-
The ROI of ThreatForce
Demonstrating the ROI of security investments has long been a challenge for SecOps teams. If an organization as a whole…
-
Verizon DBIR: Analysis of Verizon DBIR Report
It is that time of the year again! The Verizon 2020 DBIR report is out again – https://enterprise.verizon.com/resources/reports/dbir/ – and…
-
Vulnerability Management in the time of a Pandemic
As an average person I had to refer to the book I read and to the movie I watch to…
-
Pentest Findings & Mitigating Controls
What Enables the Kill Chains for Total System Compromise At NopSec my red teaming service team never stops amazing me…
-
E3 Engine
Three times the vulnerability prioritization When it comes to vulnerabilities, I always say: “not all vulnerabilities are created equal”. Some…
-
Security Product vs Service Company
The Lines Are Blurring NopSec started as a penetration testing service delivery company at my kitchen table. The company then…
-
VRM Wishlist for 2019
At this time of the year, like any other year, the security industry goes back to reflect on itself and…
-
In the DCShadow: How to Become a Domain Controller
I have always been fascinated by lateral movement attacks possible within Windows Active Directory environments. Hosts are compromised; credentials extracted;…
-
Fighting the War with the Right Weapon: Countering Complexity with Automation
Here at NopSec, we have always been fascinated with automation. It has been a focus of ours since the beginning…
-
The Shadow Brokers-Leaked Equation Group’s Hacking Tools: A Lab-Demo Analysis
According to the The Register’s article, last week we started assisting to the widespread exploitation of The Shadow Brokers’ leaked Windows…
-
UnifiedVRM Roadmap SiteRep
…..and I am back!! Apologies for waiting so long to blogging. The past few months here at NopSec have been…
-
Know Thy[self] Environment
Securing an environment is a constant game of cat-and-mouse. Safety measures of all kinds can (and should) be put in…
-
Pen Testing Costs: The Business Value of Pen Testing Services
On March 23rd 2016, I had the pleasure to participate in the Inaugural 2016 National Conference of Minority Cybersecurity Professionals…
-
The Importance of Technology Integration to the Value of an InfoSec product
According to FireEye, a U.S. based provider of next generation threat protection, it takes companies, on average, more than 200 days…
-
Consumers: The Last Best Mile of the Security Perimeter
For consumers and businesses alike, when it comes to keeping private information private your best defense is vigilance; in both…
-
Vulnerability Management and the Road Less Traveled
When I started my career as a penetration tester, the name of the game was all about breaching the external…
-
Threat Intelligence: one size does not fit all
Literally a flood of lines have already been written about Security Threat Intelligence and its uses, so I would not…
-
A little Machine Learning “Magic”…
This blog post is the first of a series documenting the journey into Machine Learning Algorithms NopSec is undertaking as part…
-
Working Hard towards Vulnerability Remediation: ServiceNow Integration
At NopSec, we work hard every day not only to make it easy for organizations to detect and prioritize vulnerabilities,…
-
Go party with the #DevOps
As part of the DevOps movement, it would be desirable to scan your web application for security vulnerability as part of the Continuous Integration loop…
-
Active Directory Authentication and Asset Sync
Enterprise organizations need vulnerability risk management solutions that integrate with the existing authentication and asset management infrastructure. Unified VRM has…
-
Vulnerability Management Presentation to CISO – No problem
Most of our customers’ security analysts are called on a monthly basis (or more often) to deliver a presentation of…
-
DevOpS and Remediation Task Management
Lately a lot of attention has been directed towards the “DevOps” or “SecOps” disciplines and for good reasons. According to…
-
Mapping Penetration Testing report and vulnerability management CVEs
Penetration tests are point-in-time adversarial tests aimed at testing the intrusion prevention, detection, and incident response capabilities and controls of an…
-
Counting Vulnerabilities. Assessing Threats. Frictionless Remediation
A couple of days ago I read an interesting article in the Tenable Network Security Blog — here — where…
-
Detecting the GHOST glibc Vulnerability with Unified VRM
In the previous blog post here, we described the GHOST Linux glibc vulnerability in details and its repercussions to the…
-
A GHOST in the….Linux….Wires
Our partner Qualys discovered a new vulnerability nick-named “GHOST” (called as such because it can be triggered by the GetHOST…
-
Security Doom Scenarios…..OK….name your passwords’ directory “Password”
Usually I am not particularly a big fan of security doom scenarios, but looking at this week’s security news and…
-
Projecting Your Burp
If you’re a security researcher or penetration tester you’re probably already well aware of the extensive array of tools available…
-
Poodle SSLv3 vulnerability: What it is, how to discover it, how to defend against it
Google security researchers Bodo Moller, Thai Duong and Krzysztof Kotowicz recently uncovered a vulnerability in SSL 3.0 that could allow secure connections to…
-
Are the clouds in the sky rebooting?!
