Coalfire’s Adaptive Penetration Testing at Black Hat Helped Prepare Tomorrow’s Security Talent

What makes a penetration tester highly successful? Most obviously, the technical skills to hack into a network, application, or location comes to mind first, and without those capabilities and the ability to continuously learn, an aspiring pen tester has a tough road ahead of them...

Accelerating Point-to-Point (P2PE) Adoption

How Coalfire is Helping Increase Access to PCI-listed P2PE Solutions - Use of a PCI-listed P2PE solution offers significant security and compliance benefits. However, merchants and service providers are still challenged to take full advantage of this opportunity. Coalfire has invested in solving...

Creating a Cyber Insurance Policy

According to research from PartnerRe and Advisen, the global cyber-insurance market is currently worth $2 billion a year, a number which is expected to double by 2020.With 60% of underwriters and brokers seeing a significant demand in cyber-insurance from customers, there is clearly a great...

A billion reasons to enhance your penetration testing

There are so many questions regarding those leaked Russian passwords. Is this for real? What sites are on that list? How can you tell if your sites users are in the "Russian Billion"? Isnt this just a matter of changing user passwords? Bottom line: As a company with websites that have user...

The Federal Government in Financial Services' Cybersecurity

Its no secret that the internet has changed the way we do business in nearly every industry. On the other hand, the dangers of limited cyber regulations are quickly becoming a focus for the government due to the frequency and impact of data breaches. Its becoming apparent that convenience comes a...

HIPAA Compliance: A Demanding Effort Yielding Deserved Benefits

The heat is on! Compliance with the Health Insurance Portability and Accountability Act of 1996 HIPAA has never been more scrutinized and highly regarded. The push towards compliance has fueled businesses large and small to explore the options and necessary requirements of HIPAA compliance...

Cyber Security Legislation

October is Cyber Security Awareness Month: Get Informed and Get Involved on Cyber Legislation. Every October, the National Cyber Security Alliance sponsors National Cyber Security Awareness Month, and a growing number of businesses and institutions are joining the chorus. The White House got in o...

Is your HIPAA Security and HITECH audit program in order?

Healthcare organizations have been working towards HIPAA and HITECH compliance for a few years now. "Surprise" HIPAA compliance audits conducted by the OCR have begun and at Coalfire weve come across some gaps that have led organizations to fall short of their compliance initiatives...

Cyber Security Awareness - Are you Doing All You Can to Stay Safe?

Every company has vulnerabilities and must learn to protect themselves from fast-moving cyber threats. Below are a few tips to keep in mind as you examine your network security:...

Recent Surveys Reveal Trends and Spending Habits for Retailers in PCI Compliance

Recently, Gartner Research released two separate research reports on retailer PCI DSS compliance progress, trends and strategies. These reports are based on a survey of 77 merchants of varying sizes and covers a wide range of topics, including compliance status, spending and the incidence of...

Celebrating Black History Month: Reflections as the Chair of Coalfire's Black Employee Resource Group

As we embark on another February, I am honored to reflect on the significance of Black History Month from the perspective of serving as the chair of Black Employees in Cybersecurity Obtaining Mentorship, Influence, Networking, and Growth B.E.C.O.M.I.N.G., Coalfire's Black Employee Resource Group...

Four key questions for privacy programs in the U.S.

With new state privacy laws passed each year, organizations are tasked with developing privacy programs that are compliant with applicable laws. To help organizations identify their current privacy program maturity, privacy professionals can ask four questions to determine where they stand...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

A survey of FedRAMP’s new supply chain requirements

Over the past few years, supply chain management has shifted from a background requirement that everyone unknowingly relies upon, to being a commonly talked about aspect of our everyday lives. The Federal government has ramped up its effort to gain a handle on supply chain threats as a result of...

Properties of secure hash functions

The news of NIST and their SHA-3 algorithm competition and a recent lunch and learn at Denim Group reminded me of the Cryptographic lectures I gave at UTSA. One of the hardest concepts my students had grasping was secure cryptographic hash functions, partially because of the number theory, but al...

Deploying your first Blueprints

Welcome back to the fourth and final part of this Azure Blueprints series. This section covers how to use some Blueprints provided by Microsoft and how to get started writing your Blueprints for managing your Azure Governance. Specifically, we will look more closely at a FedRAMP use case...

