603 matches found
Quality is Job One When it Comes to the HITRUST CSF Assurance Program
The HITRUST CSF® remains an essential security and privacy controls framework that addresses the multitude of security, privacy, and regulatory challenges facing both public and private sector organizations. As framework adoption increases across all industries, maintaining integrity is crucial,...
A day in the life of a cybersecurity professional
After I graduated from high school, I knew I wanted to do something in computers and IT, but I did not know exactly what - the IT help desk route, databases and database management, programming and software development, or something else perhaps? I knew one thing though - I did not want to be in ...
Pro Tip: The Right Way to Test JSON Parameters with Burp
Heres a Burp trick you might not know, which helped find this instance of command execution and lots of SQL injection in other applications. Despite PortSwigger claiming otherwise, Burp does not parse JSON very well, especially nested JSON parameters and values like you see below...
Amanda Mesler of Microsoft Addresses the Women of Coalfire
Last month RISE, Coalfires association of women in cybersecurity and leadership, welcomed our inaugural guest speaker, Amanda Mesler, General Manager of Microsoft Central and Eastern Europe. I had the great fortune to interview her and lead a discussion with our members...
Leveraging AppSec vendors amidst layoffs
The tech sector has been hit hard with layoffs and cutbacks, driving more companies to outsource their IT needs. Is it time for your organization to make the transition?...
Coalfire statement on racial injustice
In honor of Juneteenth, I wanted to reflect and share my thoughts. At Coalfire, we are committed to living our values: Respect, Excellence, Leadership, Integrity, Teamwork, and Enthusiasm. As a result, Coalfire stands against racism, violence, and hate. We stand with fairness, equity, and justice...
RSA 2018 recap: GDPR, Increasing Visibility and Transparency of Cloud Security
RSA 2018 is in the books! The event welcomed 42,000 attendees to San Francisco, including cybersecurity professionals, vendors, media, and analysts. The themes of visibility and transparency repeatedly came up in discussions and presentations as organizations grapple with ever-increasing data flo...
Blueprints scopes and assignments
Welcome back for part three of four in our Blueprint technical series. Today were covering the governance and lifecycle controls of Blueprints within an Azure tenant. There is a lot of power in what Blueprints provide, and this tooling needs to be managed across multiple subscriptions or...
Coalfire and HITRUST – 9 years, 1,000 engagements and counting
Since 2007, HITRUST® has offered programs that protect sensitive information and allow organizations to manage information risk globally across all industries and throughout the supply chain. In collaboration with information security, privacy, and risk management leaders from public and private...
Controlling Cyber Risk for Teleworkers with HITRUST
Organizations across the globe have sent workers home to avoid spreading the Coronavirus and, as a result, technology leaders are hard-pressed to create cyber-safe work-from-home environments. Organizations must quickly identify and treat new cybersecurity risks introduced by the newly formed...
The Basics of Exploit Development 1: Win32 Buffer Overflows
In this article we will cover the creation of an exploit for a 32-bit Windows application vulnerable to a buffer overflow using X64dbg and the associated ERC plugin. As this is the first article in this series, we will be looking at an exploit where we have a complete EIP overwrite and ESP points...
Payments paradigm shift
Crypto assets have been around for over a decade, and with the recent Coinbase IPO, we believe we are well past the point of calling this a "passing fad." In fact, we believe that crypto assets -- particularly bitcoin -- have now passed the tipping point from being considered an unconventional...
Deploying your first Blueprints
Welcome back to the fourth and final part of this Azure Blueprints series. This section covers how to use some Blueprints provided by Microsoft and how to get started writing your Blueprints for managing your Azure Governance. Specifically, we will look more closely at a FedRAMP use case...
Third Party Risk Management and the Cloud
Security awareness and preparation are getting more widespread. Corporate boards and C-suite executives are taking Third-Party Risk Management TPRM more seriously as they see what has happened to other enterprises in the not-so-distant past. I am speaking primarily of the top-level enterprises, b...
Windows Update Warning
Coalfire is issuing this notice to alert our clients about a very important set of updates that were issued by Microsoft, as well as a pre-release announcement released by Oracle. While these are commonly handled through modern enterprise patch management systems, we want to underscore the...
Preparing for DevSecOps transformation
The latest report from Coalfires prestigious Cloud Advisory Board CAB, consisting of some of the worlds most experienced C-level cyber leaders and cloud security thought leaders from Coalfire, provides some of the most significant insight and timely advice for cybersecurity leaders in 2022 and...
