“Hacking is satisfying one’s curiosity. Hacking is finding a way to accomplish a goal, never accepting no for an answer, and being more persistent and patient than anyone else. Hacking is pushing technology to its limits and making technology more resilient through testing, tinkering, and exploration. Hacking is a mindset, a culture, a spirit, and […]
We’ve all heard the phrase “the network never lies”, but as more organizations adopt cloud computing, getting access to the network in the cloud has been challenging. Initially, cloud services, such as AWS CloudWatch and AWS CloudTrail, allowed you to collect logs, events, and metrics from your cloud environment, but not network packets or flows. […]
We’ve been scanning for vulnerabilities for a very long time (over 20 years for me), but the shift away from device vulnerabilities to application vulnerabilities creates some new challenges. Applications in the modern, digitally transformed world are much more complex. They include open source components and custom code, are deployed in containers, and run in […]
(This post provides an overview of vulnerability assessment and penetration testing activities. For a deeper dive into advanced penetration testing techniques and the latest security research tune-in to Paul’s Security Weekly.) Over the decades, many have inaccurately described vulnerability assessments as penetration tests. What is the difference between a vulnerability assessment and a penetration test? […]
The integration of development, security, and operations, known as DevSecOps, has been a hot topic over the past few years. The benefits of implementing DevSecOps, such as better code quality, increased velocity, and reduced risk, has its advantages, but how do you effectively integrate security into the existing DevOps process? Shifting security left is easier […]
While everyone else talks about 2020 predictions and New Year’s resolutions, let’s start the year with some practical and useful information…
We hear a lot about security orchestration, automation, and response. It will help us with our security skills gap. It will improve our operational efficiency, thus reducing mean time to detect and respond to incidents. It will give us more time for threat hunting. But how much is really being automated? In sponsorship with ServiceNow, […]
For decades, anyone analyzing network traffic concentrated on external network traffic, known as north-south traffic, through the perimeter via firewalls. Although firewalls evolved to better analyze this traffic, two primary trends emerged: 1) cloud adoption was causing the perimeter to become more porous, even to the point of extinction, and 2) as attackers gained sophistication, […]
We’ve heard the same story for years. Antivirus software is not effective in stopping cyber-attacks, as hackers have adapted their techniques to evade signature-based detections. Even next generation antivirus, which apply techniques such as machine learning and behavioral analytics, is no more effective at protecting an organization than its older sibling. But why? The simple […]
Security Weekly, the security podcast network for the security community and security market validation company for the security industry, announced today it has named security industry veteran, Matt Alderman, as Chief Executive Officer. “The security industry faces a constant addition of new security vendors in an already crowded and confusing market. Security Weekly cuts through […]
