603 matches found
Stop Hitting the Snooze Button
In the aftermath of the most damaging retail breach in history, a CEO in the financial industry explained his companys position on the issue:...
What you need to know from the OCR’s Report to Congress on Breaches and HIPAA Rules Compliance
Last week the HHS Office for Civil Rights OCR issued their Annual Report to Congress on Breaches of Unsecured Protected Health Information PHI for calendar years 2011 and 2012. This is their second annual report required by the Health Information Technology for Economic and Clinical Health HITECH...
It wasn't raining when Noah built the ark
This month movie-goers around the world will flock possibly two-by-two to see Darren Aronofskys Noah--a silver-screen adaptation of the timeless biblical story, starring Russell Crow and Jennifer Connelly . Whether one interprets the flood narrative literally or figuratively, this fact remains: t...
IT Security Horror Story #1: The Case of the Phantom Blood Red Team
An unsuspecting Fortune 100 company allows horrible creatures into their building and systems during a Red Team engagement. READ MORE…IF YOU DARE -...
The Rapidly Changing World of Mobile Application Payment Systems Compliance
In this series of Compliance Talk, Dirk and Ken are back at their favorite coffee shop, this time joined by Dan Fritsche. Dan is Coalfires Director of Solution Validated Services and is considered a thought leader on mobile payments, P2PE and other emerging trends in the payments industry...
Determining if your Company is Prepared for FedRAMP
Many companies interested in pursuing FedRAMP are seeking guidelines, checklists and any referenceable source to help them understand and determine their level of preparedness to go through the FedRAMP process. The GSAs FedRAMP.gov site provides documentation on the FedRAMP process in their "Guid...
Penetration Testing Frequently Asked Questions
You may have noticed this recent article about Googles contest that rewarded a hacker for discovering a vulnerability in Chrome. Once Google verified the vulnerability, they were able to fix the bug and issue the cash prize to the hacker. This is a very public example similar to what Coalfire Lab...
Password Management: How many do you need to remember?
In todays online world, the proliferation of usernames and passwords has resulted in a cottage industry springing up to meet the need to keep track of them in a secure manner. Software and hardware providers have developed a number of unique approaches to deal with this problem, but they all...
Coalfire Appoints Larry Jones to Board of Directors
We are proud to announce the election of Larry Jones to our board of directors. Larry is the former CEO of StarTek, Activant, Message Media and NeoData, and is a seasoned veteran in technology services. He also serves on the board of Comverge, Inc., a publicly traded provider of smart grid, deman...
HIPAA Compliance and Call Centers
In a previous post titled Is It Safe to Speak? Protection for Telephone-Based Payment Card Data, I commented on the PCI SSC new requirements for call center operations and recording systems. Call center security has been a hot topic for a long time. How safe is the information that is given over...
Botnets: 2011 Rocky Mountain Information Security Conference
Botnets have become one of the most dangerous cyber threats affecting businesses today. Botnets criminals focus on the same things as most criminals: money and information. That is why these criminals are targeting payroll, human resources departments, C-level executives and senior strategists...
Coalfire Systems Speaking at Shared Assessments Summit 2011
Do you know how to ensure reliability and resiliency in cloud and SaaS environments? Join leaders from within the IT outsourcing risk management industry at the Shared Assessments Summit 2011 in Boston on March 29 and 30. Coalfire is participating in this summit because the value of managing risk...
Top 10 challenges of building an in-house application security program
Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...
Reflections on the 2023 RSA Conference: Trends, takeaways, and the shift-left approach to cybersecurity
The 2023 RSA Conference brought together over 45,000 cybersecurity professionals from around the world to discuss the latest trends, technologies, and best practices in the field. Key themes that emerged at the conference included the intersection of cybersecurity and artificial intelligence AI,...
Mobile app usage soars but security still falls short
Benchmark analysis of mobile apps shows 99% have security or privacy vulnerabilities. These weaknesses can cause exposure of sensitive information and jeopardize brand reputation, customer trust and company value...
FAQ: Transitioning to the highly anticipated new revision of ISO 27001
For a group like Coalfire Certification that lives and breathes these standards daily, it has been an exciting few months monitoring the progress of this publication and its review through the various ISO working groups...
