College students concerned about information security

Universities and colleges have been under significant pressure to upgrade their technology both in and out of the classroom. For instance, many organizations turn to mobility as a way to engage students and facilitate learning campus-wide. While much of the discussion is around issues such as the...

PCI DSS 3.0 puts emphasis on year-round awareness

Its easy to think of PCI compliance as just another annual hoop to jump through. Of course, after the annual audit, the business is safe for another 12 months, right? Well, not exactly, and with the upcoming release of PCI DSS 3.0, there will be an even bigger reason to think about compliance...

MAPCO Incident Highlights the Risks Faced by All Convenience Stores

On May 6, 2013, convenience store operator MAPCO Express, Inc. did a responsible thing - they issued a press release that shared important information about a data security incident that was discovered at their stores. Such notices ---along with a whole lot of behind-the-scenes investigative work...

PCI DSS 3.0 Is Coming Soon

The PCI Security Standards Council SSC plans on releasing the newest version of the PCI Data Security Standard in October, 2013. Predictably, the PCI SSC has been tight-lipped on divulging details regarding any expected changes...

FedRAMP PMO - FedRAMP Process and Developing SSP webinar Q&A

The FedRAMP program continues to gain momentum and GSA and the FedRAMP PMO conduct great, interactive, webinars available to attend live or to watch later. There is much to learn from the GSA on how to navigate the FedRAMP process according to their requirements...

The PCI SAQ P2PE-HW: Patience, POIs and PIMs

The new PCI SAQ P2PE-HW Point to Point Encryption Self-Assessment Questionnaire was released in July 2012, and many merchants are excited about the prospect of a shorter, less arduous compliance validation effort. After all, its significantly shorter than the SAQ-D; instead 12 sections, there are...

My DEFCON social engineering talk and DerbyCon

This year has been a year of firsts for me and for Coalfire. I was recently hired to my first Information security job as a penetration tester for Coalfire Labs, the forensic and app/network testing side of Coalfire. Many of the Coalfire Labs team attended DEFCON in Las Vegas in early August.. No...

Password Management: How many do you need to remember?

In todays online world, the proliferation of usernames and passwords has resulted in a cottage industry springing up to meet the need to keep track of them in a secure manner. Software and hardware providers have developed a number of unique approaches to deal with this problem, but they all...

Coalfire in the News

Its been quite a season in the world of IT security as we move into 2012. As experts in our field, we are often asked to comment on current trends and recent stories. Take some time to check out what we have had to say recently:...

View TPRM risk through four lenses

In recent years, as attackers seek to gain entry and disrupt business through vendors, Third Party Risk Management TPRM has proven to be a top priority item for every organization. As organizations mitigate the risks associated with a third party-related attack, leaders should continue to address...

CMMC – The smoke is clearing

The smoke is finally starting to clear on "CMMC 2.0." Hundreds of companies are already lining up for Cybersecurity Maturity Model Certification assessments. Everything is taking place faster and with far more urgency than most organizations have planned around or prepared for...

Hacking Ham Radio: WinAPRS – Part 3

In part two of this series, we reviewed our WinAPRS software and hardware configuration. We then began reverse engineering WinAPRS and fuzzing it for vulnerabilities using modified open-source software. Finally, we identified a potentially exploitable vulnerability. This installment will dig into...

Getting started with ZAP and the OWASP top 10: common questions

I recently received an email from a developer who was gearing up to use OWASP ZAP to test the security of their code. The developer had some questions about OWASP ZAP, testing for the OWASP Top 10 2013, and ZAP configuration. After I answered the email, I asked if I could repost it here because I...

Managing Application Vulnerabilities Manually?

In spite of the fact that automation and application vulnerability resolution platforms like ThreadFix have existed for a decent length of time, we continue to see organizations that try to muscle ahead with their existing manual processes. We continue to be surprised that organizations manage...

Reflections on Women in Cybersecurity

I joined Coalfire in 2014. At the time, there were very few women in cyber, much less in leadership roles. As it sometimes happens, I found myself in an elevator with Tom McAndrew, who is now our CEO. We started talking about the direction of my career and plans for my role as Director of Coalfir...

A strategy for cybersecurity strategy

Let's start with an assumption: Having a cybersecurity strategy is best practice. So, what makes a good cybersecurity strategy? You'd be surprised how this answer varies across the security industry, especially from seasoned CISOs of Fortune 500 companies...