If you are like us at NopSec one of the companies that operators on Amazon AWS cloud, this past couple…
-
Vulnerability Scanning Best Practices: Where and When to Run Vulnerability Scans
As penetration testers know, spending nights awake to probe networks, servers and applications is common practice. For companies completing vulnerability…
-
Using Unified VRM to Implement SANS 20 Critical Security Controls
The SANS 20 Critical Security Controls are prioritized mitigation steps to improve cybersecurity. Coordinated through the SANS Institute, many companies with…
-
SANS Critical Control 20: SANS Penetration Testing and Red Team Exercises
As we have reached the end of this blog post series on SANS 20 Critical Controls, this one is definitely…
-
SANS Critical Controls 17, 18 and 19: Data Loss Prevention, Incident Response and Management, Secure Network Engineering
In this installment of our SANS 20 Critical Security Controls, I bundled three controls together simply because they are very…
-
SANS Critical Control 16: Account Monitoring and Control
Have you ever considered what is the venue most attackers use to infiltrate target systems? In terms of percentage, certainly…
-
SANS Critical Controls 14 and 15: Audit Logs and Controlled Access
This week we come back with our blog series on SANS 20 Critical Controls and focus on Audit Logs and Controlled…
-
SANS Critical Control 13: Network Boundary Defense
As we are getting ready to descend for a couple of days to Vegas for Black Hat / DefCon /…
-
SANS Critical Control 6: SANS Application Software Security
Another very important area of an organization’s security program is its application security roadmap. We all know that web and…
-
Recommended sessions at Black Hat 2013 Conference
I have been attending the Black Hat Conference in Las Vegas for many years now and I have to admit that the…
-
SANS Critical Control 12: Controlled Use of Administrative Privileges
In a system there is no privilege that is higher than administrative privileges. In Unix and Linux world, this is…
-
SANS Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services
Exposure level and Risk level are directly proportional to each other! Ports, protocols and services are entry points and mechanisms…
-
SANS Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
Why all graphical representations of a network firewall include a wall with flames? Do you have to set a wall…
-
SANS Critical Control 8 and 9: Data Recovery Capability & Security Skill Assessment
On this blog post of the SANS Critical Control series I comment on two critical controls that at the first…
-
SANS Critical Control 7: Wireless Device Control
Wireless networks have always been a “no man’s land” in terms of security and appropriate configuration. Some of the most…
-
SANS Critical Control 4: Continuous Vulnerability Assessment and Remediation
As part of SANS 20 Critical Security Controls mapping with Unified VRM series, today I am going to discuss Critical…
-
SANS Critical Control 5: Malware Defenses
In this latest installment of this blog series, I am going to analyze how to implement the SANS Critical Control…
-
SANS Critical Control 3: Secure Configurations
In the previous two blog posts I have been addressing Control 1 and Control 2 in the SANS Critical Security…
-
SANS Critical Control 2: Inventory of Authorized and Unauthorized Software
Yesterday, I published the first blog post on mapping SANS 20 critical security controls to Unified VRM. The post dealt…
-
CVE-2003-0095 – Oracle Database Server Unauthenticated Remote Overflow Metasploit Module
Penetration testing is one of the services that we offer NopSec customers. A vulnerability assessment and penetration test provide an…
-
The importance of implementing security controls
Cyber Security was all over the news recently. Facebook revealed that it was hacked – even though it came out…