• Data Governance in the Cloud

    Jonathan Leach, Principal, Cyber Risk Services, Coalfire

    Data governance is something your organization has likely considered, put into action, and implemented. The question is, to what degree is the data actually being governed – or not?

    Read more
  • The HITRUST Common Security Framework: Not Just for Healthcare Anymore

    Andrew Barratt, Managing Director, Europe

    The HITRUST 2019 conference took place last month in Dallas, Texas, and covered important topics such as risk management, compliance, third-party assurance, cybersecurity, medical devices, and the Internet of Things (IoT). As speakers and sponsors, we saw much enthusiasm about HITRUST Common Security Framework (CSF) validation and certification outside of the healthcare industry.

    Read more
  • Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel

    Esteban Rodriguez, Consultant, Coalfire Labs, Coalfire

    As a penetration tester at Coalfire Labs, I frequently use exploitation frameworks such as Metasploit or PowerShell Empire to perform post-exploitation actions on compromised endpoints. While anti-virus (AV) bypass and detection avoidance is often trivial in all but the most mature environments, detections from AV have caused me to look toward custom tooling to mitigate the risk of being detected by both traditional AV as well as security operations teams relying on network indicators. Over the past year I’ve been slowly developing my own tooling to deal with these challenges.

    Read more
  • Fuzzing: Common Tools and Techniques

    Andy Bowden, Consultant, Coalfire Labs

    Fuzzing is a software testing methodology that can be used from either a black or white box perspective and predominantly consists of providing deliberately malformed inputs to an application to identify errors such as unhandled exceptions, memory spikes, thread hangs, read access violations or buffer overruns that could lead to further compromise of a system.

    Read more
Top