• Help Net Security – ThreadFix 3.0 Review

    ThreadFix Team, Coalfire

    Help Net Security recently published a review of ThreadFix 3.0. Security Researcher, Toni Grzinic, took a deep dive into our vulnerability management platform and broke down everything from infrastructure, reporting and analytics, to integrations, and beyond. Click here to read Toni’s full review of the platform and see how ThreadFix can help your organization bridge the gap between security and development teams.

    Read more
  • Applied ThreadFix: Seeding Your Application Portfolio with OWASP Amass

    Dan Cornell, VP, Product Strategy

    OWASP Amass is a great tool for asset discovery and enterprise attack surface mapping. It pulls data from a number of different data sources and identifies potential hosts and applications associated with organizations, domains, IP CIDRs and other identifiers. As we have noted, having a solid Application asset portfolio is table stakes for any credible application security program, so this post will look at ways to use OWASP Amass to help craft that application asset portfolio.

    Read more
  • Applied ThreadFix: Application Portfolio Tracking

    Dan Cornell, VP, Product Strategy

    Asset management is a serious issue across the information security space. A very common challenge we see for organizations running an application security program is just getting an idea of what applications they have available and what infrastructure has been deployed to support them. You can’t protect attack surface that you don’t know about, so trying to run a successful program without at least a decent concept of what your portfolio’s attack surface looks like is a non-starter. Note that this isn’t even looking at all the challenges associated with vulnerability management – this is the problem you have to address before you get to start addressing the vulnerability management problem. The issue is something I had been talking a lot about a year or so ago, and I presented at a couple of conferences.

    Read more
  • The Basics of Exploit Development 5: x86-64 Buffer Overflows

    Andy Bowden, Consultant, Coalfire Labs

    In this article we will be covering a technique similar to the one in the first installment of this series, however, with the twist in that this exploit will be of a 64-bit process running on Windows 10. Due to the nature of modern operating systems and the exploit mitigation techniques they employ, this will not be a very realistic example due to the fact that we will be disabling everything so we can concentrate on a few aspects of exploiting a 64-bit application. Specifically, we will be looking at the differences in how the different architectures call functions and how the features of the 64-bit method can be leveraged to exploit a vulnerability.

    Read more
  • Offensive Security Testing Using Cloud Tools

    Rick Osgood, Senior Security Consultant, Labs

    When performing offensive security testing, assessors sometimes run into issues where their source IP address gets blacklisted. For example, we might be performing a web application test and, due to the many suspicious queries being performed, our IP address is suddenly blocked. While on the surface this may seem like an effective security control, it’s actually quite easy to change a source IP address. Methods have existed for a long time, including using a proxy server or routing traffic through a VPN tunnel. The problem with these methods is that they take effort to set up and those new source IP addresses can just as easily be blocked, leaving assessors in the dark once again. When doing this kind of work every day, it would be nice to have an efficient method for changing a source IP address for this kind of testing without risking getting blacklisted.

    Read more
  • Reflections on Women in Cybersecurity

    Anne Bayerkohler, Senior Director, Quality and Compliance, Coalfire

    I joined Coalfire in 2014. At the time, there were very few women in cyber, much less in leadership roles. As it sometimes happens, I found myself in an elevator with Tom McAndrew, who is now our CEO. We started talking about the direction of my career and plans for my role as Director of Coalfire’s Quality Management System. He asked me a simple question, “What are you doing next?” I had to suddenly come up with a literal elevator pitch of what I could do in my sphere of influence.

    Read more

Recent Posts

Post Topics