SEC Roundtable

On Wednesday, I attended a roundtable discussion the Securities and Exchange Commission held to gather information on cybersecurity trends and potential disclosure requirements for regulated public companies and stock exchanges...

PCI SSC Releases New SAQ Versions for 3.0

As expected, the SSC finally released the new version of the Self-Assessments Questionnaires SAQs today on their website. They are available on the PCI SSCs website here:...

PCI DSS 3.0 Is Coming Soon

The PCI Security Standards Council SSC plans on releasing the newest version of the PCI Data Security Standard in October, 2013. Predictably, the PCI SSC has been tight-lipped on divulging details regarding any expected changes...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

P2P Encryption Program now available from PCI Council

The PCI council has updated the Point-to-Point encryption P2PE program requirements PDF. The update impacts merchants, payment applications, point of sale vendors and service providers. As a participating organization of the PCI P2PE task force, providing input into the standard, I wanted to...

Moving to the Cloud: Considerations for Implementing Cloud Migration Plans

Over 60 executive level attendees came to the Omni Interlocken Resort in Broomfield, Colorado for the National Council of Higer Education Loan Programs NCHELP Spring convention and to hear from a panel of cloud experts on how the migration to cloud IT services could impact their business in the...

Mobile Banking Malware: Protect Your Finances

The prolific rise in smartphones, tablets and other portable devices has greatly expanded the ways in which we interact with personal and professional services. The public can now singlehandedly use their mobile device to pay for things with the ease of flashing their cell phone. Unfortunately,...

RSA 2012: Mobile, Cloud, and Intelligent Control

It was good to catch up with our customers and partners at RSA 2012 this week. Much of the buzz this year was around mobile devices and securing the cloud. We were glad to see innovative organizations introducing compliance-validated architectures based on these emerging technologies. One such...

Electronic Health Records and Meaningful Use: Protecting Electronic Health Information

Since 2009, healthcare providers and other companies providing services to the healthcare industry have been mobilizing to take advantage of government incentives to implement Electronic Health Records or EHRs. These incentives were established by federal law as a part of the HITECH Act of 2009,...

Compliance and the Cloud

"The Cloud" is a hot topic right now. Yet most people cant even define what "the cloud" really is. As I talk to more companies, who are considering the move, they all have two main concerns: security and compliance. Of course, security and compliance are key when it comes to cloud computing, but...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

How Fortune 500s are building brand value by communicating security posture

With Covid and cloud migration driving new threats and vulnerabilities, security concerns are now top of mind with customers. As a result, buyer perception about an organizations security and compliance posture can be leveraged to build market trust and high-value brand magic for virtually every...

Security Performance Reporting: Command guidance for CISO-to-stakeholder communications

There is tremendous urgency for security professionals to do a better job at communicating security program performance to enterprise stakeholders and boards of directors. For the Coalfire Cloud Advisory Board CAB, effective reporting on this level is mission-critical for cyber teams, and was a...

The paradigm shift of PCI SSF: what executive leaders need to know now

As a security leader who lives and breathes security controls, protocols, and compliance standards, youre probably aware of the upcoming Payment Card Industry PCI Software Security Framework SSF transition thats been coming for some time. In fact, I posted a blog about the phase-out of the...

The biggest update you’ll barely see

Its been more than 10 years since ThreadFix had its first lines of code written by its creator, Dan Cornell, as a means of solving a very pervasive issue in the application security space. While it quickly became a popular talking point at conferences and app sec parties they exist!, it was never...

AppSec Bites: What Opportunities Does Remote Working Create for AppSec Teams? (Part 3)

Its no secret that the pandemic has shifted the operational mindset of many organizations as we adapted to a fully remote workspace. In additional to this, many businesses were subjected to tighter budgets, compelling them to find ways to be more efficient and cost effective. The automation of...

Key scoping factors when pursuing ISO 27001 certification

Service providers that seek the most recognized implementation of an information security baseline and governance structure should consider the ISO/IEC 27001:2013 "ISO 27001" standard. The information security management system ISMS prescribed by this widely adopted publication engages personnel ...

What to Expect When You are Expecting… Your CISO to Leave

"The CISO is leaving the company. What are the next steps?" No executive likes to hear that a key member of the business is leaving the organization. Turnover among key business leaders isnt unusual, but as a factual matter, CISO average tenure is relatively short - approximately 24 to 48 months...

