Blog

In today’s dynamic threat landscape, relying solely on Common Vulnerabilities and Exposures (CVEs) to assess the exposure and the likelihood…

It’s May, baseball is in full swing and schools are nearly out for summer vacation. This month we take a…

April is here, spring has arrived and everyone in the lower 48 of the United States got to witness a…

See Hidden Security Trends. Make Smarter Choices. Ever feel like you’re flying blind when it comes to your security posture?…

Go Beyond the CVSS Score In the relentless fight against cybercrime, security analysts face an avalanche of vulnerability data. Each…

Unmask the Hidden Forces Shaping Your Security Posture Every organization battles a relentless tide of vulnerabilities. The fight to identify,…

March may be absolute madness for the NCAA and people in bunny suits, but it was a fairly quiet month…

Security Data Analysis is Hindering Vulnerability Management Program Effectiveness Vulnerability management is a vital process for any organization that wants…

February 2024 is off to a ripping start for security research. This month we’re focusing on a piece of open…

Summer 2021 It was in the summer of 2021, in the middle of COVID. Isolation and testing remained in effect,…

The U.S. government this week said the Chinese state-sponsored hacking group known as Volt Typhoon had been embedded into some…

Vulnerability remediation is one of the most challenging and critical aspects of vulnerability management. It involves not only identifying and…

Happy New Year! We open up 2024 with an interesting mix of vulnerabilities, some of which have been patched for…

Happy Holidays! As we close out 2023 we do it with a bit of deja vu (depending on how sharp…

The holiday season has officially arrived, but that hasn’t slowed down security research. November featured some seriously cool exploits and…

We are excited to announce the release of a new and improved NopSec platform – NopSec Cyber Threat Exposure Management….

September was an exciting month for NopSec as we hosted our Customer Advisory Board meetings in New York City. Thanks…

Summer is slowly cooking everyone into air conditioned spaces as vacations wind down and school winds up. August featured some…

Cyber threat exposure management (CTEM) tools are a new technology replacing traditional vulnerability prioritization tools (VPT). They were created to…

July was a busy month for vulnerability research. We had the opportunity to be picky about our curated selection of…

NopSec is proud to announce it has successfully completed the System and Organization Controls (SOC) 2 Type II examination in…

It’s finally summer! That means kids are out of school and vacations are in full swing, that includes Security Researchers….

May was a rather quiet month for security research, but an excellent write up filtered to the masses from the…

When evaluating any software solution for purchase, ROI is one of the most crucial parts of that evaluation. Without communicating…

NopSec is proud to announce the release of a new feature this week aimed at enhancing our users’ workflows! We…

April was a busy month for Microsoft. Patch Tuesday introduced critical Windows fixes to address a pair of remote command…

In March 2023, security researchers identified a number of critical vulnerabilities that could be exploited by attackers to gain access…

Another day goes by, another latest and greatest security breach affects the cryptocurrency world. The attacks range from phishing campaigns…

So, you’re looking to take your vulnerability management game to the next level with a vulnerability prioritization tool (VPT). Well,…

Under the umbrella of risked-based vulnerability management (RBVM) live a host of tools who’s applications correspond to various stages of…

NopSec has been in the risk-based vulnerability management (RBVM) game for 10 years now. Over the course of this decade…

In this month’s trending CVEs we have a number of patches released by Microsoft to address critical vulnerabilities identified in…

When it comes to cybersecurity, there are two points of view to always consider – the external and the internal….

If you’re new to cybersecurity technology or looking to mature your program you’ll quickly come across vulnerability prioritization tools in…

Happy New Year! In this month’s trending CVEs ManageEngine takes the top spot with yet another unauthenticated remote command execution…

Happy holiday season! December was off the chains, literally. Microsoft released a security update to address a remote command execution…

Vulnerability Management programs produce a lot of data about the vulnerabilities and remediation efforts. Due to this, it is very…

November 2022 has not been a boring month indeed! One of the most prominent and powerful cryptocurrency exchange – FTX…

Overview NopSec provides the most accurate risk-based vulnerability prioritization across an organization’s entire attack surface. One key element of this…

Happy Thanksgiving! November was a surprisingly slow month. It’ll be perfect for some light reading over a thanksgiving break. In…

What is Full Stack Vulnerability Management? Full stack vulnerability management utilizes a variety of vulnerability scanner types to identify and…

Vulnerability management’s cornerstone is largely going to revolve around setting up and managing your infrastructure scanner in order to find,…