Understanding compliance platform capabilities: black box automation has its limitations
Compliance is hard. It is not a "black box" of opaque inputs and outputs, where systems and data are hidden and where users are oblivious to their inner workings. There has yet to be a product made that can magically produce all the evidence sufficient for testing and verification across the wide...
CMMC – The smoke is clearing
The smoke is finally starting to clear on "CMMC 2.0." Hundreds of companies are already lining up for Cybersecurity Maturity Model Certification assessments. Everything is taking place faster and with far more urgency than most organizations have planned around or prepared for...
Governing the organization
Security is the biggest risk to business today. Managing security has become one of the hardest jobs in the enterprise, and failing to do so effectively can create opportunities for severe operational disruption. One of the keystone conclusions from Coalfires Cloud Advisory Boards the Smartest Pa...
Research reveals cyber risk is the best language for a C-suite audience
As a Chief Information Security Officer CISO or cybersecurity leader, one of the most important parts of your role is to manage the organizations cybersecurity risk. Managing risk and minimizing the impact of cyber incidents strengthens trust between you and the executive team, which is essential...
The Long-Term Impact of Log4j
In its aftermath, Log4j vulnerabilities put the spotlight on vendor management and supply chain security practices. Software suppliers should expect vendor security questionnaires to expand in scope and detail around application security practices. Its relatively easy for software buyers to...
Certification body rebrands to Coalfire Certification
Were excited about our new name. It reflects what we do and where we are headed. We share this excitement with our clients and our teams and extend thanks to everyone that helped push the certification body to this level of framework coverage as Coalfire Certification enters this next period of...
Staying current with HITRUST advisory changes
As a result of an ever-evolving threat landscape, compliance requirements are proliferating at an unprecedented rate. It can be overwhelming to keep up with the staggering number of new and updated regulations, compliance frameworks, and standards. HITRUST®, founded in 2007, recognized this...
Android: DNS setup for developing and testing against local web services
Most "interesting" smartphone applications do not run only on the smartphone device; they rely on supporting web services that can be run both by the deploying organization and 3rd parties. One of the challenges we have run into when developing Android application is setting up a suitable...
AppSec Bites: Implementing DevOps? What Security Teams Need to Know. (Part 4)
DevOps practices can be difficult to implement for any business. While the overall goal is to streamline the business and join the development and operations sides of things together, the first step needs to be a strong relationship between DevOps and security teams otherwise things will typicall...
AppSec concerns: UUID generation
During static analysis, one of the things the application security team checks for is strong random number generation for security sensitive contexts. We see weaknesses in this space quite often for temporary passwords and session identifiers, but an increasingly common variant is for universally...
AppSec Bites: Top 3 Things to Consider When Maturing Your AppSec Programs (Part 2)
Maturing security programs along with the growth of development programs are essential to ensuring a safe and efficient development lifecycle. The need to be on top of development while scaling programs is imperative to managing both risk and business opportunities. However, it is during times of...
Using Azure Blueprints to Control Azure Compliance
As Peter Parker says, with great power comes great responsibility. And so it goes with public cloud: With cloud scale and agility come cloud-scale problems and compliance nightmares. Every day, IT professionals balance the need to act quickly--often leveraging cloud speed of execution to implemen...
Planning Ahead to Prevent Vulnerabilities
The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...
Establishing risk appetite is key to effective risk management
The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...
Am I doing it right? An introspective look at "why it's like this"
Cybersecurity, as a practice within organizations, has existed for decades. Larger or government organizations have had dedicated cybersecurity functions in place since at least the 90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large...
What to Expect in the initial FedRAMP briefing with your Agency Sponsor and the PMO
Most people who have spent any time researching the FedRAMP authorization process know there are two routes for a Cloud Service Provider CSP to become FedRAMP authorized: Agency and Joint Authorization Board JAB. Because of the limited number of CSPs selected each quarter for the JAB authorizatio...
ERC.Net – A Toolset for Analyzing Windows Application Crashes
ERC.Net is a collection of tools designed to assist in analyzing and debugging Windows application crashes in order to identify potential security vulnerabilities. Supporting both 64 and 32 bit applications, ERC.Net has many use cases including parsing Windows file headers, identifying compile-ti...
PCI DSS v3.2.1 – What You Need to Know
On Thursday, May 17, the PCI Security Standards Council PCI SSC released an updated version of the PCI DSS standard, primarily to include clarifications and minor revisions around controls that referenced SSL/early TLS. The new version removes notes referring to the effective date of February 1,...