How to strengthen your cybersecurity program

The first step toward becoming physically fit is looking in the mirror, acknowledging your weaknesses, and making a commitment that youll do whatever it takes to improve yourself. This is true for personal fitness, but can this approach also apply to the cybersecurity program at your growing...

Look Out! Risk Is on the Move, According to IoT Thought Leaders from Across the Globe

The IoT Security Summit 2017 in New York City in late October and the Security of Things World USA 2017 in San Diego last month were both packed with thought leaders from all parts of the IoT ecosystem - device manufacturers, telecom carriers, cloud providers, and early-adopter end users from...

The Value of Governance in Minimizing Cybersecurity Incidents

Part Two of a Three Part Series Since Equifaxs September 15th statement about their well-publicized, broadly discussed major security incident, Coalfire has fielded multiple inquiries from clients who are wondering if such an incident could happen to them, and if there is anything that they can d...

New York State Implements Cybersecurity Regulation 23 NYCRR 500

On March 1st, 2017, sweeping new cybersecurity requirements were placed on organizations regulated by the New York State Department of Financial Services. The law applies to a broad set of covered entities that are supervised by the NYDFS, including banks, trusts, budget planners, check cashers,...

How Twitter, Amazon, and others were impacted by last Friday's DDOS attack - and what you might want to do about it.

Our partner, Chertoff Group issued the following advisory. Client Advisory: October 21 distributed denial of service DDoS attack. A major distributed denial of service DDoS attack recently 10/21/16 disrupted Internet communications throughout parts of the United States in several waves, and there...

What is Defcon

The first year I attended, I was lucky enough to identify interesting wireless signals with a distinct sound - that of the POCSAG and FLEX protocols. Decoding these signals revealed party invites to the Telephreak party where I listened to raw, uncensored lightning talks covering topics from car...

Breaching a bank in 20 minutes - Horror Stories 2015

I arrived onsite to suite 102 the banks corporate headquarters around 9:40 a.m. I was impersonating a local utility worker - with all the garments like a hardhat, clipboard, obnoxious yellow vest, and some old Timberland work boots. I played the part well...

The 100 Million Dollar Getaway - Horror Stories 2015

In todays security landscape, companies face daily threats to their reputation and intellectual property. The typical response to these threats is to purchase a tool or a service claiming to be a magical silver bullet that can respond to all "cyber" threats. In reality, the quest for a security...

Is penetration testing required for HIPAA compliance?

In this blog post were going to focus our discussion on the technical requirement part of this standard. The evaluation is supposed to establish the extent to which a covered entitys or business associates security policies and procedures meet the requirements of the HIPAA Security Rule. A questi...

What does PCI DSS 3.1 and PA-DSS 3.1 mean for you and your organization

In the wake of the POODLE vulnerability identified by NIST and subsequent attacks, the PCI SSC has announced its intent to release the first revision of the PCI DSS 3.0 and PA-DSS 3.0 standards. The PCI DSS 3.1 and PA-DSS 3.1 standards will indicate that the SSL v3.0 protocol no longer meets the...

Is the “Day of Reckoning” getting closer for a large scale cyber-attack?

The "Phony War" is how commentators described the seven-month period of eerie quiet that prevailed in Western Europe between Germanys 1939 invasion of Poland and its later move into the Benelux countries, when erstwhile allies Britain and France avoided offensive operations and simply waited for...

PCI DSS 3.0 ROC Reporting Template Released

Heads up for our PCI customers: the PCI SSC released the "ROC Reporting Template for v3.0" this last weekend and it is available here. This document supports the PCI DSS 3.0 standard and must be used by all QSA organizations to create and submit a Report on Compliance ROC. What does this mean?...

The FFIEC proposes guidance on social media - can you stay two steps ahead?

On January 22, 2013, the FFIEC put out a press release called "Financial Regulators Propose Guidance on Social Media". We should begin by saying that even without a social media presence, every company should address social media risks in their annual risk assessment. In this day and age where th...

Reflections on the 2023 RSA Conference: Trends, takeaways, and the shift-left approach to cybersecurity

The 2023 RSA Conference brought together over 45,000 cybersecurity professionals from around the world to discuss the latest trends, technologies, and best practices in the field. Key themes that emerged at the conference included the intersection of cybersecurity and artificial intelligence AI,...

Six steps to prepare your application security team for a penetration test

This blog post will show step-by-step how an application security team should prepare for a penetration test...