Choosing a risk-based vulnerability management (RBVM) solution can be daunting. Where do you begin? What features are available, and what…

Vulnerability management is an ongoing, iterative process. Companies with large cybersecurity teams can still struggle with proving the efficacy of…

Happy Halloween! The October trending CVEs feature another out of bound write of vulnerability being exploited in the wild that…

CISA has recently issued a Binding Operational Directive (BOD) 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, which…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

Accurately assessing the risk of software vulnerabilities is critical in order to prioritize remediation efforts given limited remediation resources.  For…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

Categorizing and classifying vulnerabilities and attacks is important to understand how a vulnerability is exploited and how a breach unfolds…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

Securing computer systems is the ultimate big data problem.  Billions of computers generate roughly 2.5 quintillion bytes of data everyday. …

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

In this month’s edition of trending CVEs, we feature a blast from the past that provides an excellent example of…

All Risk-Based Vulnerability Management (RBVM) platforms include integrations to multiple vulnerability assessment products. In addition to vulnerability findings and asset…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

Vulnerability Management is one of the less flashy or exciting parts of your cybersecurity department maintenance routine – but is…

NopSec announces its new status as SOC 2 Type II qualified. A leading risk-based vulnerability management platform, NopSec maximizes the…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

In its most basic form, security is about protecting people and systems from harm. Increasingly, our security depends on our…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

The State of Vulnerability Management report, recently released by NopSec, shows that while organizations are making strides in vulnerability management,…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

This month we have five CVEs on the radar. The August 2022 Patch Now Award* this month goes to ManageEngine,…

In prior blogs, we’ve spelled out how an organization finds its vulnerabilities and how security teams consider threat intelligence to…

The Future of Vulnerability Management podcast is dedicated to helping security professionals tackle real issues in the vulnerability management space. Lisa…

In this blog, we’ll add to our cybersecurity considerations the concept of threats and threat intelligence. So far, we’ve looked…

The CIS Security Controls, published by SANS and the Center for Internet Security (SIS) and formerly known as the SANS…

Today, we are excited to announce our new podcast — the Future of Vulnerability Management which is dedicated to helping…

Once you’ve started a vulnerability scanning system, you may want to take the next step in identifying vulnerabilities: penetration testing,…

Have you ever wondered what security professionals want most from their Vulnerability Management (VM) program? We have. In fact, we…

Learn how to identify the right vulnerability scanner(s) for your organization’s needs. So far in this series, we have laid…

Imagine a company that started in early 2012 with a half dozen employees — all working in one office —…

We talked previously about the need to use people, processes, and technology wisely to support your vulnerability risk management. Each element…

Risk Score Update Key Takeaways NopSec is announcing the first in a series of updates to our Risk Scoring Machine…

A new advisory from top federal security and law enforcement agencies warns that state-sponsored cyber actors from the People’s Republic…

The cybersecurity world talks a lot about “common vulnerabilities and exposures” (CVEs) and compiles ongoing lists of them with a…

Cybercrime has exploded in growth over the past several years to levels that are stunning to contemplate. To put it…

Introduction Within most enterprise environments, authentication is handled by a central system known as the domain controller. The domain controller,…

We described in the previous blog post the difference between vulnerability management and risk management. A quick reminder: vulnerabilities are…

Businesses run fast to keep pace in a market that is ever dynamic, with new entries threatening to oust established…

Cybersecurity startups have had an incredible past couple of years.  In 2020, they raised $8.9 billion and last year, that…

Continuing our How to Build a VM Program series, this third installment breaks the working components of a program into…

As we said in the introduction to this series, cybercriminals are becoming increasingly sophisticated in their assaults, and the methods…

In the past, cybercriminals relied heavily on phishing to slip into an organization’s IT system to achieve their objectives. Recently,…

Cybersecurity metrics are a pertinent part of measuring the successes and failures of your program and the effectiveness of your…

In previous blogs, we discussed Attack Surface Management (ASM) and explained how ASM is critical to your overall Vulnerability Management…

In addition to the Infrastructure Vulnerability Reports released this October, NopSec is also excited to announce the following additional product…

NopSec recently released a feature that makes it easy to obtain the information you need about the vulnerabilities in your…

In our last blog, we discussed what Attack Surface Management (ASM) is. Now we will explore the importance of how…

Back in 2019, when I was a research analyst at Gartner, I started to see a monumental shift in how…