So your company has decided to do FedRAMP - What does that mean?

The exponential increase in cloud adoption in recent years has led to a dramatic increase in technology companies evolving from software and application companies to Software as a Service SaaS, Platform as a Service PaaS or Infrastructure as a Service IaaS providers. The 2011 release of the Cloud...

Applied ThreadFix: Effective security team collaboration

Modern enterprises are distributed. Most ThreadFix deployments have stakeholders spanning development and security teams and those team members are spread around the globe. To support these distributed organizations, ThreadFix has a number of collaboration features that make teams more efficient...

An Analysis of PCI DSS Requirement 11.3.4.1 and the Compliance Expectations

For some organizations, understanding, navigating, and complying with the Payment Card Industry PCI Data Security Standard DSS, especially after the release of the latest version v3.2 released in April 2016, has become confusing and/or challenging because of the inclusion of phased-in applicabili...

How You Respond Can Make All the Difference

Part Three of a Three Part Series As the narrative on the Equifax compromise evolves, the general public, politicians, and speculators continue to seek blame for what happened. Was it an unpatched vulnerability? Was Equifax not following proper configuration management? Was management derelict in...

DevOps, Automation, Security and Compliance

Phew, the title of this post alone sounds like it could be quite a lot to deal with! So what is DevOps? DevOps is simply the blending of infrastructure operations processes and software development to enable faster changes to business applications/technology. These processes share a lot of ideolo...

FedRAMP Prioritization

Coalfire has been participating in the American Council for Technology and the Industry Advisory Council ACT-IAC Cloud Computing community of interest in order to contribute in developing the new FedRAMP JAB Prioritization process...

Best of Enterprise and AD Exploitation at Black Hat / DEFCON

Lots of hacks, lots of people, lots of content, and lots of parties. That basically sums up this years BlackHat and Defcon. The two conferences seem to get bigger every year with no sign of slowing down, which emphasizes how cybersecurity is becoming more and more of an issue for everyone:...

Highlights from the HITRUST Health Industry Third Party Assurance Summit

On June 29, 2015, the Health Information Trust Alliance HITRUST announced that several massive payer organizations, including Anthem, Health Care Services Corp., Highmark, Humana, and UnitedHealth Group will require their business associates to obtain CSF certification. While this is old news,...

Guest blog: PCI audits and how to recognize a good QSA auditor and partner

Many organizations approach a PCI audit with fear and trepidation. There are a lot of stories out there about how difficult, expensive and disruptive a PCI audit can be, but I want to see if I can add some balance to this view. I believe that when it comes to a PCI auditor it matters a great deal...

Evolving Financial Services Security Requirements: Part 1

Through the end of the year, the New York State Department of Financial Services NYSDFS, or DFS for short, expects to proceed with a number of initiatives to help strengthen cybersecurity at its regulated companies. Among these changes will be integration of regular, targeted assessments of...

Upcoming Podcast: Python security projects

Join Coalfire penetration tester Dan McInerney on Thursday April 30th at 6:00pm ET on the Security Weekly Podcast...

Top 10 Cybersecurity Predictions for 2015

Fueled by cybercrime, cyber warfare, and cyber terrorism, the cost of cybersecurity and risk management will double in 2015. Thats the bad news. The good news is there will be a shift to cyber offense that will begin to stem the tide of cyber threats...

A New Cold War – with Many Sides

A New Cold War - with Many Sides Theres a lot we still dont know about the FBIs investigation of the data theft at JP Morgan Chase & Co. Criminal hackers based in Russia were targeting U.S. financial institutions long before Russia annexed Crimea or the West responded with sanctions. Is this trul...

Please make sure you have offline backups

This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering...

University Data Breaches Pose Threat to Students, Academic Openness

North Dakota State University administrators confirmed last week that hackers never accessed the personal information of more than 200,000 students, faculty and staff housed on the server they successfully infiltrated. This attack perfectly suits the modern hackers MO. They attack open systems...

