Blog

OpenSSL to Fix 'High' Severity Security Flaw
Blog
Blog

80% of Retailers Failed Interim PCI Compliance Assessments

By Editorial Staff on Wed, 03/11/2015
Despite retailers’ continuous improvement in compliance with the Payment Card Industry (PCI) security standards, four out of five companies are still failing at interim assessments, according to Verizon’s latest report . The report highlights that the overall state of compliance grew significantly in 2014, with 20 percent of organizations achieving full compliance – up from 11 percent in 2013, and...
Compliance
PCI DSS
Blog
Blog

Apple To Add New Security Alerts Following iCloud Hack

Fri, 09/05/2014
In response to the recent debacle that exposed multiple celebrities by hackers breaking into their personal Apple accounts and leaking private images on the web, Apple has stated it plans to launch additional security alerts warning users of possible intrusion.
Vulnerability & Risk Management
Cloud Security
Blog
Blog

Vulnerability Management: Just Turn It Off! Part III

Mon, 08/18/2014
Four unnecessary risks that often appear in even the most secure networks, and step-by-step instructions on how to immediately address these considerable risks that can be hurting the security of our environment.
Vulnerability & Risk Management
Blog
Blog

Vulnerability Management: Just Turn It Off! Part II

Wed, 08/06/2014
Our last post in the “Turn It Off!” blog series discussed some of the most common and yet unnecessary features that can make your environment more vulnerable, including JBoss JMX consoles, server banners and the Apache HTExploit. These risks are often encountered by our Vulnerability and Exposure Research Team (VERT), even on well-defended networks and many of which have been around for quite some...
Vulnerability & Risk Management
Blog
Blog

NETGEAR Wireless Router Configuration Guide

Mon, 03/31/2014
This guide assumes that the reader has a NETGEAR branded wireless router and knows it’s address on the network. If you have forgotten the administrative password for your device, it may be necessary to perform a factory reset as outlined in this NETGEAR knowledge base article and then to login with the default password. Please note that while performing these steps, a malicious web page could...
Vulnerability & Risk Management
Blog
Blog

Friends Don’t Let Friends Mix XSS and CSRF

By Craig Young on Sun, 02/16/2014
In preparation for my upcoming talk at BSides SF about finding vulnerabilities, I would like to share today some insights regarding two common types of vulnerabilities which leverage web browser in two unique ways. The goal of these vulnerabilities is quite different however. One is used to run untrusted code while the other is used to hijack authentication. The combined effect of these issues can...
Vulnerability & Risk Management
Blog
Blog

Why the Security Stack Has Ten Layers, Not Seven

By Tripwire Guest Authors on Wed, 01/15/2014
The next item to tackle is the overall security architecture – and this includes several things. But let me first state the disclaimer that of course it is imperative that the correct governance and policies are in place and that technology can’t replace those things. But, it is also clear that however sophisticated, no paper document or process design will block an attack in the meantime until...
Vulnerability & Risk Management
Blog
Blog

Penetration Testing with Smartphones Part 1

Fri, 11/30/2012
When most people think of penetration testing, they think of a simulated external attack where the tester tries to break into a network remotely. Companies focus most of the security spending and policies on keeping hackers out remotely, from firewalls and other security hardening appliances, software and tools. However, given the proliferation of mobile devices in the workplace and use of Wi-Fi...
Vulnerability & Risk Management