Creative Ideas for Replacing Passwords

Passwords have been the de facto manner of providing security for IT systems. Theyve got a bad reputation, but its not the passwords themselves that deserve the reputation - its the individuals using them and the weak standards to which these passwords are managed. In fact, a password system...

Small Breach, Big Settlement

Earlier this week the Department of Health and Human Services HHS announced the first ever breach settlement where fewer than 500 patient records were compromised. The $50,000 settlement was issued as a result of 441 patient records being stored on an unencrypted laptop that was stolen from the...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

Proudly Supporting Our Country’s Navy Reserves

July is a month in which we celebrate our nations independence and we hope that youve had the chance to reflect on the many freedoms and blessing we enjoy as citizens of the United States. At Coalfire, we know full well that those freedoms have been paid for, at least in part by the Americas...

Moving to the Cloud: Considerations for Implementing Cloud Migration Plans

Over 60 executive level attendees came to the Omni Interlocken Resort in Broomfield, Colorado for the National Council of Higer Education Loan Programs NCHELP Spring convention and to hear from a panel of cloud experts on how the migration to cloud IT services could impact their business in the...

RSA 2012: Mobile, Cloud, and Intelligent Control

It was good to catch up with our customers and partners at RSA 2012 this week. Much of the buzz this year was around mobile devices and securing the cloud. We were glad to see innovative organizations introducing compliance-validated architectures based on these emerging technologies. One such...

GivingFirst Launches online Charity Processing Service

In the spirit of the Holiday Season, Coalfire has made a significant contribution to GivingFirst.org in the form of free Penetration Testing services. GivingFirst is a Denver-based community foundation whose mission is "to improve quality of life by increasing community generosity and involvement...

Viruses and Vendors Can Put Healthcare Data At Risk

A recent article in Healthcare Security Info highlights that computer viruses can cause security breaches, that can then in turn compromise health care data and potentially violate the HIPAA and HITECH Act regulations. Beth Israel Deaconess Medical Center in Boston had to notify more than 2,000...

Compliance and the Cloud

"The Cloud" is a hot topic right now. Yet most people cant even define what "the cloud" really is. As I talk to more companies, who are considering the move, they all have two main concerns: security and compliance. Of course, security and compliance are key when it comes to cloud computing, but...

Full Steam Ahead! Coalfire Systems Secures $5 Million in Funding from Baird Venture Partners

People often ask me what defines a successful company. At Coalfire Systems, its having a clear roadmap of services that clients need and want, which in turn drives growth and expansion. I am pleased to announce that Coalfire Systems has received an investment of $5 million dollars from Baird...

Sitting in cars with hackers

Are organizations doing enough to protect customer data? The auto industry can teach us a lot about vulnerability management...

Hacking Ham Radio: WinAPRS – Part 5

This installment will review the final Python exploit code. The exploit will transmit the three-stage shellcode in two separate AX.25 packets. It will then listen for a response from the victim machine and allow the attacker to send commands back over ham radio. Well then revisit Windows 10 and...

StateRAMP: The “easy button” is now a reality

When StateRAMP was announced last year, I was excited! Finally, they have put together a program that will enforce rigorous cloud security standards, while reducing the burden on state and local governments, which are flexible and eliminate repetitive and costly authorization and accreditation...

Asymmetric-key algorithms and symmetric-key algorithms

The symmetry of the algorithm comes from the fact that both parties involved share the same key for both encryption and decryption. It works similar to a physical door where everyone uses a copy of the same key to both lock and unlock the door. A symmetric-key algorithm, just like real doors,...

IoT Part 3: Fire!

When we left off in Part 2 of our blog series, we had just identified the max temperature variable and set it to a much higher number. Our celebrations quickly ended, however. Upon flashing the firmware with the new edited max temperature variable, we realized that the printer would get up to...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

Privacy by design: Building customer trust

Historically, the question of privacy has been the domain of the legal community. This makes perfect sense, because privacy has its roots almost exclusively in laws and regulations. The EU General Data Protection Regulation GDPR, the California Consumer Privacy Act CCPA, and similar regulations...

A Cyber Engineering Primer: System Compliance and Hardening

Cybersecurity is a hot topic for just about everyone: it affects organizations as well as individuals, workers, and citizens. Each of us needs at least a basic understanding of how to safely use and protect the devices and systems that are a part of our day-to-day lives...