Threat and vulnerability management - No time for complacency

There was some very good news in Coalfires 4th Annual Penetration Risk Report. Most notable was that high-risk vulnerabilities have been cut almost in half since 2018 when we first began reporting our pen testing research derived from thousands of direct client engagements. Also of note, the larg...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...

Android: DNS setup for developing and testing against local web services

Most "interesting" smartphone applications do not run only on the smartphone device; they rely on supporting web services that can be run both by the deploying organization and 3rd parties. One of the challenges we have run into when developing Android application is setting up a suitable...

Azure Policies

Welcome back to Part Two of our four-part Blueprint Series. Today's post covers the use of Azure Policies within a Blueprint deployment along with ARM templates and permissions management. Azure Policies are the critical component of Azure Blueprints. Policies, like ARM Templates, are JSON...

Mining Splunk's Internal Logs

Splunk is great about logging its warnings and errors, but it wont tell you about them - you have to ask! As the leading machine-generated data analysis software, its not surprising that Splunk excels at creating robust logs. The current version of Splunk Enterprise v 8.05 generates 22 different...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

Applied ThreadFix: Security teams collaborating with development teams

Modern enterprises are distributed. Most ThreadFix deployments have stakeholders spanning development and security teams and those team members are spread around the globe. To support these distributed organizations, ThreadFix has a number of collaboration features that make teams more efficient...

AWS Certified Cloud Practitioner: A Valuable Certification for Professionals in Non-Technical Roles

Within the past year, AWS unveiled what is arguably one of the best programs they have ever offered to non-technical professionals in the AWS Partner Network APN: the AWS Certified Cloud Practitioner certification. The program, which is especially valuable for those in sales or marketing roles,...

Cooking Up Shells with Chef

I was able to compromise a Chef server on one of my recent engagements. Owning a Chef server means having the keys to the castle. I wasnt quite sure how to go about using this tool. Im familiar with Puppet as Ive spent the majority of my career on the systems side. Having never run into Chef, I...

NIST Interagency Report on IoT: An Incremental Step Toward IoT Standards

The Internet of Things IoT has been widely regarded as representing a significant cybersecurity risk, which will only grow as connected devices continue to proliferate. As an important step in addressing these concerns, the Interagency International Cybersecurity Standardization Working Group IIC...

Introducing Red Baron - Automate the Creation of Resilient, Disposable, Secure, and Agile Infrastructure for Red Teams

The need to automate the creation of disposable red-team infrastructure is key to providing effective adversary simulations. As Coalfire Labs continued to grow, our team needed a system to quickly configure and spin up C2 and/or phishing infrastructure, run multiple campaigns at the same time, an...

Black Hat Europe puts cybersecurity on the C-Suite Agenda

Black Hat is renowned for being one of the biggest, most technical security conferences in the world operating in the USA, Europe and Asia. 2017 marks Europes first Black Hat Executive summit, a format well received for senior executives to be able to openly discuss cyber security concerns and...

News and Updates from the PCI Europe Community Meeting

In September, Hurricane Irma forced the PCI SSC to cancel the North America Community Meeting; and the uncertainty of Catalonian independence from Spain may have led some to stay home from the Europe Community Meeting held in Barcelona last week. Nevertheless, the Coalfire team was well-represent...

President’s Cybersecurity Executive Order

On May 11, 2017, President Trump released the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This E.O. -- while stand alone in focus --should be seen in the context of a greater move in the Executive Branch to elevate the awareness...

Ransomware Response: To Pay or Not to pay

Recently, I was speaking with a CISO friend of mine and he mentioned that his company suffered a breach. I asked if it was a ransomware attack, and sadly, that was the case. Malware had infected nearly every connected computer. Clearly there was a breakdown in protective controls, but Ill get to...

Cloud Burst?

The cloud can burst!? This weeks AWS service disruption showed us the importance of architecting a system to account for failure, and how to be successful when deploying your solution in the cloud...

What’s Your Computer Thinking About? Examining Random Access Memory (RAM)

How valuable would it be to be able to read another persons mind? To know what theyre thinking or planning to do would be invaluable. Or, how valuable would it be to know what they have done in the recent past, especially if you believed they were involved in some criminal activity? Who they were...

Final HITECH Act Stage 3 Meaningful Use Rules May Require Annual Risk Analysis plus a Risk Management Component

The comments are in and the HHS is scrambling to review them all before they issue the final Stage 3 Meaningful Use rules later this summer. Comments from entities such as CHIME and HIMSS represent good news and bad news for healthcare providers, depending on how you look at it. The HIPAA Securit...