Compliance Talk: Debt Collectors and PCI

As the largest IT audit and compliance advisor in the U.S., Coalfire is exposed to a wide variety of compliance concerns. In this series of Compliance Talk blogs, Dirk and Ken are back at their favorite coffee shop…the Bean and Berry in Louisville, Colorado. Over a couple cappuccinos, their...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

Creative Ideas for Replacing Passwords

Passwords have been the de facto manner of providing security for IT systems. Theyve got a bad reputation, but its not the passwords themselves that deserve the reputation - its the individuals using them and the weak standards to which these passwords are managed. In fact, a password system...

White House Executive Order on Cyber Security

The tense standoff between an unresponsive Congress and a reluctant critical infrastructure industry has been broken. On February 13, 2013, the President issued an Executive Order that provides initial guidance for the country to confront escalating cyber threats. Finally, we have someone with th...

Long-awaited HIPAA Omnibus Rule is Unveiled

As of January 17, 2013, the HIPAA Omnibus Rule has finally been released by the Department of Health and Human Services HHS, which will modify the HIPAA privacy, security, and enforcement rules. The package of regulations, in regard to this long-overdue HIPAA Omnibus Rule, will officially be post...

Small Breach, Big Settlement

Earlier this week the Department of Health and Human Services HHS announced the first ever breach settlement where fewer than 500 patient records were compromised. The $50,000 settlement was issued as a result of 441 patient records being stored on an unencrypted laptop that was stolen from the...

Formalized IT Security Policy Now Required for Government Prime and Sub-contractors

This month the GSA announced an IT security mandate for government prime- and sub-contractors that requires them to have a formalized IT security plan that includes periodic audits. Many government sub-contractors, large and small, will benefit from a third-party compliance program review so they...

Exercise your Incident Response Plan

So youve finally completed your Incident Response Plan. Youve named your team, defined roles, documented standard operating procedures, and establishing escalation processes. Heck, youve even got training material. So now what?...

Cyber Defense Summit 2011

On September 14, we will be partnering with InfraGards New York City Alliance to host a one-day Cyber Defense Summit. This year we have seen a drastic increase in data breaches. As these hacks have become daily occurrences, enterprises must learn how to protect their data while simultaneously...

Viruses and Vendors Can Put Healthcare Data At Risk

A recent article in Healthcare Security Info highlights that computer viruses can cause security breaches, that can then in turn compromise health care data and potentially violate the HIPAA and HITECH Act regulations. Beth Israel Deaconess Medical Center in Boston had to notify more than 2,000...

Full Steam Ahead! Coalfire Systems Secures $5 Million in Funding from Baird Venture Partners

People often ask me what defines a successful company. At Coalfire Systems, its having a clear roadmap of services that clients need and want, which in turn drives growth and expansion. I am pleased to announce that Coalfire Systems has received an investment of $5 million dollars from Baird...

Hacking Ham Radio: WinAPRS – Part 5

This installment will review the final Python exploit code. The exploit will transmit the three-stage shellcode in two separate AX.25 packets. It will then listen for a response from the victim machine and allow the attacker to send commands back over ham radio. Well then revisit Windows 10 and...

CMMC – The smoke is clearing

The smoke is finally starting to clear on "CMMC 2.0." Hundreds of companies are already lining up for Cybersecurity Maturity Model Certification assessments. Everything is taking place faster and with far more urgency than most organizations have planned around or prepared for...

Hacking Ham Radio: WinAPRS – Part 1

Hackers have been breaching computer system defenses for more than half a century, and the networks they use to exploit those weaknesses have been around for far longer than that. With the internet replacing most wirelines and wavelengths, and with the rise of cybercrime sophistication from petty...

Command injection in java: 80% proven that it is 100% impossible (sometimes)

I was reading Alex Smolens blog the other day and ran across the post "Command Injection Impossible in Java and .NET?" Interesting stuff! In an effort to avoid doing work I should actually be doing, I decided to look into it a bit more...

Asymmetric-key algorithms and symmetric-key algorithms

The symmetry of the algorithm comes from the fact that both parties involved share the same key for both encryption and decryption. It works similar to a physical door where everyone uses a copy of the same key to both lock and unlock the door. A symmetric-key algorithm, just like real doors,...

IoT Part 3: Fire!

When we left off in Part 2 of our blog series, we had just identified the max temperature variable and set it to a much higher number. Our celebrations quickly ended, however. Upon flashing the firmware with the new edited max temperature variable, we realized that the printer would get up to...