Information and guidance for dealing with WannaCry

Coalfire continues to closely monitor the WannaCry ransomware attack. Much has been written over the past few days about the attack. For those of you who may not have had time to review in detail and assess appropriate actions for your organization, we wanted to provide summary information...

Hacker Summer Camp – Recap of BSidesLV, Black Hat & Defcon

What a week! Hacker summer camp in Vegas was amazing! This was my first time through for all three of the conferences in Vegas - BSidesLV, Black Hat, and Defcon. Ive been to BSidesLV and Defcon plenty of times, but experiencing all of these back-to-back -to-back!, with a bit of overlap gives a...

Funeral Services for Rick Dakin

The funeral for Rick Dakin will be held on Tuesday, June 30 at 10 a.m. at the Gatehouse Lionsgate, located at 1055 South 112th Street, Hwy 287, Lafayette, CO 80026. Arrangements are being made through the Crist Mortuary in Boulder, Colorado. An online memorial page and guestbook will be set up...

The Future of Healthcare Cybersecurity: The Best Defense is a Good Offense

In the last five years with the increasing digitalization of health information, healthcare security breaches have increased four-fold with the industry experiencing more breaches than any other in 2013. With a large number of potential targets and the high value of personal medical information o...

Two final thoughts from the PCI Community Meeting

The 2014 North American PCI Community Meeting has drawn to a close, but the messages and lessons learned will continue to resonate with me long after Ive returned home to Denver. There were two messages from the SSC this week that really struck a chord with me and I wanted to expand on why I thin...

Forensics Session Takeaways from Day 2

Day two of the PCI Community Meeting presented an array of security topics ranging from best practices, EMV, security awareness, and more. I had the pleasure of sitting in on a forensics presentation, which leveraged information from a variety of industry leaders and provided valuable insight int...

Are you ready for PA-DSS 3.0?

Theres been a lot of chatter about PA-DSS 3.0 among several early-adopter application vendors. As of January 1, 2014 its permissible to validate against 3.0 in place of a 2.0 validation. Longevity of the 3.0 validation and the desire to be validated first on a new standard seem to be driving the...

Detecting and Preventing Compromises in Retail Payment Systems

Information Weeks Matthew Swartz published an article on the recently- confirmed payment card breaches at Target, Nieman Marcus and three other unnamed retailers. This article and many others reveal that these attacks involve sophisticated malware and some even suggest it is the work of the same...

2013 PCI SSC North America Meeting – Wrap-Up

Coalfire sent the entire team to the meeting in Las Vegas and everyone reported a positive and engaging experience. We hosted our annual dinner where we caught up with clients and friends - a good time was had by all. The most valuable technical information was presented during the Assessors Only...

Are you in danger of missing the HIPAA Omnibus?

On September 23, 2013, many companies will be required by law to comply with HIPAA…and they dont even know it. Specifically, the final HIPAA Omnibus Rule pulls all companies under the law if they store, process, or transmit PHI data as part of their business processes. While the Omnibus Rule was...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

White House Executive Order on Cyber Security

The tense standoff between an unresponsive Congress and a reluctant critical infrastructure industry has been broken. On February 13, 2013, the President issued an Executive Order that provides initial guidance for the country to confront escalating cyber threats. Finally, we have someone with th...

South Carolina Data Breach Survey Results on Residents' Attitudes

Coalfire recently conducted a survey of South Carolina residents who were victims of the recent data breach at the Department of Revenue. The data breach affected residents of the State who had filed their taxes online exposing 3.8 million taxpayer Social Security numbers and nearly 400,000 credi...

Spotlight: Women of Coalfire part 2

Its been nearly 50 years since Congress formally recognized the 1920 certification of the 19th Amendment to the Constitution with Womens Equality Day on August 26. In the last half-century, women have made significant strides in the workforce and the world, but still face adversity due to their...

Command injection in java: 80% proven that it is 100% impossible (sometimes)

I was reading Alex Smolens blog the other day and ran across the post "Command Injection Impossible in Java and .NET?" Interesting stuff! In an effort to avoid doing work I should actually be doing, I decided to look into it a bit more...

