Using Azure Blueprints to Control Azure Compliance

As Peter Parker says, with great power comes great responsibility. And so it goes with public cloud: With cloud scale and agility come cloud-scale problems and compliance nightmares. Every day, IT professionals balance the need to act quickly--often leveraging cloud speed of execution to implemen...

Baselining PassGAN: Adventures in the rhubarb

Cracking is a complex topic full of misunderstandings, confusing terminology and weird people. This blog post is front-loaded with some terminology, some explanations, and maybe some apologies. Password cracking: This is fundamentally one thing: guessing. Were not reversing, or talking to spirits...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

So your company has decided to do FedRAMP - What does that mean?

The exponential increase in cloud adoption in recent years has led to a dramatic increase in technology companies evolving from software and application companies to Software as a Service SaaS, Platform as a Service PaaS or Infrastructure as a Service IaaS providers. The 2011 release of the Cloud...

With IoT, common devices pose new threats

For Instance… Hackers Setting Your 3D Printer on Fire The world is careening toward the reality that almost all electronics in your home and business are connected to the internet. Many of these devices contain things like heating elements, batteries, and motors that are entirely...

ERC.Net – A Toolset for Analyzing Windows Application Crashes

ERC.Net is a collection of tools designed to assist in analyzing and debugging Windows application crashes in order to identify potential security vulnerabilities. Supporting both 64 and 32 bit applications, ERC.Net has many use cases including parsing Windows file headers, identifying compile-ti...

NIST SP 800-171A Assessment: Finalized Assessment Objectives Foster a Roadmap to Compliance

On June 13, 2018, NIST formally released their Special Publication SP 800-171A, Assessing Security Requirements Controlled Unclassified Information CUI.This publication provides organizations with an assessment methodology to evaluate their compliance with the CUI security requirements defined in...

Incident Response: Do Your Vendor Contracts Have Claws (for Liability)?

In previous blogs, weve discussed some of the struggles organizations have when responding to cyber incidents. For many, it is the recovery aspect, and specifically vendor liability for the data or privacy breach, that poses many questions. In trying to assign liability, the obvious place to star...

Scripted Inputs and Splunk

Splunk is an extremely versatile tool when dealing with data: - Monitor files? Check! - Listen in on an open port? Check! - Monitor the file system? Performance monitor? HTTP Event Collector? - Check, check aaaaand check! But what if the data you want to ingest does not have a method listed...

Blockchain: Are You Ready?

By now, most of us have heard of Bitcoin. Few of us really know the specifics about what that is. Fewer still have a workable or even cursory knowledge of the underlying technology that makes Bitcoin possible...

Q&A from P2PE-NESA Webinar for Merchants

The selection of a PCI-listed P2PE solution and determination of expected benefits can be challenging for even the most sophisticated merchants. The introduction of the NESA program can make decisions more difficult. To help guide merchants, Coalfire and FreedomPay held a webinar "P2PE & NESA for...

A Growing Symphony of Security Analytics Tools Needs Careful Orchestration

Security analytics tools available to companies are increasing rapidly. However, cyber incident and vulnerability prevention, detection, response, and recovery times remain significant challenges as the types of attacks and attack vectors increase. Newer cyber analytics using machine learning are...

Cloud Burst?

The cloud can burst!? This weeks AWS service disruption showed us the importance of architecting a system to account for failure, and how to be successful when deploying your solution in the cloud...

Reconciling Quarterly ASV and QSA Scanning Requirements

In the compliance realm, the term "quarterly" seems to be a sound and straight-forward term used to provide guidance and to aid entities in adhering to requirements. However, its meaning can vary based on its context in relation to dealing with various compliance requirements from your ASV and QS...

Ghosts in the Bank

It was a dark night. A car pulled up in the parking space next to me and quickly extinguished his lights. I looked out the my window and saw the driver. He gave me a quick nod and we exited our cars. Opening the trunk I pulled out my tools for the night. A backpack full of trash bags, a flash...

Robert Flores Named Vice President of IT

Coalfire welcomes Robert Flores as the newest addition to the cybersecurity risk management and compliance service leaders leadership team as its Vice President of Information Technology. Flores has a proven track record of driving strategy for high-growth IT companies while managing billion-doll...

