IT Security Horror Story: Slow Network, Big Phish

It was a typical morning, just like any other for Annie. She arrived at the office just in time to fill her coffee mug and get to her desk to read her email that had been piling up since Friday. After reading through the standard office wide emails she came across one from the help desk...

Cybersecurity and the Financial Services Industry

2014 is the year that the US Securities and Exchange Commissions Office of Compliance Inspections and Examinations OCIE is turning its focus to cybersecurity, a looming threat to any and all companies that utilize the internet. In case you missed my last post, back in March the OCIE hosted a...

Emerging Threats and Going Beyond Compliance

I recently presented to a C-level gathering of retail finance executives about the industrys changing threat landscape and the emerging threats facing omni-channel sellers. The retail security environment has changed dramatically in the past few years. Not that long ago, retailers mostly worried...

The Lesson of eBay

After every major cyber breach, security professionals are asked about the lessons we can learn from them. While the technical details of the eBay attack arent yet public, we can already learn lessons about from companys public statements and its communications to its customers...

The Top 3 Security Issues in Federal Cloud Computing

A journalist recently asked me for my top three pressing concerns related to Federal cloud security. Here are a few points I had to offer up...

Target Hackers Broke in Via HVAC Company?

When I first heard about the account used to gain access to the Target environment, my first reaction was to laugh at the ridiculousness of the HVAC vendor having an impact on the CDE like it seems to or is rumored to have had in the recent breach. Then I started thinking with the PCI controls,...

Free and low-cost tools for PCI DSS Compliance

Complying with the PCI DSS requires policies and processes plus implementing and managing a variety of software tools. As a QSA who has performed many PCI assessments for merchants and service providers, Ive seen and assessed a variety of free and low-cost under $200 software tools that help our...

IT Security Horror Story #3: Ghost in the Machine

A supernatural sequence of automotive portals and applications yield a ghostly in-car phenomenon. READ MORE…IF YOU DARE -...

PCI DSS 3.0 puts emphasis on year-round awareness

Its easy to think of PCI compliance as just another annual hoop to jump through. Of course, after the annual audit, the business is safe for another 12 months, right? Well, not exactly, and with the upcoming release of PCI DSS 3.0, there will be an even bigger reason to think about compliance...

The PCI DSS Cloud Computing Guidelines: An Executive Summary

The PCI SSC and its Cloud Special Interest Group has released its Cloud Computing Guidelines after a year of collaboration and input from SIG members. Coalfire was a big contributor to this document, and we think it is required reading for anyone who has front-line responsibility for managing...

FedRAMP PMO - FedRAMP Process and Developing SSP webinar Q&A

The FedRAMP program continues to gain momentum and GSA and the FedRAMP PMO conduct great, interactive, webinars available to attend live or to watch later. There is much to learn from the GSA on how to navigate the FedRAMP process according to their requirements...

IT Security Horror Stories: The Case of the Phantom Technician

At Coalfire Labs, we discover--and help our clients address--a lot of scary security and compliance problems. Like zombies out looking for a victim, nefarious characters are out to attack your IT infrastructure and compromise your systems. Even when organizations have protections in place, the...

My DEFCON social engineering talk and DerbyCon

This year has been a year of firsts for me and for Coalfire. I was recently hired to my first Information security job as a penetration tester for Coalfire Labs, the forensic and app/network testing side of Coalfire. Many of the Coalfire Labs team attended DEFCON in Las Vegas in early August.. No...

Coalfire in the News

Its been quite a season in the world of IT security as we move into 2012. As experts in our field, we are often asked to comment on current trends and recent stories. Take some time to check out what we have had to say recently:...

Is it Safe to Speak? Protection for Telephone-Based Payment Card Data

Recently, the PCI Security Standards Council released educational resource requirements for securing cardholder data in audio recordings. The PCI SSC has been focusing on call center operations and recording systems of merchants. The need to provide a secure system to protect cardholder data is a...

How the CISO drives value across the enterprise

Coalfire's Securealities 2023 State of CISO Influence report shows that CISOs have a growing responsibility to report to the board/c-suite. During budget planning, CISOs can drive value and secure budget allocations by demonstrating Return on Security Investment ROSI...

Six steps to prepare your application security team for a penetration test

This blog post will show step-by-step how an application security team should prepare for a penetration test...