What is Vulnerability Management lifecycle? Vulnerability management lifecycle —Discovery, Detection, Prioritization, Remediation, Validation and Program Intelligence. What is an asset? …

Demonstrating the ROI of security investments has long been a challenge for SecOps teams. If an organization as a whole…

NopSec’s Vulnerability Risk Management Platform Enables Organizations to Better Manage Business Risk. New York, NY – NopSec,Inc., a leader in…

NopSec and CrowdStrike are pleased to announce that the two companies have entered into a global technology partnership, integrating NopSec’s leading enterprise Vulnerability…

Penetration testing demands a diverse skill set to effectively navigate and defeat security controls within the evaluated environment. It’s a…

Analysis of Verizon 2020 DBIR Report: Vulnerability Management Implications Webinar presented by Michelangelo Sidagni. THIS WEBINAR COVERED… • Asset management…

It is that time of the year again! The Verizon 2020 DBIR report is out again – https://enterprise.verizon.com/resources/reports/dbir/ – and…

Due to COVID-19, NopSec is empowering remote workforces with a much needed relief for businesses. Take Advantage of NopSec’s Amazing…

As an average person I had to refer to the book I read and to the movie I watch to…

The tool “SMBMap” was created nearly seven years ago. Originally based on a Python library called PySMB, it has since…

In celebration of  International Women’s Day 2020, NopSec and Mastercard partner to commemorate women in tech, diversity and product leadership…

NopSec, a leader in vulnerability and cyber threat management, attended Fal.Con UNITE 2019, CrowdStrike Cybersecurity Conference. We have gathered on…

Still CVE-2019-14287 – Linux Sodo Vulnerability Linux Sodo Vulnerability, tracked as CVE-2019-14287, has been a nightmare for IT & cyber-security…

CVE-2019-14287 – Linux Sodo Vulnerability Description A flaw was found in the way sudo implemented running commands with arbitrary user…

CVE-2019-1367 – MICROSOFT ZERO-DAY VULNERABILITY – OUT-OF-BAND PATCH, Again Microsoft zero-day vulnerability is still trending on social media and we…

CVE-2019-16759 – vBulletin Remote Code Execution Description vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in…

CVE-2019-1367 – Microsoft Zero-Day Vulnerability – Out-of-band Patch Description A remote code execution vulnerability exists in the way that the…

CVE-2019-0708 – BLUEKEEP Exploit Has Been Released The BlueKeep vulnerability, tracked as CVE-2019-0708, has been a nightmare for IT &…

What Enables the Kill Chains for Total System Compromise At NopSec my red teaming service team never stops amazing me…

Still CVE-2019-11510 – Pulse Secure VPN CVE-2019-11510 has been a nightmare for IT & cyber-security teams for the past 2…

Security risk professionals need to assess asset values to add business context to vulnerability management prioritization. NopSec understands that it…

CVE-2019-11510 – Pulse Secure VPN Description  In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before…

CVE-2019-1181 – Wormable Windows Remote Desktop Flaw  Description  A remote code execution vulnerability exists in Remote Desktop Services – formerly…

CVE-2019-1125 – SWAPGS Vulnerability Description  An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An…

My work as Senior Product Designer here at NopSec has given me a unique view of the industry landscape, as…

NopSec offers role-based access control (RBAC) that give you flexibility to determine the level of permissions and access scope that…

In Unified VRM, permissions can be set for each user based on their role and their access. Roles can be…

CVE-2019-13272 – Linux Kernel Privilege Escalation Vulnerability Alert Description  In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the…

NopSec’s Threat and Vulnerability Risk Management platform, Unified VRM, exposes a REST API with Unified VRM Vulnerability Export API. It…

NopSec bidirectionally syncs a single source of truth to organizations’ IT ecosystems Organizations often have several tools as a part…

CVE-2019-2107 – Android devices could be hacked by playing a video Description  This vulnerability could lead to remote code execution…

CVE-2019-6342 – Drupal Core Access Bypass Vulnerability Description  According to its self-reported version, in Drupal 8.7.4, when the experimental Workspaces…

CVE-2019-1132 – Win32k Elevation of Privilege Vulnerability Description  An elevation of privilege vulnerability exists in Windows when the Win32k component…

CVE-2017-11774 – Microsoft Outlook Security Feature Bypass Vulnerability Description  A security feature bypass vulnerability exists when Microsoft Outlook improperly handles…

