• Waiting, Waiting, Waiting... Is There a Right Time for Breach Notification?

    September 28, 2018, Andrew Brosman, Senior Security Consultant, Cyber Risk Advisory

    Recently, a popular online retailer revealed a month-long data breach. Card-skimming code was found capturing customer credit card data from the payment page of its website and sending that data to what appeared to be a legitimate server (with a similar domain name and a valid HTTPS certificate). The company has not yet determined which customer accounts may have been affected, so the extent of the damage is yet to be determined.

    Read more
  • The Unhealthy Security of Healthcare

    September 25, 2018, Qasim Ijaz, Director, Coalfire Labs

    I have been involved in a number of healthcare penetration tests here at Coalfire and in my previous roles. I have hacked electronic medical records, medical devices, and most importantly, humans. From my time as a systems engineer at a medical device and systems vendor to my current role at Coalfire as a penetration tester, I have seen a few healthcare organizations grow from highly insecure to cyber-fortresses. In this blog, I will highlight the most common issues my teammates and I come across while penetration testing healthcare environments.

    Read more
  • Leading in Privacy

    September 25, 2018, Mali Yared, Practice Director, Cyber Risk Advisory & Privacy, Coalfire

    On September 24, I was pleased to represent Coalfire (and private-sector expertise) by attending the kickoff for the Privacy Framework at the Brookings Institute in Washington, D.C. The event was attended by notable leaders in the industry and government: The Departments of Transportation and Commerce, the Information Technology Industry Council, Intel, Citrix, National Telecommunications, and various other notable public and private-sector leaders in the industry. The National Institute of Standards and Technology (NIST) is taking steps toward pulling the various, splintered privacy initiatives in our nation together into a focused approach – and it is very exciting to see.

    Read more
  • Phantom Acquisition Lets Splunk SOAR

    September 12, 2018, Matt Alshab, Certified Splunk Admin

    At the SplunkLive! Conference in Washington, D.C., Splunk gave a presentation on Phantom, a Security Orchestration, Automation, and Response (SOAR) system. Splunk acquired Phantom this year for $350 million.

    Read more
  • From OSINT to Internal: Gaining Domain Admin from Outside the Perimeter

    September 11, 2018, Esteban Rodriguez, Consultant, Coalfire Labs, Coalfire

    When I first began working at Coalfire in early 2017, I couldn’t wait to get started pentesting professionally for the first time. When I finally got tasked with my first gig, I dove right in. I was tasked to perform an assessment of the external network. After hitting all known servers and web applications with various scanning tools, I had nothing. For a penetration tester, the assessment does not end here.

    Read more
  • Exploiting Blind Java Deserialization with Burp and Ysoserial

    September 04, 2018, Esteban Rodriguez, Consultant, Coalfire Labs, Coalfire

    While performing a web application  penetration test, I stumbled upon a parameter with some base64 encoded data within a POST parameter. Curious as to what it was, I sent it over to Burp decoder.

    Read more

Recent Posts

Post Topics

Archives

Tags

2.0 3.0 access Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff cloud CoalfireOne Compliance credit cards C-Store Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Ed Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi wireless women XSS