What to Expect in the PCI 3.2 Update

A preview of new requirements and guidance expected later this month from the Payment Card Industry Security Standards Council was announced Thursday. The PCI DSS 3.2 version represents the first update to the standard that the Council has released since 3.1 in April 2015 and 3.0 in November of...

Report from the PCI SSC North American Community Meeting

The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...

WS2-Cybersecurity Fundamentals Workshop

2 day Workshop Saturday 17 October - Sunday 18 October, 9:00 a.m. - 5:00 p.m...

COSO Framework for Service Organizations and SOC Reporting (Part 1 of 3)

One of the most important reference tools that companies use to establish and evaluate their internal controls is the Committee of Sponsoring Organizations COSO Internal Control - Integrated Framework. Initially published in 1992 the 1992 Framework, the COSO framework has been the most widely use...

Emerging Payment Technologies and Due Diligence: A Warning about “Silver Bullets”

2015 will be an exciting year for the payments industry, especially for merchants that now have a number of new payment technologies at their disposal. Emerging payment technologies such as Point-to-Point-Encryption P2PE, Tokenization, EMV/Chip and Signature and Mobile Payment Acceptance are...

Social Engineering- Beyond the Baseline

Coalfire Labs does a lot of Social Engineering testing. Traditional Social Engineering testing involves a mundane process of taking a sample of a population and then attacking those "targets" with some pretext calls or a phishing email in order to obtain credentials. Metrics are recorded and then...

IT Security Horror Story: Digging your own grave with Default Credentials

I recently performed a penetration test that really required no "hacking skills" whatsoever. I was able to obtain domain administrator rights simply by logging into web applications and network hardware using default credentials...

IT Security Horror Story: Slow Network, Big Phish

It was a typical morning, just like any other for Annie. She arrived at the office just in time to fill her coffee mug and get to her desk to read her email that had been piling up since Friday. After reading through the standard office wide emails she came across one from the help desk...

Stop Hitting the Snooze Button

In the aftermath of the most damaging retail breach in history, a CEO in the financial industry explained his companys position on the issue:...

Cybersecurity and the Financial Services Industry

2014 is the year that the US Securities and Exchange Commissions Office of Compliance Inspections and Examinations OCIE is turning its focus to cybersecurity, a looming threat to any and all companies that utilize the internet. In case you missed my last post, back in March the OCIE hosted a...

Emerging Threats and Going Beyond Compliance

I recently presented to a C-level gathering of retail finance executives about the industrys changing threat landscape and the emerging threats facing omni-channel sellers. The retail security environment has changed dramatically in the past few years. Not that long ago, retailers mostly worried...

The Lesson of eBay

After every major cyber breach, security professionals are asked about the lessons we can learn from them. While the technical details of the eBay attack arent yet public, we can already learn lessons about from companys public statements and its communications to its customers...

The Top 3 Security Issues in Federal Cloud Computing

A journalist recently asked me for my top three pressing concerns related to Federal cloud security. Here are a few points I had to offer up...

Target Hackers Broke in Via HVAC Company?

When I first heard about the account used to gain access to the Target environment, my first reaction was to laugh at the ridiculousness of the HVAC vendor having an impact on the CDE like it seems to or is rumored to have had in the recent breach. Then I started thinking with the PCI controls,...

Free and low-cost tools for PCI DSS Compliance

Complying with the PCI DSS requires policies and processes plus implementing and managing a variety of software tools. As a QSA who has performed many PCI assessments for merchants and service providers, Ive seen and assessed a variety of free and low-cost under $200 software tools that help our...

PCI DSS 3.0 puts emphasis on year-round awareness

Its easy to think of PCI compliance as just another annual hoop to jump through. Of course, after the annual audit, the business is safe for another 12 months, right? Well, not exactly, and with the upcoming release of PCI DSS 3.0, there will be an even bigger reason to think about compliance...

The Rapidly Changing World of Mobile Application Payment Systems Compliance

In this series of Compliance Talk, Dirk and Ken are back at their favorite coffee shop, this time joined by Dan Fritsche. Dan is Coalfires Director of Solution Validated Services and is considered a thought leader on mobile payments, P2PE and other emerging trends in the payments industry...