Sleuthing the Cloud: The Challenges of Forensics in Cloud Environments
More and more companies are embracing Cloud computing for the practicality, efficiency, and economy of outsourcing the housing, maintenance, and monitoring of applications and their associated infrastructure to a third-party provider. As the Cloud becomes more the norm than the exception, there i...
Scripted Inputs and Splunk
Splunk is an extremely versatile tool when dealing with data: - Monitor files? Check! - Listen in on an open port? Check! - Monitor the file system? Performance monitor? HTTP Event Collector? - Check, check aaaaand check! But what if the data you want to ingest does not have a method listed...
Blockchain: Are You Ready?
By now, most of us have heard of Bitcoin. Few of us really know the specifics about what that is. Fewer still have a workable or even cursory knowledge of the underlying technology that makes Bitcoin possible...
Q&A from P2PE-NESA Webinar for Merchants
The selection of a PCI-listed P2PE solution and determination of expected benefits can be challenging for even the most sophisticated merchants. The introduction of the NESA program can make decisions more difficult. To help guide merchants, Coalfire and FreedomPay held a webinar "P2PE & NESA for...
A Growing Symphony of Security Analytics Tools Needs Careful Orchestration
Security analytics tools available to companies are increasing rapidly. However, cyber incident and vulnerability prevention, detection, response, and recovery times remain significant challenges as the types of attacks and attack vectors increase. Newer cyber analytics using machine learning are...
Reconciling Quarterly ASV and QSA Scanning Requirements
In the compliance realm, the term "quarterly" seems to be a sound and straight-forward term used to provide guidance and to aid entities in adhering to requirements. However, its meaning can vary based on its context in relation to dealing with various compliance requirements from your ASV and QS...
Ghosts in the Bank
It was a dark night. A car pulled up in the parking space next to me and quickly extinguished his lights. I looked out the my window and saw the driver. He gave me a quick nod and we exited our cars. Opening the trunk I pulled out my tools for the night. A backpack full of trash bags, a flash...
Robert Flores Named Vice President of IT
Coalfire welcomes Robert Flores as the newest addition to the cybersecurity risk management and compliance service leaders leadership team as its Vice President of Information Technology. Flores has a proven track record of driving strategy for high-growth IT companies while managing billion-doll...
What to Expect in the PCI 3.2 Update
A preview of new requirements and guidance expected later this month from the Payment Card Industry Security Standards Council was announced Thursday. The PCI DSS 3.2 version represents the first update to the standard that the Council has released since 3.1 in April 2015 and 3.0 in November of...
Report from the PCI SSC North American Community Meeting
The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...
WS2-Cybersecurity Fundamentals Workshop
2 day Workshop Saturday 17 October - Sunday 18 October, 9:00 a.m. - 5:00 p.m...
Coalfire Receives Investment from The Carlyle Group and The Chertoff Group
Im pleased to announce that we recently closed on a significant investment from The Carlyle Group and The Chertoff Group - two prestigious investment groups that both have extensive experience in the cybersecurity space. The selection of these two firms came after an extensive six-month process o...
COSO Framework for Service Organizations and SOC Reporting (Part 1 of 3)
One of the most important reference tools that companies use to establish and evaluate their internal controls is the Committee of Sponsoring Organizations COSO Internal Control - Integrated Framework. Initially published in 1992 the 1992 Framework, the COSO framework has been the most widely use...
Emerging Payment Technologies and Due Diligence: A Warning about “Silver Bullets”
2015 will be an exciting year for the payments industry, especially for merchants that now have a number of new payment technologies at their disposal. Emerging payment technologies such as Point-to-Point-Encryption P2PE, Tokenization, EMV/Chip and Signature and Mobile Payment Acceptance are...
Social Engineering- Beyond the Baseline
Coalfire Labs does a lot of Social Engineering testing. Traditional Social Engineering testing involves a mundane process of taking a sample of a population and then attacking those "targets" with some pretext calls or a phishing email in order to obtain credentials. Metrics are recorded and then...
IT Security Horror Story: Digging your own grave with Default Credentials
I recently performed a penetration test that really required no "hacking skills" whatsoever. I was able to obtain domain administrator rights simply by logging into web applications and network hardware using default credentials...