What’s in a Name? – Why Gartner Picking “Application Vulnerability Correlation” is an Important Step for the Application Security Market

If you havent seen it yet, Gartner just published its "Hype Cycle for Application Security, 2016" written by Gartner Analyst Ayal Tirosh with support from colleague Lawrence Pingree Gartner clients can view it at https://www.gartner.com/doc/3376617/hype-cycle-application-security-. This is...

Sam Pfanstiel Appointed Director, Solution Architecture for Payments

Coalfire today announced Sam Pfanstiel has joined the company as the Director of Solution Architecture for Payments. Pfanstiels experience spans solution engineering and consulting as well as research and development positions...

2016 Cybersecurity Predictions

The lessons learned from this past year teach us that no one is immune to cyber threats. The sooner corporate boards and executives come to understand that cybersecurity breaches are a very real and pervasive threat; then the hard work can begin to take preemptive measures and prepare an...

Truth is SCARIER than Fiction Redux

Yes... To be honest, although we really do some neat stuff here at Coalfire Labs that can be pretty scary, Ive got to give a shout out to "reality" for being even scarier than any emulated attack we could possibly develop. The astounding number of data breaches announced this year is just shockin...

PCI Community Meeting Keynote

Admiral James Stavridis delivered this mornings PCI Community Meeting keynote presentation, Sailing the Cyber Sea: The New Realities of 21st Century Security to an engaged and near-capacity crowd. Admiral Stavridis, a four-star admiral and former NATO Supreme Allied Commander, touched briefly on...

Where should CISO report?

A key question faced by many organizations in defining the role and responsibilities of the security organization, is where to align the most senior information security executive, typically referred to as the Chief Information Security Officer or CISO. To answer this question it is important to...

This Week: Coalfire Systems in the News

Its been quite a week in the world of IT security, and as experts in our field, we are often asked to comment on current trends and recent stories. Take some time to check out what we had to say recently:...

Why are companies still managing compliance with spreadsheets?

Compliance management and automation has come a long way in just the last couple of years, and market demand for cyber assurance is at an all-time high. So why are so many companies still managing their compliance programs with spreadsheets?...

Anthem Data Breach - A Message from Coalfire's Healthcare Practice Director

Several weeks ago I had the opportunity to speak on a panel at a healthcare conference. In attendance were CIOs, CISOs, VPs of IT, and members of legal counsel. The individuals attending the session represented organizations ranging from small- to medium-sized business associates all the way up t...

Would EMV Help?

With the spate of cyber attackers on US retailers recently, Coalfires European Managing Director, Andrew Barratt considers how the attacks on retailers differ outside the US and what the potential impact of similar attacks is in a world where chip and pin technology is more widely deployed...

IT Security Horror Story #2: A Tale of Spooky Hosted Images

Image manipulation madness causes a near disaster for a popular web site. READ MORE…IF YOU DARE -...

What “Dexter Malware” tells us about the future of POS security (It might just be P2PE)

The recently announced Dexter malware is targeting POS systems and once in, it collects sensitive credit card data and surreptitiously sends it off to attackers. While the details of this particular attack are not yet available, this is not the first time this general approach has been exploited...

FedRAMP Question and Answer session from PMO webinar

On October 25, the FedRAMP PMO conducted its first webinar, in what will be a series of webinars, on the FedRAMP process. This first webinar covered the four methods that CSPs can get listed in the FedRAMP repository. This webinar is well worth the time to listen to it. The PMO had a lengthy Q&A...

What is Your Risk Assessment Worth?

A risk assessment provides your organization with a tool to determine how, where and how much to invest in controls and security over technology. It also serves to document the risk acceptance policy of your organization as the acceptable level of risk dictates the level of controls to be...

Can we kick the attachment habit?

As consumers of messaging services, particularly email, we have become addicted to attachments. This habit has become an easy avenue for mounting cyber-attacks against an organization. In the 2010 Verizon Data Breach Investigations Report, conducted in cooperation with the United States Secret...

Corporate demand for cybersecurity ROI drives CISO metrics

Increasing cyber risks and decreasing budgets mean that C-suites and boards are demanding better cyber performance metrics and reporting from security teams...

Why are companies still managing compliance with spreadsheets?

Compliance management and automation has come a long way in just the last couple of years, and market demand for cyber assurance is at an all-time high. So why are so many companies still managing their compliance programs with spreadsheets?...