• Headless, Unattended Scanning in Burp Suite Professional 2.0 with Seltzer

    Gabriel Merritt, Senior Security Consultant, Coalfire Labs

    Burp Suite Professional (Burp) is one of the best tools available for penetration testers. It is feature-rich, intuitive, well-supported, and customizable. However, it can be difficult to use Burp for headless, unattended scanning. Alternatives such as Burp Suite Enterprise exist, but those of us with Burp Suite Professional may want to leverage it to perform this type of work. For years, my tool of choice for this has been the Burp extension Carbonator. Available in the BApp Store, Carbonator provides a means to interact with Burp via the command line, scanning a target and exporting the results as HTML. It is a great extension that has worked well, until the release of Burp 2.0.

    Read more
  • A new way to manage supply chain risk – Introducing the AICPA SOC for Supply Chain report

    Jeff Cook, SOC Director, Coalfire

    With the continuation of its System and Organization Controls (SOC) suite of services (SOC 2®, SOC for Cybersecurity, etc.), the American Institute of Certified Public Accountants (AICPA) has released a new report format that focuses on manufacturing and distribution supply chains. The AICPA’s SOC for Supply Chain framework helps these organizations communicate their processes and controls to support their supply chain risk management, as well as to detect, prevent, and respond to supply chain risks. Organizations can also use SOC for Supply Chain reports to help understand and manage their external risks (including cybersecurity) that are typically related to their vendor or distribution networks.

    Read more
  • Establishing risk appetite is key to effective risk management

    Mandy Pote, Director, Cyber Risk Services, Coalfire

    The mission of an enterprise risk management program is to respond to and monitor risks to the enterprise’s operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite thresholds will ensure that risks are mitigated consistently at all levels of the organization.

    Read more
  • Remote Workforce is NOT the New Norm, but “Secure Work Anywhere” Should Be

    Jonathan Leach, Principal, Cyber Risk Services, Coalfire

    Secure Work Anywhere (SWA) is a new term for an old idea that is quickly becoming an industry standard. The overall principles of SWA are not new, but the risks associated with increased rates of workers connecting from potentially unsecure networks highlight the importance of those principles now more than ever. Although your workers may not always be remote, they should always be secure.

    Read more
  • Am I doing it right? An introspective look at "why it's like this"

    Mike Weber, Vice President, Coalfire Labs

    Cybersecurity, as a practice within organizations, has existed for decades. Larger (or government) organizations have had dedicated cybersecurity functions in place since at least the ‘90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large organizations had a CISO, and by 2017, over 85% of ALL organizations have appointed a CISO.

    Read more
  • What to Expect in the initial FedRAMP briefing with your Agency Sponsor and the PMO

    Nick Peters, Senior Manager, FedRAMP Assurance Services, Coalfire

    Most people who have spent any time researching the FedRAMP authorization process know there are two routes for a Cloud Service Provider (CSP) to become FedRAMP authorized: Agency and Joint Authorization Board (JAB). Because of the limited number of CSPs selected each quarter for the JAB authorization process (FedRAMP Connect), many CSPs follow the agency authorization path. In fact, 77% of authorized CSPs have an Agency Authorization to Operate (ATO).

    Read more
  • FedRAMP – 8 years in and 100 assessments achieved

    Michael Carter, Vice President, Cyber Assurance – FedRAMP

    Back in 2011, if you had asked me what cloud computing was, I would have looked at you with a blank look on my face. At the time, I was supporting a Federal client when my boss asked me to assist in applying to become a 3PAO. I had no clue what 3PAO even stood for (it stands for Third-Party Assessment Organization), but I volunteered to support the cause.

    Read more
  • Cybersecurity Risk Management – From HIPAA to HITRUST

    Rich Curtiss, Director, Healthcare Risk Assurance Services

    Cybersecurity risk management for healthcare organizations continues to be a perplexing issue. While it is explicit in the security management standard of the HIPAA Security Rule that a Covered Entity and their Business Associates must conduct an “accurate and thorough” risk analysis teamed with a plan to “implement security measures to reduce risks,” it is not immediately clear how this is to be accomplished.

    Read more
  • Cloud Transformation and the Shared Security Model

    Sean Cyriaque, Senior Consultant, Cyber Risk Advisory, Coalfire

    For many organizations, the lure of the cloud is very strong. Large enterprises usually have several justifications for adopting cloud-based services including preserving capital, adding scalability to applications, and minimizing IT staffing needs. Small- to medium-sized organizations often look at the cloud as an avenue to achieve all those same goals without the need for improved security skills from their existing IT staff. But as the number and sophistication of attacks in the cloud grow exponentially, there is increasing confusion regarding who is responsible for the security and compliance of applications and data in the cloud.

    Read more
  • The Basics of Exploit Development 3: Egg Hunters

    Andy Bowden, Consultant, Coalfire Labs

    Hello dear reader. If you have read the other articles in this series, welcome back!  If not I encourage you to read the previous installments before proceeding with this post. This post covers a surprisingly useful technique in exploit development called Egg Hunters. In order to demonstrate how Egg Hunters function, we will write an exploit for a 32 bit Windows application vulnerable to a SEH overflow. However, due to how the application handles input, we will be required to use an Egg Hunter to locate our payload in memory move execution to it.

    Read more
  • What to Expect When You are Expecting… Your CISO to Leave

    Kurt Manske, Director, Cyber Risk Advisory, Coalfire

    “The CISO is leaving the company. What are the next steps?”

    No executive likes to hear that a key member of the business is leaving the organization. Turnover among key business leaders isn’t unusual, but as a factual matter, CISO average tenure is relatively short – approximately 24 to 48 months.

    Read more

Recent Posts

Post Topics

Archives

Tags

Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff CISO cloud CMMC CoalfireOne Compliance Covid-19 credit cards C-Store Culture Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DevSecOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi women XSS
Top