Determining if your Company is Prepared for FedRAMP

Many companies interested in pursuing FedRAMP are seeking guidelines, checklists and any referenceable source to help them understand and determine their level of preparedness to go through the FedRAMP process. The GSAs FedRAMP.gov site provides documentation on the FedRAMP process in their "Guid...

The PCI DSS Cloud Computing Guidelines: An Executive Summary

The PCI SSC and its Cloud Special Interest Group has released its Cloud Computing Guidelines after a year of collaboration and input from SIG members. Coalfire was a big contributor to this document, and we think it is required reading for anyone who has front-line responsibility for managing...

FedRAMP PMO - FedRAMP Process and Developing SSP webinar Q&A

The FedRAMP program continues to gain momentum and GSA and the FedRAMP PMO conduct great, interactive, webinars available to attend live or to watch later. There is much to learn from the GSA on how to navigate the FedRAMP process according to their requirements...

IT Security Horror Stories: The Case of the Phantom Technician

At Coalfire Labs, we discover--and help our clients address--a lot of scary security and compliance problems. Like zombies out looking for a victim, nefarious characters are out to attack your IT infrastructure and compromise your systems. Even when organizations have protections in place, the...

My DEFCON social engineering talk and DerbyCon

This year has been a year of firsts for me and for Coalfire. I was recently hired to my first Information security job as a penetration tester for Coalfire Labs, the forensic and app/network testing side of Coalfire. Many of the Coalfire Labs team attended DEFCON in Las Vegas in early August.. No...

Coalfire in the News

Its been quite a season in the world of IT security as we move into 2012. As experts in our field, we are often asked to comment on current trends and recent stories. Take some time to check out what we have had to say recently:...

Coalfire Systems Speaking at Shared Assessments Summit 2011

Do you know how to ensure reliability and resiliency in cloud and SaaS environments? Join leaders from within the IT outsourcing risk management industry at the Shared Assessments Summit 2011 in Boston on March 29 and 30. Coalfire is participating in this summit because the value of managing risk...

Celebrating Black History Month: Reflections as the Chair of Coalfire's Black Employee Resource Group

As we embark on another February, I am honored to reflect on the significance of Black History Month from the perspective of serving as the chair of Black Employees in Cybersecurity Obtaining Mentorship, Influence, Networking, and Growth B.E.C.O.M.I.N.G., Coalfire's Black Employee Resource Group...

Celebrating Asian American and Pacific Islander (AAPI) Heritage Month

Coalfire employees share what Asian American and Pacific Islander AAPI Heritage Month means to them...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

Reflections on the 2023 RSA Conference: Trends, takeaways, and the shift-left approach to cybersecurity

The 2023 RSA Conference brought together over 45,000 cybersecurity professionals from around the world to discuss the latest trends, technologies, and best practices in the field. Key themes that emerged at the conference included the intersection of cybersecurity and artificial intelligence AI,...

It’s time to bite the bullet for more secure software

On September 14, 2022, the Office of Management and Budget OMB released their M-22-18 memorandum on "Enhancing the Security of the Software Supply Chain through Secure Software Development Practices." This document builds upon previous government documents such as Executive Order EO 14028...

Software supply chain security is coming of age

Coalfires first Securealities Software Supply Chain Risk Report revealed dramatic budget increases for enterprise security in general and a growing demand for more testing, training, and process improvements in the battle to defend digital assets. But perhaps the most significant takeaway from th...

Security as a differentiator: How to market the secure customer experience

Leveraging software development lifecycle security as a go-to-market differentiator is imperative in setting companies apart from competitors. As Coalfires Cloud Advisory Board and my colleague Gail Coury eloquently pointed out in our recent Securealities Report, Smartest Path to DevSecOps...

View TPRM risk through four lenses

In recent years, as attackers seek to gain entry and disrupt business through vendors, Third Party Risk Management TPRM has proven to be a top priority item for every organization. As organizations mitigate the risks associated with a third party-related attack, leaders should continue to address...