Successful mitigation of today’s security threats requires an approach that is both on the offensive and on the defensive. Here, we give our take on how to approach and handle specific security challenges, as well as our reaction to some of the latest industry topics.
04.22.20How We Compromised a Major Corporate Network During a Physical Pen Test Here’s a “pro tip” for any company out there using armed guards to protect their facility: If you’re not properly segmenting your network, those armed guards can’t do anything to stop an attacker from compromising your company’s private data. We recently conducted a… Read more »
03.19.20Notice to Our Customers While organizations around the world are reorganizing their workforces to handle the current health issue, I’d like to take this moment to reassure you that we at DirectDefense are well prepared to facilitate the services you count on us to provide for you. Unlike most industries that maintain a collective work… Read more »
03.19.20COVID-19 has people suddenly working from home, but there are attackers seizing on the opportunity to compromise virtual networks.
12.10.19Significant Volume of Brute Force Attempts Against Ingress Authentication Sources In the past 72 hours there has been a significant volume of brute force attempts against various ingress authentication sources (like o365 or VPN solutions). We have seen this across all of our customers and that this activity is both typical for this time of… Read more »
12.04.19Revisiting the Security Threats That Marked 2019 and How They Were Managed Wow, what a year it has been! Security attacks in 2019 were marked by a resurgence of Ransomware attacks, business email compromise (BEC) attacks, and the discovery of painful blind spots in existing security programs for our new, and in some cases older,… Read more »
03.21.19During application testing, most SQL injection attacks are mundane. Often, when there is one SQL injection, there are many–and they are easily exploitable with tools like sqlmap. Occasionally, an application is largely protected against SQL injection, but something interesting happens on a test. A tester manually validates a SQL injection vulnerability based on server responses,… Read more »
12.13.18Assessing the Successes (and Failures) of Organizations’ Information Security Orchestration and Automation Response Solutions As 2018 comes to a close, we must look at the information security and managed services trends already established this year, and those on deck for 2019. To get things going ahead of the new year, we thought we would share… Read more »
09.25.18Learn how to prevent the exploitation of Amazing S3 buckets with weak permissions from one of our security consultants.
06.26.18Turn Your Software Development Security into a Repeatable Engineering Process Companies have long viewed application security testing as a black art that’s dependent upon a small number of experts wielding arcane tools to find vulnerabilities and develop exploits. However, as the velocity of software development increases, the old way of running security tests becomes less… Read more »
04.11.18No, this blog post isn’t about the credit cards or identity theft. It’s about the tools that, as a security professional, you should keep stored in your “security wallet.” Like any tradecraft, security professionals should have a set of tools, in this case, applications, websites, and resources, that they keep on-hand. These items become your… Read more »