Everything you need to know about HITRUST v11

HITRUST v11 is finally here. In this blog post, Coalfire HITRUST experts provide guidance to address the key details surrounding the transition timelines and what organizations can expect with the latest version...

It’s time to bite the bullet for more secure software

On September 14, 2022, the Office of Management and Budget OMB released their M-22-18 memorandum on "Enhancing the Security of the Software Supply Chain through Secure Software Development Practices." This document builds upon previous government documents such as Executive Order EO 14028...

Software supply chain security is coming of age

Coalfires first Securealities Software Supply Chain Risk Report revealed dramatic budget increases for enterprise security in general and a growing demand for more testing, training, and process improvements in the battle to defend digital assets. But perhaps the most significant takeaway from th...

Security as a differentiator: How to market the secure customer experience

Leveraging software development lifecycle security as a go-to-market differentiator is imperative in setting companies apart from competitors. As Coalfires Cloud Advisory Board and my colleague Gail Coury eloquently pointed out in our recent Securealities Report, Smartest Path to DevSecOps...

View TPRM risk through four lenses

In recent years, as attackers seek to gain entry and disrupt business through vendors, Third Party Risk Management TPRM has proven to be a top priority item for every organization. As organizations mitigate the risks associated with a third party-related attack, leaders should continue to address...

Hacking Ham Radio: WinAPRS – Part 3

In part two of this series, we reviewed our WinAPRS software and hardware configuration. We then began reverse engineering WinAPRS and fuzzing it for vulnerabilities using modified open-source software. Finally, we identified a potentially exploitable vulnerability. This installment will dig into...

A little actually doesn’t go a long way: Fight the urge to shortcut your TPRM program

Third Party Risk Management TPRM is hard to get right. Ineffective TPRM is when 83% of legal and compliance leaders identify third party risks after due diligence, despite spending 73% of effort on due diligence. This is supported by 49% of business leaders saying they lack a centralized strategy...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...

MIME sniffing in browsers and the security implications

Whenever a website in opened in a browser, there are many tasks that are being silently performed in the background. One of those tasks is fetching resources such as images, stylesheets and JavaScript from different domains on the internet and then parsing those resources...

Automated application scanning: handling complicated logins with AppScan (only!)

Ory Segal @orysegal from IBM Rational reached out with a simpler method to handle this natively in AppScan. It involves configuring AppScan to add a custom parameter to each request. For the sample case in the authexamples GitHub repository it would be handled like this...

Managing Application Vulnerabilities Manually?

In spite of the fact that automation and application vulnerability resolution platforms like ThreadFix have existed for a decent length of time, we continue to see organizations that try to muscle ahead with their existing manual processes. We continue to be surprised that organizations manage...

Help Net Security – ThreadFix 3.0 Review

Help Net Security recently published a review of ThreadFix 3.0. Security Researcher, Toni Grzinic, took a deep dive into our vulnerability management platform and broke down everything from infrastructure, reporting and analytics, to integrations, and beyond. Click here to read Tonis full review ...

Reflections on Women in Cybersecurity

I joined Coalfire in 2014. At the time, there were very few women in cyber, much less in leadership roles. As it sometimes happens, I found myself in an elevator with Tom McAndrew, who is now our CEO. We started talking about the direction of my career and plans for my role as Director of Coalfir...

State privacy laws: 2020 highs and lows

2020 is shaping up to be another interesting year for data privacy, especially given that public health agencies, private companies, and states are now working feverishly to create contact tracing apps and programs while still preserving privacy. Being thoughtful and accountable about data privac...

A strategy for cybersecurity strategy

Let's start with an assumption: Having a cybersecurity strategy is best practice. So, what makes a good cybersecurity strategy? You'd be surprised how this answer varies across the security industry, especially from seasoned CISOs of Fortune 500 companies...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

What can Application Security Testing add to DevOps programs?

The adoption of DevOps practices by organizations to shorten the standard development lifecycle has put new pressure on security teams to keep up with the pace of development within CI/CD pipelines. In order to accomplish this, security teams need to provide better security insights to developers...

Dodge Data Breaches with Real-Time PCI Compliance

Its been five years since the PCI Council released the first "Best Practices for Maintaining PCI DSS Compliance" guidance document in August 2014. Since then, many prominent payment data breaches have occurred, with the finger often pointing to lapses in the affected organizations compliance...

