4 min
IoT
Lessons and Takeaways from CTIA’s Recently Released IoT Security Certification Program
The CTIA recently announced a new cybersecurity certification program for cellular- and Wi-Fi-connected IoT devices. Here is my high-level overview of this program.
1 min
Metasploit Weekly Wrapup
Metasploit Wrapup: 8/24/18
ssh_enumusers Gets An Update
wvu integrated the malformed packet technique
into the ssh_enumusers module
originally written by kenkeiras . This module
allows an attacker to guess the user accounts on an OpenSSH server on versions
up to 7.7, allowing the module to work on more versions than before.
GSoC Wraps Up
As Google Summer of Code finished up, Framework received an array of new and
exciting features. WangYihang
3 min
IoT
Enhancing IoT Security Through Research Partnerships
Securing IoT devices requires a proactive security approach to test both devices and the IoT product ecosystem. To accomplish this, consider setting up a research partnership.
4 min
Cross-Site Scripting (XSS) Can Steal Payment Information from Payment Processors
This blog was previously published on blog.tcell.io.
Just because your payment processor has PCI Level 1 doesn't mean you can ignore
cross-site scripting (XSS)
. If you handle
money, you process credit cards (since it's pretty hard to email cash). To
prevent fraud, the card industry has created the PCI Data Security Standard
. So, if you're processing cards, you'll
be safe if you follow the specifi
3 min
What's Going on in Production Application Security 2018
Today, we released theSecurity Report for Web Applications
(Q2 2018) which identified key threats in real-world web
application traffic in the Amazon Web Services (AWS) and Azure cloud ecosystems.
In evaluating 316 million incidents, it is clear that attacks against the
application are growing in volume and sophistication, and as such, continue to
be a major threat to business.
The majority of web application attacks are the result of overall scanning for
vulnerabilitie
4 min
Endpoint Security
Endpoint Agents Are Necessary for Today’s Modern Environment: Here’s Why (Part 1)
Endpoint agents can help you integrate your siloed vulnerability management and incident detection and response programs and implement SecOps practices.
5 min
Penetration Testing
Password Tips from a Pen Tester: Taking the Predictability Out of Common Password Patterns
Humans are predictable. As unique as we like to think we all are, our actions tend to be similar—and our choices when creating a password are no different.
4 min
Penetration Testing
CIS Critical Security Control 20: Measure Your Security Standing with Penetration Tests and Red Team Exercises
Protecting yourself from threats requires consistently asking yourself whether your security program is working as designed. Critical Control 20 covers pen tests and Red Team exercises.
3 min
Metasploit
Metasploit Wrapup: 8/17/18
We had a great time meeting everyone at the various Metasploit events at hacker summer camp last week, including two popup capture the flag events with Metasploitable3, the Open Source Security Meetup and selling Metasploit 0xf Anniversary Tour.
4 min
Threat Intel
The Top Threat Actors Targeting Financial Services Organizations
This post discusses the key motivations and supporters behind cybercrime groups and lists the top groups that target financial services organizations.
2 min
Analysis of the Ticketmaster Breach
This blog was previously published on blog.tcell.io.
Although there have been a number of breaches in the past few weeks, the story
around the breach at Ticketmaster
is more interesting than most. It combines sophisticated web design, reusable
components, the security model of the web browser, and even a dash of payment
regulations.
The breach itself is interesting b
3 min
Compliance
Address the NAIC Insurance Data Security Model Law
The NAIC Insurance Data Security Model Law suggests a modern approach to detecting and responding to threats. This post looks at a few interesting requirements and shares how we can partner with your team across people, process, and technology.
3 min
InsightAppSec
Scan Management with InsightAppSec: There’s More to Application Security than Long Lists of Vulnerabilities
Knowing what you are scanning, how often, and with how much success is vital to knowing your vulnerability data is accurate, up-to-date, and reflects your security position. InsightAppSec can help.
4 min
Events
A Tale of Security Summer Camp: Rapid7's 2018 Recap of Black Hat and Beyond
From conference talks and business hall exhibitions to security trainings and personal conversations, the big takeaway from the past week was undeniable. Our industry is at an inflection point, and everyone is focused on a common theme: unification.
2 min
Patch Tuesday
Patch Tuesday - August 2018
Microsoft's updates this month
address over 60 vulnerabilities, 20 of which are classified as Critical. As
usual, most of this month's fixes are browser-related, and nearly half of the
flaws could lead to remote code execution (RCE). Patches for Exchange, SQL
Server, and Microsoft Office were also released.
Two of this month's vulnerabilities have already been seen exploited in th