3 min
Simplifying Account Takeover Protection
Account takeover
[http://www.darkreading.com/endpoint/anatomy-of-an-account-takeover-attack/a/d-id/1324409]
(ATO) is difficult to prevent against because it can go unnoticed for years
until a customer notices something is amiss. It’s tedious and requires detailed
logging as well as flexible query ability to survey for it ‘by hand’.
Many consumer-facing companies try to create in-house solutions, but it can take
years to develop the tools to even do ‘machine assisted’ ATO detection. Even
the
4 min
Komand
The Real Cost of Manual Security Operations
More tools, processes, or people doesn’t always equal better security. In fact,
the more you have to manage, the costlier it can get. But as threats evolve,
technologies and processes change, and so too must security operations.
If your security operations are highly manual today, this post will help you
visualize what that is costing your organization, not just from a monetary
standpoint, but from an efficiency and speed perspective, too. We’ll start by
looking at the three major areas of secu
4 min
Automation and Orchestration
ChatOps for Security Operations
Synopsis
Bots are tiny helpers that can be part of any applications and are well suited
for a large scale, repetitive and real time tasks. They enable highly qualified
security teams to focus on more productive tasks such as building, architecting
and deploying rather than get occupied with menial tasks. Additionally, they act
as sharing and learning tools for everyone in the organizations and provide
context for all conversations and collaborations.
Benefits of ChatOps for Security
ChatOps [ht
2 min
Metasploit
Metasploit Weekly Wrapup
hdm recently provided a new exploit module for a type confusion vulnerability that exists in Ghostscript versions 9.21 and earlier, allowing remote code execution on the target.
2 min
3 Simple Ways to Approach Content Security Policy
In the 2 previous posts about Content Security Policy, we talked about the main
reasons why you need to get started with CSP and the common problems that you
will run into. In this post, we will dive deeper into the 3 types of CSP
solutions.
Phased Approach
Because reports of violations can be overwhelming for both analysis and
performance reasons tCell recommends starting with the most critical directives
first (such as script-src and object-src which help prevent XSS) and a very
permissive s
5 min
Komand
Translating and Detecting Unicode Phishing Domains with Komand's Security Orchestration Platform
I don't know about you, but in the past few weeks, my news feed has been abuzz
with unicode domain names as phishing
[https://www.rapid7.com/fundamentals/phishing-attacks/] URLs. The use of unicode
domain names is a version of a homograph attack applied using International
Domain Names (IDN).
The underlying problem is that it’s difficult to visually distinguish some
unicode characters from ASCII ones. Luckily, Chrome and Firefox have stopped
converting domain names
[https://www.wordfence.com/bl
2 min
Komand
Asia Cybersecurity Event Calendar [Free Shared Google Calendar]
Cybersecurity events and conferences are ways for the infosec community to
connect and share their knowledge. We’ve provided an extensive calendar of
events for US cybersecurity events
[/us-cybersecurity-events-you-need-to-know-about-free-shared-google-calendar],
and now we are pleased to present the latest and upcoming events in other
regions of the world. This time though, we’re taking it international with an
Asia cybersecurity events list and shared calendar!
The Asian continent is home to
11 min
Komand
A Privacy Stack for Protecting Your Data
Over the years, there have been a number of incidents that have raised my
security-guy neck hairs. Every time something crops up, I get a bit more worried
about where my data lives, and who is privy to it that I don’t know about.
Most recently, we have the dismantling of privacy rules that protect our
information from being wantonly sold off by our ISPs, even more in depth
searching at US borders, large scale sweeping up of people and associated
electronic devices at occurrences of civil unrest
4 min
Automation and Orchestration
Introduction to ISO/IEC 27035 - the ISO Standard on Incident Handling
Synopsis
In the series of articles titled “Incident Response Life Cycle in NIST and ISO
standards” I review incident response life cycle, as defined and described in
NIST and ISO standards related to incident management.
I introduced these standards in the first article in this series
[/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/]
and later in this article
[/2017/01/11/introduction-to-incident-response-life-cycle-of-nist-sp-800-61/] I
start
4 min
Automation and Orchestration
Introduction to ISO/IEC 27035 - Planning for and Detection of Incidents
Synopsis
In the series of articles titled “Incident Response Life Cycle in NIST and ISO
standards” I review incident response life cycle, as defined and described in
NIST and ISO standards related to incident management.
I introduced these standards in the first article in this series
[/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/]
and later in this article
[/2017/01/11/introduction-to-incident-response-life-cycle-of-nist-sp-800-61/] I
start
4 min
Automation and Orchestration
Introduction to ISO/IEC 27035 - Assessment and Responding to Incidents
Synopsis
In the series of articles titled “Incident Response Life Cycle in NIST and ISO
standards” I review incident response life cycle, as defined and described in
NIST and ISO standards related to incident management.
I introduced these standards in the first article in this series
[/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/]
and later in this article
[/2017/01/11/introduction-to-incident-response-life-cycle-of-nist-sp-800-61/] I
start
4 min
Automation and Orchestration
Introduction to ISO/IEC 27035 - More Details on Part 2 of the Standard
Synopsis
In the series of articles titled “Incident Response Life Cycle in NIST and ISO
standards” I review incident response life cycle, as defined and described in
NIST and ISO standards related to incident management.
I introduced these standards in the first article in this series
[/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/]
and later in this article
[/2017/01/11/introduction-to-incident-response-life-cycle-of-nist-sp-800-61/] I
start
3 min
Content Security Policy: Newer CSP Directives & Common Problems
Content-Security-Policy (CSP) Versions 2.0 & 3.0
Content Security Policy [/2017/03/3-reasons-content-security-policy] is still
very dynamic in its definitions. Reporting is handled differently and new
directives are being added, some are being renamed, and others the definition is
being refined.
Some notable additions to the original:
Frame-Src & Child-Src – In CSP v1 frame-src defined what domains your site is
allowed to frame. This is to prevent an attacker from creating an iframe which
r
4 min
Komand
What is the Difference Between a SOC and a CSIRT?
Building an effective security organization requires a mix of the right people,
processes, and technologies, and there are many different ways in which you can
organize your security team and strategy.
Two types of teams you most often hear about are security operations centers (or
SOCs) and computer security incident response teams (or CSIRTs). Which one is
best for your organization depends on a few factors. Let's cover the differences
between the structure of each team type, and how to decid
0 min
4 Must-Haves to Bring Security into DevOps
Security can leverage the DevOps methodology so that their tools and processes
reap the benefits of continuous deployment, increased time to market, and faster
remediation.
This infographic highlights the 4 Must-Haves to Bring Security into DevOps.
[http://www.devsecops.org/]