Again, CVE-2019-0708 – BlueKeep – Wormable RDP Vulnerability The BlueKeep vulnerability, tracked as CVE-2019-0708, has been a nightmare for IT…

CVE-2019-11477 – SACK Panic Remote Command Execution Flaw in Exim is still trending on social media and we extensively covered…

CVE-2019-10149 – Remote Command Execution Flaw in Exim The BlueKeep vulnerability is still the number one trending vulnerability on social…

CVE-2018-15664 – Docker Vulnerability The BlueKeep vulnerability is still trending on social media and we extensively covered CVE-2019-0708 in May…

IT Vulnerability Ownership, Part 2: Find early adopters Telling people what to do gets nowhere fast. I even have to…

At NopSec we have one mission: to make vulnerability management easier. We bring transparency, order and ease to vulnerability data…

Still CVE-2019-0708 – BlueKeep – Wormable RDP Vulnerability The BlueKeep vulnerability, tracked as CVE-2019-0708, has been a nightmare for IT…

CVE-2019-0708 – BlueKeep – Wormable RDP Vulnerability NopSec advises you to apply patches immediately. Description CVE-2019-0708 is a critical remote…

NopSec’s founders, Michelangelo Sidagni and Lisa Xu built the company with one main goal in mind: better prioritization. After years…

CVE-2019-0604 – Microsoft SharePoint Remote Code Execution Vulnerability Description A remote code execution vulnerability exists in Microsoft SharePoint when the…

CVE-2019-3396 – Widget Connector Macro in Atlassian Confluence Server Last week, we covered CVE-2019-2725 which was a vulnerability in the…

CVE-2019-2725 – Oracle WebLogic Server Zero-Day Vulnerability Description CVE-2019-2725 is a vulnerability in the Oracle WebLogic Server component of Oracle…

CVE-2019-0859 – Yet Another Windows Zero-Day Vulnerability Last week, we covered an elevation of privilege vulnerability in Win32k component of…

CVE-2019-0859 – Yet Another Windows Zero-Day Vulnerability Description This week’s trending vulnerability may sound eerily familiar. CVE-2019-0859 is an elevation…

NopSec commonly needs to bypass anti-virus / anti-malware software detection during our penetration testing engagements, which leads us to spend…

Three times the vulnerability prioritization When it comes to vulnerabilities, I always say: “not all vulnerabilities are created equal”. Some…

IT Vulnerability Ownership, Part 1: Problem, benefits to solving it, and understand its roots Running a successful vulnerability management program…

CVE-2019-0211 – Carpe Diem – Apache Local Privilege Escalation Vulnerability Description This week’s trending vulnerability is CVE-2019-0211, a local privilege…

The Lines Are Blurring NopSec started as a penetration testing service delivery company at my kitchen table. The company then…

Spam detection, facial recognition, market segmentation, social network analysis, personalized product recommendations, self-driving cars – applications of machine learning (ML)…

Back in February, we talked about a malicious container ‘break out’ vulnerability in runc (CVE-2019-5736), a universal command-line interface tool…

CVE-2019-1002101 – Kubernetes Directory Traversal Description Back in February, we talked about a malicious container ‘break out’ vulnerability in runc…

Launching the new Unified VRM gave us an opportunity to redesign the vulnerability management experience from the ground up. As…

CVE-2019-5418 – Ruby on Rails File Content Disclosure Vulnerability Description This week’s trending vulnerability, CVE-2019-5418, is a file content disclosure…

Spam detection, facial recognition, market segmentation, social network analysis, personalized product recommendations, self-driving cars – applications of machine learning (ML)…

Recently on a customer engagement, I discovered an application that exposed its Web Application Description Language (WADL) XML that describes…

CVE-2019-0797 – Windows Zero-Day Vulnerability Description CVE-2019-0797 is one of the three zero-day vulnerabilities (one in Chrome, the other two…

Snow flurries were a welcome change in New Jersey from last month’s high gust winds. I often multitask my dog…

Google Chrome Zero-Day Vulnerability (CVE-2019-5786) & Two New Actively Exploited Windows Zero-Day Vulnerabilities Description On February 27th, security engineers from…

NopSec Inc, a leader in vulnerability prioritization, remediation workflow automation and breach prediction announces the appointments of three new Board…

Updates on Drupal (CVE-2019-6340) & A New Improper Input Validation Flaw Leading to RCE in Cisco Routers (CVE-2019-1663) The improper…

This is the final post in this six-part series. You can find the previous posts below. Time is Money, Part…

CVE-2019-6340 – Improper Input Validation Leading to Remote Code Execution in Drupal This week’s most tweeted-about vulnerability is a, yet…

CVE-2019-5736 – Malicious Container “Break Out” Vulnerability in Runc Last week, we extensively covered a security flaw in runc –…

This is part five in a six-part series. You can find the previous posts below. Time is Money, Part 1:…

Here at NopSec our goal is to provide the most intelligent, automated way of managing cybersecurity risk in enterprise environments….

tl;dr CVE-2019-5736 is a runc vulnerability that allows attackers to obtain root access of any host running a docker container….

