High-value penetration testing involves modeling the techniques used by real-world computer attackers to find vulnerabilities, and, under controlled circumstances, to exploit those flaws in a professional, safe manner according to a carefully designed scope and rules of engagement. This process helps to determine business risk and potential impact of attacks, all with the goal of helping the organization improve its security stance.

(more…)

Attackers use a variety of techniques to discover passwords, including using powerful tools freely available on the internet. The following advice makes password security easier for your users – improving your system security as a result.

Passwords can be intercepted as they are transmitted over a network. Automated guessing of billions of passwords until the correct one is found.  (more…)

Penetration testing will never be an exact science where a complete list of all possible issues that should be tested can be defined. Indeed penetration is only an appropriate technique to test the security of web applications under certain circumstances. For information about what these circumstances are, and to learn how to build a testing framework and which testing techniques you should consider, we recommend reading the OWASP Testing Framework Part One (http://www.owasp.org) .

(more…)

Cybersecurity blue teams are groups of individuals who identify security flaws in information technology systems, verify the effectiveness of security measures, and monitor the systems to ensure that implemented defensive measures remain effective in the future. While not exclusive, this list is heavily biased towards Free Software projects and against proprietary products or corporate services.

(more…)

This document outlines a catalogue of threats to mobile devices and associated mobile 166 infrastructure to support development and implementation of mobile security capabilities, best 167 practices, and security solutions to better protect enterprise information technology (IT). Threats 168 are divided into broad categories, primarily focused upon mobile applications and software, the 169 network stack and associated infrastructure, mobile device and software supply chain, and the 170 greater mobile ecosystem.

(more…)