New cybersecurity legislation to amend the Health Information Technology for Economic and Clinical Health (HITECH) Act – an analysis of H.R. 7898
New legislation was passed by Congress and signed by the president on January 5, 2021 that amends the HITECH Act with an additional section titled: SEC. 13412. RECOGNITION OF SECURITY PRACTICES. The fundamental driver for amending HITECH is to ensure the secretary of Health and Human Services HHS...
The California Privacy Rights Act (CPRA)
The California Privacy Rights Act CPRA was passed in November by voters in California. Adding another entry to the alphabet soup that is privacy regulations, the CPRA known as Proposition 24 when it was on the ballot expands on the states landmark consumer privacy law, the California Consumer...
The Edge of a Storm?
The SolarWinds element of this breach is likely just the tip of the iceberg as many more businesses leveraging their management tools are exposed to this compromise. Not necessarily from the nation state actor believed to have triggered it, but from the potential sell off of those points of acces...
Getting around the cybersecurity talent shortage
More remote workers mean larger attack surfaces, and as cyber criminals take advantage of the rush to provision a remote workforce, the pain of the cybersecurity professionals shortage has become acute. Last year, the ISC2 Workforce Study identified a shortage of 561,000 cybersecurity professiona...
What Will Happen to My ISO Certificate During a Global Pandemic?
As the coronavirus outbreak continues and safety concerns relating to travel and large group meetings increase globally, Coalfire ISO "CFISO" has been monitoring the effects of this crisis on both its customers and its employees. As a certification body, CFISO maintains accreditation with both th...
Compliance in the Cloud - Effective Strategies to Ensure Success
It's no secret that the principles, controls, and terminology associated with compliance can be a confusing alphabet soup that hinders an organization's ability to go-to-market and expand its customer base. The difficulties in meeting compliance objectives are not limited to organization size or...
The California Consumer Privacy Act: Will It Apply to Your Organization?
In August 2018, California issued a revised version of a new consumer privacy law--the California Consumer Privacy Act CCPA. This statute goes into effect on January 1, 2020 and provides broad privacy protections to California consumers. This statute will have wide-ranging effects outside of...
The business case to expand ISO 27001 certification with privacy controls
Third-party inspections of organizational privacy risk remain a novel trend. Only five years ago, the most basic of common controls frameworks for this risk taxonomy did not even exist. Today, privacy has captured the collective global consciousness. Every segment, from regulators and industry...
Cybersecurity opportunities for the public and private sectors
Im happy to share a new paper by Cynergy Partners, co-authored by Coalfire board member, Jim Pflaging, titled Cybersecurity Opportunities for the Public and Private Sectors...
Developing COVID-19 outbreak communication and adjustment to planned assessment activities
As the coronavirus outbreak continues and safety concerns relating to travel and large meeting groups increase globally, Coalfires Payments Assurance Practice has been monitoring the effect of this crisis on both its customers and its employees. As a Qualified Security Assessor Company QSAC,...
Hexeon unleashed: human-centric offensive security amplified by technology
Part 3 in a blog series spotlighting Coalfire's 5th Annual Penetration Risk Report...
What you need to know: Transitioning CSA STAR for Cloud Controls Matrix 4.0
In January of this year, the Cloud Security Alliance CSA released a major revision to its widely adopted Cloud Controls Matrix CCM in the form of version 4.0. This comes in the middle of a calendar year where several alternative information security frameworks are also expected to be refined,...
The Basics of Exploit Development 4: Unicode Overflows
If you have read the previous articles in this series, welcome back and keep reading. If not, I would encourage you to read those first before proceeding, as this article builds on concepts laid down in the previous installments. In this article, we will be covering a technique similar to the one...
pymetasploit3 – Metasploit Automation Library
Have a checklist of tasks you perform every penetration test, such as SSH bruteforcing or port mapping? Automate it with Python and Metasploit! Unfortunately, there hasnt been a working, full-featured Python library for making these tasks easy for many years now. This changes today...
The CMS Allows Health Plans to Host Their Own Enrollment Applications for Improved Consumer Experience
As part of the ongoing implementation of the Affordable Care Act ACA, the Centers for Medicare and Medicaid Services CMS recently began permitting direct enrollment entities qualified health plan issuers and web-brokers to host their own enrollment applications on their websites instead of proxyi...
Privacy information management system considerations for ISO 42001
Organizations that want to pursue ISO 42001 certification and have an existing ISO management system in place need to consider how to integrate an AI management system with their current management system to ensure common objectives and obligations are maintained. The following blog post explores...