CVE-2019-5736 – malicious container “break out” vulnerability in runc If you follow cybersecurity news at all, you have likely already…

CVE-2019-1653 (Cisco Routers information disclosure), CVE-2018-16858 (LibreOffice directory traversal bug) It has been a relatively slow week as we have…

This is part four in a six-part series. You can find the previous posts below. Time is Money, Part 1:…

This is part three in a six-part series. You can find the previous posts below. Time is Money, Part 1:…

This week’s most talked about vulnerability is CVE-2019-1653. It is an information disclosure vulnerability affecting web-based management interface of Cisco…

CVE-2018-15982 is a use after free zero-day vulnerability in Adobe Flash Player (versions up to 31.0.0.153) which can result in…

This is part two in a six-part series. You can find the first in this series here, which lists the…

Time is Money is a six-part series we’re going to post throughout the first few months of 2019. We’ll also…

2019 is here and it’s back to the workday routine. As a dad with a Jersey bus commute, mornings are…

At this time of the year, like any other year, the security industry goes back to reflect on itself and…

The Great News It has been recently reported that NIST, the agency hosting the National Vulnerability Database (NVD), plans to replace its…

IT Security Teams spend most of their time putting out fires, and just plain dreading and waiting for the next…

Will We Learn the Right Lesson This Time Around? A little over a year ago, Equifax announced a huge breach…

I’d like to diverge from our typical blog topics today to discuss the Offensive Security Certified Professional (OSCP) certification, and…

Many of our clients at NopSec have mature web application security programs with their own internal white hat penetration testing…

It’s a cliché now to declare any year the year of the _____-breach. It’s especially difficult to see around corners…

The black swan theory grew out of a metaphor that referred to something that didn’t exist at one point. When…

On Monday, March 19th, NopSec’s Co-founder & CTO, Michelangelo Sidagni will be speaking at this year’s IANS New York Information…

I have always been fascinated by lateral movement attacks possible within Windows Active Directory environments. Hosts are compromised; credentials extracted;…

We’re living through the gold rush of information security. The awareness and importance of information (or cyber) security has never…

As a penetration tester who uses Python in virtually all engagement, here are the top 5 python libraries that I recommend…

The updated PCI 3.2 requirements are coming to a head with a deadline this February 1st, 2018. While we’re sure…

IT Security and Risk teams in every organization have one common goal: to protect the company’s data from breaches by…

The first traditional deadline is coming to a close this month for compliance with the NYDFS Cybersecurity Regulations. Please note that…

Silos exist in all levels and all types of organizations. Different teams naturally have different priorities, methodologies, and more, though…

The “password” is one of those seemingly foolproof ways to protect your online valuables. Like a secret word between you…

Antivirus software is one of the oldest and the most ever present security control against malware and various types of…

What’s the quickest way to a hacker’s heart? Make sure your business email password is “Password123.” Or perhaps “Summer2017” if…

Here at NopSec, we have always been fascinated with automation. It has been a focus of ours since the beginning…

CIS 20 Security Controls represent one of the reference frameworks of the most critical controls an organization can implement to…

Data is power virtually everywhere, and it’s all about how you utilize that information. In business, you can use data…

Penetration Testers (aka ethical hackers) use a myriad of hacking tools depending on the nature and scope of the projects they’re…

If you asked car salesmen from different dealerships the question, “How much does a great car cost?” you’re guaranteed to…

If you’re in the financial industry (or working as a provider with such organizations), you most likely have already heard…

Cybersecurity is finally gaining the attention it’s due. From whistleblowers to major data breaches, issues once kept strictly in the…

We’re proud to build products IT Security Teams actually need and use on a daily basis. We’re a company started…

According to the The Register’s article, last week we started assisting to the widespread exploitation of The Shadow Brokers’ leaked Windows…

Organizations seeking to improve their security posture and meet regulatory or audit compliance requirements must consider implementing role based access control (RBAC).