Coalfire participates in cybersecurity disaster exercise at the 2019 HSCC Spring Summit

The Healthcare and Public Health Sector Coordinating Council HSCC conducted their biannual Joint Cybersecurity Working Group JCWG All-Hands Meeting on April 3-4, 2019. As a member of HSCC, Coalfire participated in the JCWG meeting with other security leaders from across the healthcare industry an...

Upcoming Changes to Cryptographic Findings in Q4 2018

The security world is a constantly changing and evolving landscape, and as part of Coalfire's commitment to security, we need to constantly review and update vulnerability information for vulnerability scanning to keep up. We've made some changes to previously acceptable vulnerability checks, whi...

Cloud Security Governance - Optimizing the Business Benefits of Security in the Cloud

Enterprises are increasingly pursuing the business advantages of migrating technology platforms and services into the cloud environment leveraging one or more of the three main cloud service areas - Infrastructure as a Service IaaS, Platform as a Service PaaS, and Software as a Service SaaS. Thes...

She Powers Tech

November 28th at the Venetian in Las Vegas, AWS re:INVENT held an important session that could shape the future of technology. The sold-out session, SHE POWERS TECH: Women Supporting Women in Tech, filled a ballroom with 500 women in technology and a few men who were interested in the topic. The...

Blueborne – Don’t Panic!

Here is what we know right now: Security company Armis recently released research identifying eight newly discovered vulnerabilities that exist in the wireless communications protocol Bluetooth, which could potentially affect a large percentage of the estimated 8.2 billion Bluetooth enabled...

How to Address Major Gaps in Third-Party Risk Management Programs

While securing the organizational environment, its easy to focus on the enterprise assets without thinking as much about the vendor ecosystem. However, that extended ecosystem and how it interacts with the organization is a potential significant risk if not secured properly...

Getting cert-y with all-5 AWS certs

I thought my recent experience achieving all five 5 AWS certs might be helpful to others in the community that are looking to do the same. However, this blog isnt meant to stand on its own, and I encourage everyone interested in going for all 5 certs to read other blogs posts too...

SOC 2 Type 1 and SOC 2 Type 2 Frequently Asked Questions

Coalfires SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you wil...

What does the FBI have to say about ransomware

The FBI provided guidance on ransomware at a recent FBI/US Secret Service/ISAC event. They defined ransomware as a type of malware that is commonly transmitted through malicious email, which is disguised to look normal. Once the email link has been clicked on, or an email attachment has been...

The Cost of a FedRAMP Assessment from a 3PAO Perspective

FedRAMP.gov recently published a blog titled How Much Does It Cost to Go Through FedRAMP? As a FedRAMP Third Party Assessment Organization 3PAO, we wanted to provide additional factors for consideration for organizations that are evaluating or pursuing a FedRAMP authorization...

EC Ruling Invalidates Safe Harbor - Now What?

In a ruling on October 7, 2015 the European Court of Justice ECJ invalidated the principal European component of the U.S.-E.U. Safe Harbor Framework when it ruled in Schrems v. Data Protection Commissioner. In the ruling the court said that the existing U.S.-EU Safe Harbor agreement, overseen by...

Audio Video Media Forensics

Our media forensics practice is a fast growing part of Coalfire. Were often asked what we can do, and this post is intended to be a quick primer to provide some background if youre in need of this service and what you can expect from us and others in the field...

RFPs and Needs Assessments for Higher Education

In this blog post, I will be discussing RFP best practices for Higher Education Institutions. Having worked with higher education organizations for a number of years, Ive noticed some trends that could be useful as you and your department or institution head into another year of projects that may...

COSO Framework for Service Organizations and SOC Reporting (Part 3 of 3)

In part 1 of this series, we discussed the recent changes to the COSO framework and the overall impact that the updated framework has on service organizations that receive Service Organization Controls SOC reports...

PCI DSS version 3.1 released!

As expected, a "minor" revision to the PCI DSS 3.0 standard now version 3.1 was released by the PCI SSC today to address the vulnerabilities exposed by the POODLE and BEAST browser attacks. PCI DSS 3.1 primarily addresses the insecure use of SSL as an encryption protocol within a Cardholder Data...