An Analysis of PCI DSS Requirement 220.127.116.11 and the Compliance Expectations
October 13, 2017, Jason Pieters, Product Director, PCI, Coalfire
For some organizations, understanding, navigating, and complying with the Payment Card Industry (PCI) Data Security Standard (DSS), especially after the release of the latest version (v3.2) released in April 2016, has become confusing and/or challenging because of the inclusion of phased-in applicability of requirements. The most common questions that Coalfire receives from clients are regarding requirement 18.104.22.168
Blockchain: Are You Ready?
October 06, 2017, Mitch Ross, Senior Consultant, Cyber Engineering, Coalfire
By now, most of us have heard of Bitcoin. Few of us really know the specifics about what that is. Fewer still have a workable (or even cursory) knowledge of the underlying technology that makes Bitcoin possible.
How I discovered CVE-2017-13707
October 05, 2017, Michael Allen, Senior Consultant, Coalfire Labs
New Vulnerability Found Using Techniques Taught at Black Hat USA
One of the topics I teach in Coalfire's Adaptive Penetration Testing course, given most recently at Black Hat 2017, is manual privilege escalation on Linux- and Unix-based systems. I also talk about how common it is to gain an initial foothold in an environment by leveraging default or easily guessable login credentials. During a recent red team engagement, I leveraged both of these techniques – not only to fully compromise the organization's Active Directory environment, but also to discover and exploit a previously unknown vulnerability in the Replibit Linux distribution installed on a server on their network.
How You Respond Can Make All the Difference
October 02, 2017, Doug Hudson, Senior Director, Cyber Risk Advisory, Coalfire
(Part Three of a Three Part Series)
As the narrative on the Equifax compromise evolves, the general public, politicians, and speculators continue to seek blame for what happened. Was it an unpatched vulnerability? Was Equifax not following proper configuration management? Was management derelict in their duties? At this point, the damage of leaking records including the personally identifiable information (PII) of 143 million people is done. However, it might be a good to look at what could have been done differently to reduce impact to the organization.
The Value of Governance in Minimizing Cybersecurity Incidents
September 27, 2017, Michael Addo-Yobo, Managing Principal, Cyber Risk Advisory, Coalfire
(Part Two of a Three Part Series)
Since Equifax’s September 15th statement about their well-publicized, broadly discussed major security incident, Coalfire has fielded multiple inquiries from clients who are wondering if such an incident could happen to them, and if there is anything that they can do to better protect and prepare themselves. While every situation is different, one thing is clear: cyber risk management ought to be a top priority for every enterprise, and that priority should be established and enforced through cybersecurity governance.