Here at NopSec, we’ve spoken with a number of financial organizations about where they are in the process of meeting…

Distributed denial of service (DDoS) attacks are a growing but frequently misunderstood threat in the cybersecurity world. Defined generally, a…

How can I find security people, how do I deal with budget and time, how should I prioritize, what will…

Blind assumptions about online security are not the only assumptions that demand attention in the cybersecurity industry today. An article…

Unified VRM Analytics leverages vulnerability data from across all the modules (Internal, External and Web) the user has subscribed to…

Do you feel confident that everyone in your organization could identify a phishing email that contained ransomware? What if the…

The year 2016 will be remembered for some big moments in the world of cybersecurity: the largest known distributed denial…

Each year, NopSec conducts a survey of IT and cybersecurity professionals to glean a snapshot of the current state of…

When new cybersecurity regulations from the New York Department of Financial Services (NYDFS) take effect on March 1, 2017, financial institutions will…

Growing up as a kid in the 80’s ransom used to be a simple thing. A bad person with a…

Remember Shamoon, the malware that disabled some 35,000 computers at one of the world’s largest oil companies in 2012? If…

Now, let’s talk technical. Malicious executable are used to deliver a payload to a victim. These can be very technical…

The first thing that all organizations need to understand is why social engineering works. In many cases organizations, security professionals,…

Businesses, governments, and consumers alike need to be aware of ransomware – a type of malware that can inflict serious…

Most organizations are currently migrating their computing infrastructure into the public cloud (AWS, Google, Azure) usually embracing a mixed private…

NopSec released a featured annual report, “2016 State of Vulnerability Risk Management.” The report reveals key security threats by industry,…

…..and I am back!! Apologies for waiting so long to blogging. The past few months here at NopSec have been…

Note: This article was updated in June 2022. Here at NopSec, we are all about risk — our number one…

Compliance isn’t enough for healthcare organizations. For years, we have equated compliance with effective vulnerability risk management. This is simply…

Most small and medium business owners believe that cyber criminals only target large businesses and corporations. They couldn’t be more…

Securing an environment is a constant game of cat-and-mouse. Safety measures of all kinds can (and should) be put in…

Time and again, we hear from information security leaders who have invested in vulnerability risk management (VRM) technology and are…

On March 23rd 2016, I had the pleasure to participate in the Inaugural 2016 National Conference of Minority Cybersecurity Professionals…

Scanning is an important part of a well-established vulnerability risk management program. Vulnerability scanners allow you to identify the threats…

The information security industry is buzzing about the newest threat, DROWN. According to Drown Attack, “[it] is a serious vulnerability…

Since product launch (2012), Unified VRM has been rapidly expanding with new features and advanced automation solutions for security professionals….

Automation Strikes Back! There are tons of technologies out there that are trying to “AUTOMATE” every aspect of human life….

According to recent research over 60 percent of survey participants stated their executives are only “somewhat” or “not at all” informed about…

According to FireEye, a U.S. based provider of next generation threat protection, it takes companies, on average, more than 200 days…

OpenVAS (Open Vulnerability Assessment Scanner) – is an open source security vulnerability scanner and manager. It is an open source…

For consumers and businesses alike, when it comes to keeping private information private your best defense is vigilance; in both…

When I started my career as a penetration tester, the name of the game was all about breaching the external…

Another day, another hack. And not just any old hacking incident, but one involving yet another healthcare provider, only demonstrating how…

The recent recall of 1.4 million vehicles by Fiat Chrysler has raised many questions and concerns after researchers discovered a security vulnerability…

Information security professionals have a single core mission: to understand technological risks and take the necessary steps to protect information…

Literally a flood of lines have already been written about Security Threat Intelligence and its uses, so I would not…

This blog post is the first of a series documenting the journey into Machine Learning Algorithms NopSec is undertaking as part…

NopSec has just launched ThreatForce – a flagship security vulnerability search engine that makes it easy for security analysts to gain a…

At NopSec, we work hard every day not only to make it easy for organizations to detect and prioritize vulnerabilities,…

As part of the DevOps movement, it would be desirable to scan your web application for security vulnerability as part of the Continuous Integration loop…

Enterprise organizations need vulnerability risk management solutions that integrate with the existing authentication and asset management infrastructure. Unified VRM has…