Penetration testing: shifting paradigms from reactive to proactive
Part 2 in a blog series spotlighting Coalfires 5th Annual Penetration Risk Report...
A rundown of the OWASP top 10 for large language model applications
As part of the Open Worldwide Application Security Project OWASP AI Project, a community of international experts published a list of the top 10 critical vulnerabilities seen in Large Language Model LLM applications...
Privacy-by-design… not by accident
The concept of privacy-by-design was actually devised almost 30 years ago by Ann Cavoukian, PhD, former Ontario Information and Privacy Commissioner. If youre reading a blog about privacy, chances are good you have at least a passing familiarity with Dr. Cavoukians seminal contribution to the...
Offensive Security Testing Using Cloud Tools
When performing offensive security testing, assessors sometimes run into issues where their source IP address gets blacklisted. For example, we might be performing a web application test and, due to the many suspicious queries being performed, our IP address is suddenly blocked. While on the...
Keeping Privacy Afloat During a Pandemic
The world is navigating uncharted digital waters and facing evolving challenges to maintain patient privacy. Protected Health Information PHI is a ship sailing in a sea of digital risks and vulnerabilities. Humans wreak havoc at every turn - not always intentionally - and actions during times of...
Waiting, Waiting, Waiting... Is There a Right Time for Breach Notification?
Recently, a popular online retailer revealed a month-long data breach. Card-skimming code was found capturing customer credit card data from the payment page of its website and sending that data to what appeared to be a legitimate server with a similar domain name and a valid HTTPS certificate. T...
From OSINT to Internal: Gaining Domain Admin from Outside the Perimeter
When I first began working at Coalfire in early 2017, I couldnt wait to get started pentesting professionally for the first time. When I finally got tasked with my first gig, I dove right in. I was tasked to perform an assessment of the external network. After hitting all known servers and web...
On Padding Oracle Attacks
Poodle is a vulnerability found in late 2014, and it is still occasionally seen during penetration tests. The vulnerability allows an attacker with a man-in-the-middle position to downgrade a secure connection between a client and a server to the vulnerable SSLv3. After the connection is...
Navigating the AI security landscape: The federal push for responsible AI adoption
This blog post discusses the U.S. government's commitment to responsible AI through the Executive Order and proposed legislation, outlines key provisions for AI risk management, highlights efforts to strengthen federal AI governance, and emphasizes Coalfire's role in promoting responsible AI...
Looking back at Black Hat 2023
From AI to the evolving threat landscape, Black Hat 2023 spotlighted the security industrys latest and greatest innovations...
Hacking Ham Radio: WinAPRS – Part 4
In part three of this series, we discovered and traced a memory corruption bug in WinAPRS using IDA Pro and WinDbg. We discovered that it could be used to gain control over the CPUs EIP register to obtain remote code execution. We found that there were limitations on the address that could be...
Success stories in cybersecurity and information technology
RISE is Coalfires initiative to Recruit, Influence, Support, and Educate women in cybersecurity. I am honored to have been invited to be an active member of the RISE steering committee and help contribute to this worthy cause...
New HC3 report defines security assessments needed for healthcare organizations during and after COVID-19
The Health Sector Cybersecurity Coordination Center HC3 recently delivered a report that defines and articulates the security assessments and information technology audits that should be considered during and after the COVID-19 pandemic...
How the COVID-19 epidemic is like cybersecurity
Today, every citizen is on the front lines of the epidemic. We are flooded with information about staying safe, keeping an eye out, and left to process unfamiliar language. We are all suddenly doctors and epidemiologists analyzing information and predicting how the world is changing. With countle...
A Good Shell Is Hard to Choose
I had the recent opportunity to speak at BSides SLC, held on the Sandy campus of Salt Lake Community College. I tailored my presentation to the student demographic and chose to talk about one of the fundamental concepts that a penetration tester must understand: types of shells. I touched on the...
Protecting Confidential Data: You May Not Be as Secure as You Think
Part One of a Three Part Series Unless you have been out of the country or otherwise shunning the news, you have likely heard that on September 7th and again on September 15th, Equifax reported that it suffered a security incident from May 13th through July 30th, 2017. This breach is broad reachi...
Where is your social security number today?
As April 15 approaches, the "water cooler" talk revolves around all types of topics related to the tax season. However, due to the overwhelming number of security breaches reported this past year, several individuals are finding that fraudulent tax filings were created with voluntarily provided...