Am I doing it right? An introspective look at "why it's like this"

Cybersecurity, as a practice within organizations, has existed for decades. Larger or government organizations have had dedicated cybersecurity functions in place since at least the 90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large...

Cloud Security Governance - Optimizing the Business Benefits of Security in the Cloud

Enterprises are increasingly pursuing the business advantages of migrating technology platforms and services into the cloud environment leveraging one or more of the three main cloud service areas - Infrastructure as a Service IaaS, Platform as a Service PaaS, and Software as a Service SaaS. Thes...

Cyber Engineering for 2018 and Beyond

2017 could be considered one of the most exciting or horrifying years in the technology industry. End-of-year statistics showed that the number of reported breaches in the business sector saw a 21% increase over the previous year, and headlines from all major news outlets were riddled with report...

Blueborne – Don’t Panic!

Here is what we know right now: Security company Armis recently released research identifying eight newly discovered vulnerabilities that exist in the wireless communications protocol Bluetooth, which could potentially affect a large percentage of the estimated 8.2 billion Bluetooth enabled...

How to Address Major Gaps in Third-Party Risk Management Programs

While securing the organizational environment, its easy to focus on the enterprise assets without thinking as much about the vendor ecosystem. However, that extended ecosystem and how it interacts with the organization is a potential significant risk if not secured properly...

Getting the Most Value Out of Your Phishing Program

Are your phishing tests worth the money you are spending on them? Please dont misinterpret that as suggesting you shouldnt be testing your users. To the contrary, I think you should be testing all your users executives of all ranks included on a regular basis. What I mean by that question is; are...

SOC 2 Type 1 and SOC 2 Type 2 Frequently Asked Questions

Coalfires SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you wil...

To [Hell] Shell and Back

My initial thought was it has to be the firewall keeping my reverse shell from getting out of their environment. So, leveraging the command execution vulnerability, I started testing outbound internet access from the vulnerable server to my server on the internet, only to find that the port I had...

Thoughts on BSides Las Vegas 2016

I recently attended "Infosec Week" in Vegas - Black Hat, BSides and DEFCON. BSides is a high point every year. This smaller Con has a plethora of perks which make it a "must attended" and also offers many of the same benefits or advantages or opportunities as Black Hat and DEFCON...

One Way to Boost Proactive Cybersecurity

Its clear from media articles that new CISOs need to make an immediate impact on their organizations security program in the first 90 days with action items such as "make a quarterly plan for the next year"...

Highlights from the HITRUST Health Industry Third Party Assurance Summit

On June 29, 2015, the Health Information Trust Alliance HITRUST announced that several massive payer organizations, including Anthem, Health Care Services Corp., Highmark, Humana, and UnitedHealth Group will require their business associates to obtain CSF certification. While this is old news,...

PCI Scope Assessments for Higher Education Institutions

With the release of PCI DSS version 3.0 and more recently 3.1, many Higher Education Institutions have found it hard to know which SAQs they should be filling out since there are now nine options. Higher Education Institutions have very complex merchant card environments and with the new...

Upcoming Podcast: Python security projects

Join Coalfire penetration tester Dan McInerney on Thursday April 30th at 6:00pm ET on the Security Weekly Podcast...

COSO Framework for Service Organizations and SOC Reporting (Part 1 of 3)

One of the most important reference tools that companies use to establish and evaluate their internal controls is the Committee of Sponsoring Organizations COSO Internal Control - Integrated Framework. Initially published in 1992 the 1992 Framework, the COSO framework has been the most widely use...

Their Claim to Fame – So-Called HIPAA-Compliance Experts and Tools

Have you noticed how many vendors and software solutions are out there claiming they can make you HIPAA-compliant? Well, at the end of the day thats simply not possible because only you can make your organization HIPAA-compliant. I came up with a list of "red flags" that I typically see from...

Social Engineering- Beyond the Baseline

Coalfire Labs does a lot of Social Engineering testing. Traditional Social Engineering testing involves a mundane process of taking a sample of a population and then attacking those "targets" with some pretext calls or a phishing email in order to obtain credentials. Metrics are recorded and then...

PCI Community Meeting - EMV Chip Update

Randy Vanderhoof, Executive Director, EMV Migration Forum EMF, presented the EMV Chip Update today at Day Two of the PCI Community Meeting. The session provided attendees with insights into the EMV chip migration process in the U.S. and how this impacts PCI security efforts...

