The Cloud is Beige - The demise of black box testing
April, 2020, Mike Weber, Vice President, Coalfire Labs
Black-box penetration testing is dead. I’d question why it is even a consideration. It’s of limited and dubious value in almost any context. Wait, wait… I didn’t mean that. Put down the pitchforks and torches, development and QA teams, I’m only talking about black-box penetration testing. Yes, traditional software functional or regression testing in a black-box manner does have a purpose. Validating the functional requirements of the code has a place, and it’s valuable. Non-functional black-box testing has a place as well, when evaluating the sturdiness of an application such as load testing and the like. Settle down. Read more
Compliance in the Cloud - Effective Strategies to Minimize to Ensure Success
March, 2020, Adam Kerns, Managing Principal, Commercial Services: Product Development, Coalfire
It's no secret that the principles, controls, and terminology associated with compliance can be a confusing alphabet soup that hinders an organization's ability to go-to-market and expand its customer base. The difficulties in meeting compliance objectives are not limited to organization size or types. Most (if not all) organizations struggle to integrate compliance requirements into their existing workloads and systems.
Data Governance in the Cloud
June, 2019, Kurt Hagerman, CxO Advisor, Cyber Strategy, Coalfire
Data governance is something your organization has likely considered, put into action, and implemented. The question is, to what degree is the data actually being governed – or not?
Is Cloud Computing Really New? And Other Insights on the Changing Face of Cloud
May, 2019, Kurt Hagerman, CxO Advisor, Cyber Strategy, Coalfire
What is cloud computing, and why is its increased use getting so much attention? In my view, cloud computing is just the latest iteration of what started back in the days of the IBM service bureaus of the 1960s and ‘70s. Back then, only a handful of organizations had the resources to own and operate IBM mainframe computers. Those that did eventually realized they were only using a fraction of these computers’ capacity; and so, they came up with a novel approach – rent computing time to other organizations that couldn’t afford to own a mainframe themselves but could take advantage of the computing power they offered. This was easily done given the security model and ability to partition memory and processing built into the mainframe. Voila! Cloud computing was born!
Continuous Monitoring in the Cloud
June, 2018, Michael Pitcher, Vice President, Technical Cyber Services, Coalfire Federal
I recently spoke at the Cloud Security Alliance’s Federal Summit on the topic “Continuous Monitoring / Continuous Diagnostics and Mitigation (CDM) Concepts in the Cloud.” As government has moved and will continue to move to the cloud, it is becoming increasingly important to ensure continuous monitoring goals are met in this environment. Specifically, cloud assets can be highly dynamic, lacking persistence, and thus traditional methods for continuous monitoring that work for on-premise solutions don’t always translate to the cloud.