillars apply to IT Operations. Think about it. In a world of agility and enablement, the availability, integrity and confidentiality of the systems and...

Firewalls are staples of network security, and for years, they’ve played a part in keeping networks safe by restricting both incoming and outgoing network traffic. Along with antivirus software, they are among the oldest and most widely used cybersecurity tools. But what role should firewalls play in 2016 and beyond? One thing is clear: even though...

“Should we fear hackers? Intention is at the heart of this discussion.” – Kevin Mitnick In cybercrime, truth is in the eye of the beholder. And if in any other research or business field it is somehow easy to define cause and consequence, in cybercrime it is not. Perhaps it is due to its complexity and multi-layered character that cybercrime has...

We all know that cybercrime is increasing and likely to jump from a $75 billion problem last year to a $170 billion problem in 2020. Most will argue that this out of control spiral is unavoidable. It’s just the nature of the game. We will always be one step behind – that much is true. At the rate we are traveling, though, we are slipping behind by...

Crowd-sourced review service Yelp says it will award researchers up to 15,000 USD for reporting exploits as part of its newly public bug bounty program. The company successfully ran a private bug-bounty program for the past two years, during which it worked with private researchers and bug bounty hunters to fix as many as 100 vulnerabilities. But to...

Apple issued critical updates for OS X Yosemite and El Capitan on Thursday to patch security vulnerabilities resembling those discovered on iOS 9.3.5 earlier this week. Dubbed Trident, the three zero-day vulnerabilities (CVE-2016-4655, CVE-2016-4656 and CVE-2016-4657) could allow an attacker to silently jailbreak an iOS device and spy on victims,...

You, a creative entrepreneur with a great idea, finally launch a business. As a startup, having your own website is essential in conducting business. Startups must always take extra precaution when it comes to their web security. Because startups are the perfect targets for hackers, your website should be protected as soon as it is ready to go live....

We are moving into an era of inter-connectivity with billions of devices, including a previously disconnected industry of automotive vehicles. Vehicles were not designed with computer security in mind, and that worked just fine for the last few decades. However, now we are at a point where we can take an "unhackable" 1997 Honda Civic and add in a...

Industrial control system (ICS) security is a growing concern for organizations around the world. On the one hand, research suggests that vulnerabilities and exposures are increasingly jeopardizing the security of ICS assets. In their report Overload: Critical Lessons from 15 Years of ICS Vulnerabilities, the FireEye iSIGHT threat intelligence team...

Cisco has confirmed the legitimacy of two exploits found in a data dump of code released by the Shadow Brokers hacker group. On 13 August, the mysterious hacking group announced an auction of files allegedly containing exploit code used by the Equation Group, a sophisticated threat actor which leverages unknown vulnerabilities in multiple vendor...

An organization's computer network is never fixed. It is constantly changing. To illustrate, as a company continues to grow, it might adopt a different mission that requires the installation of new endpoints onto its network. Additionally, with the detection of new exposures, security teams will need to update all critical devices running the...

It's just a week since Apple announced its first-ever bug bounty for researchers who find vulnerabilities in its widely-used software and hardware, in the hope that it can provide better security and privacy to its millions of customers. The Cupertino-based company made headlines for its belated entry into the bug bounty marketplace, offering up to ...

I was incredibly happy with the initial release of CVSSv3. While it wasn’t perfect, it was a huge improvement over CVSSv2 in that a couple of the weaknesses in v2 were removed. The first of two particularly great changes was the language related to the network attack vector in the specification document:A vulnerability exploitable with network access...

To protect against evolving digital threats, more and more organizations are employing endpoint detection and response (EDR) systems on their computer networks. EDR consists of six crucial security controls. The first two, endpoint discovery and software discovery, facilitate the process of inventorying each device that is connected to the network and...

Today’s VERT Alert addresses 9 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-684 on Wednesday, August 10th. EASE OF USE (PUBLISHED EXPLOITS) TO RISK TABLE Automated Exploit Easy ...

The Internet of Things (IoT) is slowly taking over consumer markets in every category, from coffee makers to fitness trackers. Yet while smart automation might seem like the ideal for consumer convenience, when it comes to home security systems, connecting to the Internet can lead to increased vulnerability. In this article, we take a look at some...