Jeremy Johnson

Home/Jeremy Johnson

About Jeremy Johnson

This author has not yet filled in any details.
So far Jeremy Johnson has created 5 blog entries.

Don’t Let Urgency Lead to Insecurity-WST

2020-04-09T14:43:17+00:00

March 26, 2020 Don't Let Urgency Lead to Insecurity - WST Across the country, institutions are finding themselves dusting off almost forgotten pandemic plans and quickly trying to adjust to new realities.  Many of our clients are scrambling to deploy remote work solutions for large numbers of employees.  At the same time, they find themselves in that same old quandary of balancing functionality with security. Stressed and very busy IT folks are quickly standing up new infrastructure, which is a perfect situation for inadvertent misconfigurations.  Don’t become that low hanging fruit the bad guys are just circling [...]

Don’t Let Urgency Lead to Insecurity-WST2020-04-09T14:43:17+00:00

Attackers are opportunistic, keep new remote users safe

2020-04-09T14:43:42+00:00

March 19, 2020 Keep New Remote Users Safe - WST As institutions and companies around the world scramble to support a new or enlarged remote workforce, we are already seeing attackers take advantage of fear and confusion to launch attacks using COVID-19 as a topic.  The bad guys have always leveraged disasters and major events to improve success rates and the current pandemic is no different. As you are quickly training new remote workers, make sure you remind them to be on the lookout for phishing attacks that will be targeting them.  Credential theft is likely going [...]

Attackers are opportunistic, keep new remote users safe2020-04-09T14:43:42+00:00

Penetration Test and the Vulnerability Assessment

2019-07-16T18:27:08+00:00

Penetration Test vs the Vulnerability Assessment Some say Potato, some say Patato. The term "Penetration Test" has been thrown around a lot in the Information Security industry. Some vendors and institutions use the term Penetration Test interchangeably with "Vulnerability Scan" (or Assessment), when in fact, the two define very different scopes, methodologies, and deliverables. The recently updated FFIEC Information Security Booklet discusses these types of tests and offers definitions and expectations of what is required of financial institutions in these areas. The short story is that yes, both are different, and yes, both are needed as part of an effective [...]

Penetration Test and the Vulnerability Assessment2019-07-16T18:27:08+00:00

The Patch is Only the Beginning

2019-07-30T21:52:54+00:00

The Patch Sometimes it is only the beginning. Not all patches work out of the gate. Anyone who has been responsible for patch management knows that it is a never ending cycle of download, test, patch and repeat. What is often overlooked, unfortunately, is that sometimes, even when a patch is applied, the vulnerability it is supposed to fix isn't always fixed…not right away at least. Over the past few years, there have been several Microsoft vulnerabilities that need additional action after the patch is applied to actually render the vulnerability remediated. When performing Internal Vulnerability Scanning, time and again [...]

The Patch is Only the Beginning2019-07-30T21:52:54+00:00

Exposed Management Consoles

2018-04-02T17:53:46+00:00

Exposed Management Consoles - A look at Microsoft Exchange In most organizations where we find Microsoft Exchange, we find Outlook Web Access (OWA) open to the internet. Generally, external access to OWA and ActiveSync is allowed when mobile users are accessing Exchange email. This is all hosted using Microsoft's Internet Information Services (IIS). What many administrators may not realize is what other websites are running by default and may be exposed to the internet as well. Microsoft Exchange uses different server roles to determine what services a server offers and hosts. The Client Access role generally is what provides services [...]

Exposed Management Consoles2018-04-02T17:53:46+00:00