Data Governance in the Cloud
Jonathan Leach, Principal, Cyber Risk Services, Coalfire
Data governance is something your organization has likely considered, put into action, and implemented. The question is, to what degree is the data actually being governed – or not?
The HITRUST Common Security Framework: Not Just for Healthcare Anymore
Andrew Barratt, Managing Director, Europe
The HITRUST 2019 conference took place last month in Dallas, Texas, and covered important topics such as risk management, compliance, third-party assurance, cybersecurity, medical devices, and the Internet of Things (IoT). As speakers and sponsors, we saw much enthusiasm about HITRUST Common Security Framework (CSF) validation and certification outside of the healthcare industry.
Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel
Esteban Rodriguez, Consultant, Coalfire Labs, Coalfire
As a penetration tester at Coalfire Labs, I frequently use exploitation frameworks such as Metasploit or PowerShell Empire to perform post-exploitation actions on compromised endpoints. While anti-virus (AV) bypass and detection avoidance is often trivial in all but the most mature environments, detections from AV have caused me to look toward custom tooling to mitigate the risk of being detected by both traditional AV as well as security operations teams relying on network indicators. Over the past year I’ve been slowly developing my own tooling to deal with these challenges.
Fuzzing: Common Tools and Techniques
Andy Bowden, Consultant, Coalfire Labs
Fuzzing is a software testing methodology that can be used from either a black or white box perspective and predominantly consists of providing deliberately malformed inputs to an application to identify errors such as unhandled exceptions, memory spikes, thread hangs, read access violations or buffer overruns that could lead to further compromise of a system.