Resources

Blog

Vulnerability Management Program Best Practices – Part 2

Recently, I introduced a three-part series on how to build a successful vulnerability management program. The first installment examined Stage 1, the vulnerability scanning process. My next article investigates Stages 2 (asset discovery and inventory) and 3 (vulnerability detection), which occur primarily using the organization’s technology of...
Blog

Netflix to Crack Down on Use of Proxies among Members

Netflix has announced its intention to counter the use of proxies among members who wish to view content outside of their immediate geographic territory. David Fullagar, Vice President of Content Delivery Architecture at Netflix, broke the news in a blog post on Thursday: "[I]n coming weeks, those using proxies and unblockers will only be able to...
Blog

The Ten Keys to Cyber-Survival

I don’t know if you have noticed, but when it comes to incident response, the methodology applied by organisations can vary from the downright chaotic, to a well-disciplined, well-oiled machine. However, from what I have observed over the preceding five years of my professional life, the general approach seems to be ad-hoc and has suffered from a...
Blog

DDoS Attacks Increased by 180% Compared to 2014, Reveals Akamai Report

Last September, CloudFlare detected a large-scale browser-based L7 flood. Over the course of the distributed denial of service (DDoS) attack, 650,000 IP addresses sent out a total of 4.5 billion HTTP requests, with the campaign peaking at 250,000 requests per second. After investigating the incident, the security company concluded that the attack...
Blog

Hacker Receives 334 Years in Prison for Bank Phishing Scheme

Computer crime is on the rise around the world. Every day, nefarious actors develop increasingly more sophisticated forms of malware for their attacks. Additionally, as reported by the United Kingdom's National Crime Agency (NCA) back in December, the average age of online criminals has dropped to 17 years old, suggesting that teenagers are more...
Blog

VERT Threat Alert: January 2016 Patch Tuesday Analysis

Today’s VERT Alert addresses 9 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-652 on Wednesday, January 13th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...
Blog

The Ad Blocking Conundrum: Stealing or a Sound Security Practice?

Is using ad blocking software stealing or is it a sound security practice? On one hand, many websites and content creators make money from advertising. They certainly deserve to be compensated for their time and effort. On the other hand, advertising – at best – can be annoying, and at worst, can serve up malware, suck up bandwidth and redirect...
Blog

Vulnerability Management Program Best Practices – Part 1

An enterprise vulnerability management program can reach its full potential when it is built on well-established foundational goals that address the information needs of all stakeholders, its output is tied back to the goals of the enterprise, and there is a reduction in the overall risk of the organization. Such vulnerability management technology...
Blog

Dealing with Security in the Real World

Seven months ago I began an odyssey through our medical system that ended in December with my last visit to my surgeon's office. Throughout the entire experience, I couldn't help but make mental notes about the security practices I encountered. I want to be clear from the beginning – nothing I saw was egregious or malicious, just caring people...
Blog

Researchers Disclose Default Credentials for Over 100 ICS/SCADA Products

A group of researchers has made public a database, dubbed "SCADAPASS," containing default credentials for more than 100 industrial control system (ICS) products belonging to various top vendors. The research team—known as SCADA StrangeLove—published the list on GitHub, which includes the product and vendor names; device type; default username and...
Blog

Blast a Hole in Adobe Flash and Earn $100,000

Fancy earning $100,000? Of course, you do. Well, now there's an opportunity to earn a huge reward if you can demonstrate how Adobe Flash can be exploited. Sounds good right? Well, here's the bad news for the rest of us: it's not Adobe offering the money in the form of a bug bounty. Less than a month ago, Adobe proudly announced a series of security...
Blog

More Executives Turn to Cyber Risk Transfer

As cyber threats grow in scope and potential impact, the complexity of enterprise digital data protection grows to astonishing proportions. Last year, a Fortune 500 survey revealed that cyber security is the second biggest concern for CEOs, who keep looking for new solutions to keep their data safe and their clients happy. The enterprise data is...
Blog

The Top 11 Information Security Conferences of 2016

UPDATED 01/07/2016 to include RSA Conference USA. (Please see below.) In Part II of our 2015 Infosec Wishlist series, a number of security experts expressed their desire for the security community to renew its focus on collaboration, communication and unity in the New Year. To accomplish this goal, folks in information security will need to...