Most of our customers’ security analysts are called on a monthly basis (or more often) to deliver a presentation of…

Lately a lot of attention has been directed towards the “DevOps” or “SecOps” disciplines and for good reasons. According to…

Penetration tests are point-in-time adversarial tests aimed at testing the intrusion prevention, detection, and incident response capabilities and controls of an…

At NopSec, we are using vagrant and packer to spin up local dev environments and build our instances across the various hypervisor and cloud…

A couple of days ago I read an interesting article in the Tenable Network Security Blog — here — where…

Penetration Testing, Red Team Operations, Exploit Development, Vulnerability Management, Brute Forcing, Advanced Persistent Threats and even BEAST, CRIME, Zeus, Code…

In the previous blog post here, we described the GHOST Linux glibc vulnerability in details and its repercussions to the…

Our partner Qualys discovered a new vulnerability nick-named “GHOST” (called as such because it can be triggered by the GetHOST…

If you haven’t read the book or watched the movie Fight Club, you may not understand this reference. “1st RULE: You…

Usually I am not particularly a big fan of security doom scenarios, but looking at this week’s security news and…

Heartbleed (CVE-2014-0160) is a vulnerability with a CVSSv2 base score of only 5.0/10.0. Though its CVSS score is relatively low,…

If you’re a security researcher or penetration tester you’re probably already well aware of the extensive array of tools available…

Parameter injection is one of the most common classes of web application vulnerabilities exploited in the wild.  This class of…

Understanding and fulfilling PCI 11, Requirement 3 can be daunting, but NopSec is here to help you through it. 11.1…

The term “security breach,” and other similar phrases, have become commonplace. This year alone we have seen the data of…

Google security researchers Bodo Moller, Thai Duong and Krzysztof Kotowicz recently uncovered a vulnerability in SSL 3.0 that could allow secure connections to…

Call it good timing. After all the horrendous cybersecurity news of the past weeks, it feels great about that our…

It is no secret that hackers have been making the rounds, targeting organizations of all sizes, from national retailers to local financial institutions,…

If you are like us at NopSec one of the companies that operators on Amazon AWS cloud, this past couple…

Threat intelligence is an increasing popular buzzword in security magazine articles and blogs. It also is becoming more prevalent in…

With the time, effort and resources that companies dedicate to penetration testing, it can be frustrating (at best) to not…

No industry is immune to IT security breaches and it seems that retailers have been in the spotlight of late….

Understanding how to effectively evaluate and select a penetration testing vendor can be a challenging exercise. Frequently the problem comes…

A vulnerability assessment, also known as vulnerability testing, is the practice of detecting, classifying, prioritizing, and remediating security vulnerabilities in…

No industry is immune to IT security breaches. Recent breaches at Indiana University, Iowa State, the University of Maryland, and…

Note: This article was updated in June 2022. Risk Based Vulnerability management is the ongoing practice of detecting, classifying, prioritizing,…

Security risks to information systems and sensitive data are expanding at a rate that can outpace an organization’s technical resources…

This is the time of year when companies gaze into their crystal ball and try to discern what lies ahead….

As penetration testers know, spending nights awake to probe networks, servers and applications is common practice. For companies completing vulnerability…

With any technology investment, budget is a core part of the decision criteria. IT security departments are expected to do…

According to a reports released by the Information Security Forum and ISACA, cyber-security will continue to be a critical issue for businesses in…

Many federal regulations such as GBLA, HIPAA and PCI require an annual penetration test. Customers often ask for our penetration testing services in…

This is the time of the year that we get a lot of inquiries about performing an annual penetration test….

Reports in the news make it clear that the sophistication of cyber-attackers continues to evolve. So why do so many…

When IBM Security announced availability of its QRadar Vulnerability Manager earlier this year, vulnerability risk management was solidified as an…

In September the deadline for compliance with changes to the HIPAA rules relating to breaches of unsecured electronic Protected Health Information…

The SANS 20 Critical Security Controls are prioritized mitigation steps to improve cybersecurity. Coordinated through the SANS Institute, many companies with…

One of the most important aspects of every complex system is flexibility. Flexibility of adapting to changing circumstances and leveraging…

Cyber forensic investigators report that some of the most complicated and audacious hacks started in two simple ways: either with…

As the benefits of cloud computing drive increased adoption by businesses, the fastest growing area of public cloud computing appears…

As we have reached the end of this blog post series on SANS 20 Critical Controls, this one is definitely…