DoD DIACAP transition to RMF approved

Welcome DIARMF! This has been a long time coming. From DITSCAP to DIACAP and now to DIARMF the Department of Defense approved the transition to a Risk Management Framework RMF approach developed by NIST on March 12. What does this mean for Information Systems and Platform Information Technology...

A Proven Strategy for Implementing Vendor Management Programs

Every regulated industry includes a requirement for managing third-party risk. Some industries are further along the path and have more mature processes than others. However, there are tried and true methodologies and standards established by those early movers that we can utilize across other...

All Aboard the HIPAA Omnibus - but is the ‘bus’ missing anything?

In the wake of the recently-released HIPAA Omnibus Rule with its upcoming deadline, healthcare organizations are trying to figure out how theyre going to achieve compliance. Weve been busy trying to get through the 563-page rule and determine what it means to our clients...

What's Next in Retail IT? The Convergence of Mobile, P2PE and the Cloud

Greetings from the Javits Center in New York City, the site of the National Retail Federations Big Show. This year, the theme of NRF is "Next". When it comes to Retail technology - and in particular, security and compliance, the most talked about "next" things are:...

IT Security Horror Stories: The Case of the Phantom Technician

At Coalfire Labs, we discover--and help our clients address--a lot of scary security and compliance problems. Like zombies out looking for a victim, nefarious characters are out to attack your IT infrastructure and compromise your systems. Even when organizations have protections in place, the...

Formalized IT Security Policy Now Required for Government Prime and Sub-contractors

This month the GSA announced an IT security mandate for government prime- and sub-contractors that requires them to have a formalized IT security plan that includes periodic audits. Many government sub-contractors, large and small, will benefit from a third-party compliance program review so they...

Cyber Defense Summit 2011

On September 14, we will be partnering with InfraGards New York City Alliance to host a one-day Cyber Defense Summit. This year we have seen a drastic increase in data breaches. As these hacks have become daily occurrences, enterprises must learn how to protect their data while simultaneously...

Hacking Ham Radio: WinAPRS – Part 1

Hackers have been breaching computer system defenses for more than half a century, and the networks they use to exploit those weaknesses have been around for far longer than that. With the internet replacing most wirelines and wavelengths, and with the rise of cybercrime sophistication from petty...

The paradigm shift of PCI SSF: what executive leaders need to know now

As a security leader who lives and breathes security controls, protocols, and compliance standards, youre probably aware of the upcoming Payment Card Industry PCI Software Security Framework SSF transition thats been coming for some time. In fact, I posted a blog about the phase-out of the...

The biggest update you’ll barely see

Its been more than 10 years since ThreadFix had its first lines of code written by its creator, Dan Cornell, as a means of solving a very pervasive issue in the application security space. While it quickly became a popular talking point at conferences and app sec parties they exist!, it was never...

AppSec Bites: A Podcast on Balancing Speed and Thorough AppSec Coverage (Part 1)

In the world today we have all become so accustomed to high-speed delivery and the instant gratification it instills any large 2-day shipping retail monsters come to mind?. Its only natural that the demand for speed and efficiency we are experiencing in our daily lives has expanded to the...

Applied ThreadFix: Application Portfolio Tracking

Asset management is a serious issue across the information security space. A very common challenge we see for organizations running an application security program is just getting an idea of what applications they have available and what infrastructure has been deployed to support them. You cant...

Managing Vulnerabilities Introduced from Open Source Code Libraries

Modern development architectures are commonly based around open source components. Using open source components helps organizations lower their overall development cost while improving the time to market for new applications. Introducing these components however, can lead to serious consequences...

Applied ThreadFix: Effective security team collaboration

Modern enterprises are distributed. Most ThreadFix deployments have stakeholders spanning development and security teams and those team members are spread around the globe. To support these distributed organizations, ThreadFix has a number of collaboration features that make teams more efficient...

Applied ThreadFix: Automated Vulnerability Exception Reporting

One of the most valuable things about ThreadFix is that it centralizes the results of all your testing, assurance, and remediation activities so you no longer have separate silos of data. This is really valuable from a reporting standpoint. If you need to you can drill down into specific parts of...

Managing Web Application Security

Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...

A Cyber Engineering Primer: Automated Tools for Compliance Auditing

Cybersecurity practitioners sometimes forget to define and explain the terms we use during the course of our work. Thus, my colleagues and I have embarked on a series of posts that provide a primer on some of the most important cyber engineering practices. In this post, we will focus on...