If you are responsible for IT security in the financial services industry, you may have been asked by a regulator…

In this installment of our SANS 20 Critical Security Controls, I bundled three controls together simply because they are very…

Have you ever considered what is the venue most attackers use to infiltrate target systems? In terms of percentage, certainly…

This week we come back with our blog series on SANS 20 Critical Controls and focus on Audit Logs and Controlled…

NopSec was recognized on the CRN Magazine 2013 list of “Emerging Security Vendors” for the second consecutive year. CRN’s Emerging Vendors…

As every year the Las Vegas security conferences extravaganza unfolds and then passes leaving a head full of new knowledge…

Lisa Xu, Chief Executive Officer at NopSec, knows that an outside perspective is critical to building the company. Lisa recently…

You may have heard the adage, “The best defense is a good offense.” As Chief Marketing Officer at NopSec, I…

Wendy Nather is Research Director within 451 Research’s Enterprise Security Program, providing analysis on the current state of security from the…

As we are getting ready to descend for a couple of days to Vegas for Black Hat / DefCon /…

Another very important area of an organization’s security program is its application security roadmap. We all know that web and…

I have been attending the Black Hat Conference in Las Vegas for many years now and I have to admit that the…

There’s a quote attributed to Fabio Massacci, professor of information systems and security at the University of Trento in Italy…

In a system there is no privilege that is higher than administrative privileges. In Unix and Linux world, this is…

Exposure level and Risk level are directly proportional to each other! Ports, protocols and services are entry points and mechanisms…

Why all graphical representations of a network firewall include a wall with flames? Do you have to set a wall…

Robert McGarvey recently covered the topic of account takeover attempts in his regular column in the Credit Union Times. Michelangelo…

On this blog post of the SANS Critical Control series I comment on two critical controls that at the first…

Wireless networks have always been a “no man’s land” in terms of security and appropriate configuration. Some of the most…

I came across a post by Tony Turner titled, “Vulnerability Management is a Lie” and I could hardly wait to…

As part of SANS 20 Critical Security Controls mapping with Unified VRM series, today I am going to discuss Critical…

In this latest installment of this blog series, I am going to analyze how to implement the SANS Critical Control…

In the previous two blog posts I have been addressing Control 1 and Control 2 in the SANS Critical Security…

Yesterday, I published the first blog post on mapping SANS 20 critical security controls to Unified VRM. The post dealt…

Recently I got the chance to spend a little more time examining the SANS top 20 Critical Security Controls for…

Do you ever wish there was a single document that would answer all your burning questions? If you’ve ever moved…

The rationale for this blog post is the Rule of Three and, as noted on Wikipedia, the Latin phrase, “omne trium perfectum”….

I came across some news the other day that a local university will start offering a master’s degree in “Cyber-Security…

Is there anybody that has not received an email that starts like this, “<Company name> recently experienced a cyber-attack on…

An industry colleague forwarded me a recent article from Upstart Business Journal titled, “VC firms need to find their feminine…

Lisa Xu, CEO of NopSec, was interviewed recently by BankInfoSecurity.com about her career in information security – a male-dominated field…

I loved the opening paragraph in a recent article titled, “How Attackers Choose Which Vulnerabilities To Exploit” by Michael Cobb,…

Penetration testing is one of the services that we offer NopSec customers. A vulnerability assessment and penetration test provide an…

Last week at the RSA Conference, Lisa Xu and I had an opportunity to sit down with Tracy Kitten, Managing…

In a recent article posted by Robert McGarvey in the Credit Union Times, Threat of the Week: APT Will Get…

NopSec is pleased to announce the immediate availability of a new Executive Dashboard for Unified VRM. NopSec continues the rapid…

We observe a common misconception that companies believe they are doing “vulnerability management” when, more often than not, they are…

Cyber Security was all over the news recently. Facebook revealed that it was hacked – even though it came out…

Crain’s New York Business, there is an article written by Matthew Flamm that discusses the pervasiveness of cyber attacks and…

It looks like the Federal Government is getting serious about IT security. “Now our enemies are also seeking the ability…

It has been hard to keep up with my news alert due to all the IT security headlines. “Hackers in…

Some of you probably wondered where the NopSec crew and I ended up these days….already tired for blog writing? Not…

The other day I was thinking about the concept of “event correlation” embedded into various SIEM products. Security events can…

Every day I get tot talk to a lot of infosec professionals and business people regarding vulnerability management. They tell…