Information Security News

/Information Security News

Penetration Testing – What kind should you get

2019-04-03T20:22:00+00:00

What’s in a Penetration Test? Penetration testing has become a standard requirement for the majority of our clients, and there are myriad factors that go into a successful penetration testing engagement for both the client and the evaluator.  Let’s take a look at what commonly comprises a penetration test, and the related testing actions that are performed. External Penetration Testing This is generally the type of test people think of when they hear about a Penetration Test.  An External Penetration Test is a simulated cyber-attack launched against the target institution and may include both technical and social engineering methods.  The [...]

Penetration Testing – What kind should you get2019-04-03T20:22:00+00:00

The Low-Down on Multi-Factor Authentication

2019-02-22T21:57:57+00:00

The Low-Down on Multi-Factor Authentication Multi-Factor Authentication, Strong Authentication, 2FA, MFA, Token-Based, Out-of-Band Authentication; what does it all mean?  Many more people are familiar with these terms than just a few years ago.  But, not all multi-factor authentication (MFA) types are created equal.   MFA solutions are designed to protect their users’ accounts in the event of credential theft.  With more advances in software technology and features, comes more vulnerabilities and potential ways for attackers to gain your password.  However, just how effective are the various MFA types?  Many MFA solutions have recently flooded the market, and that raises the question: [...]

The Low-Down on Multi-Factor Authentication2019-02-22T21:57:57+00:00

I’ll Tell You What You Need to Know

2019-02-22T18:10:39+00:00

I’ll Tell You What You Need to Know While walking past the president’s office, he sees and summons you into his office and asks if you can fix the printer on the back wall.  After astutely seeing the printer’s status panel is indicating “Out of paper,” you load paper and voila, it prints.  “Hey, you’re pretty good at this technology stuff.  Our last exam said we had to appoint an Information Security Officer that isn’t part of the IT Department.  That will be you.”  The president gets the Board of Directors to formalize the role and title, and before you [...]

I’ll Tell You What You Need to Know2019-02-22T18:10:39+00:00

Windows Update Management Tips

2019-02-22T18:12:21+00:00

Windows Update Management Tips Windows Updates…  Believe it or not, they’ve been around since the days of Windows 98.  They are often despised by end users and IT support staff because they may interrupt the workday, delay leaving at the end of the day, or they may break functionality.  Along the way, Microsoft has improved the deployment and installation process with functions such as Windows Server Update Services (WSUS).  Despite usually minor inconveniences, Windows Updates are vital to the security of your computer, your network, and your data, and should not be ignored. How does an admin know what updates [...]

Windows Update Management Tips2019-02-22T18:12:21+00:00

VPN

2019-02-22T18:17:31+00:00

Virtual Private Networks: Should you be using one? A VPN, or Virtual Private Network, allows you to create an encrypted connection to another network over the Internet.  Most users are familiar with them for connecting back to their institution’s network for remote access.  While this is one reason to use a VPN, it’s far from the only reason to use one.  In today’s environments, eaves-dropping, public Wi-Fi, and location tracking (just to name a few) pose significant issues that often result in unwanted privacy invasions or data theft. One method of helping to prevent this is using a VPN.  In [...]

VPN2019-02-22T18:17:31+00:00

GDPR is coming… but what does it mean, and why should I care?

2019-02-22T18:21:08+00:00

GDPR is coming… but what does it mean, and why should I care? If your organization hasn’t heard these four letters by now, it may not be time to panic - but it is time to learn what they mean and if they could impact organization.  Below is a brief overview intended to get you familiar with this new international regulation and hopefully answer some of the basic questions. What is the GDPR?  General Data Protection Regulation - A new set of rules (regulations) established by the European Union (EU) to give its citizens more control over their personal data. [...]

GDPR is coming… but what does it mean, and why should I care?2019-02-22T18:21:08+00:00

50 Shades of Administration – Managing Domain Admin Privileges

2019-02-22T18:22:59+00:00

50 Shades of Administration During our work, both our auditors and engineers have noticed a common issue our clients large and small have – overly permissive administration accounts.  Many times, we see all IT users given a Domain Admin account, from the greenest helpdesk tech, to the person overseeing the network.  Microsoft’s Active Directory has a couple of different ways to grant rights to a user, group, or organizational unit, allowing the target the ability to perform certain tasks without giving them the keys to the kingdom.  Here are just a couple simple examples. In the Springfield.local domain, Lisa Simpson [...]

50 Shades of Administration – Managing Domain Admin Privileges2019-02-22T18:22:59+00:00

New Easy Password Standards? Not so Fast!

2019-02-22T18:24:48+00:00

Passwords… it's no secret; most of us are really bad at creating and maintaining passwords. In fact, 81% of hacking related breaches leveraged either stolen or weak passwords. But unfortunately, passwords won't go away any time soon. Almost every resource, application, web site, and the like requires some form of username and password. Because of this, it's no surprise that almost all of us struggle to follow recommended password standards by many security experts. At the same time, attackers and their tools are becoming more and more sophisticated, enabling them to more easily steal, decrypt and/or brute force passwords, which [...]

New Easy Password Standards? Not so Fast!2019-02-22T18:24:48+00:00

Mimikatz – How it is Used to Exploit your Network

2019-02-22T18:27:42+00:00

Bad Kitty How Mimikatz is used to exploit your network and what you can do about it. For this blog post I wanted to highlight a common attack vector that we often use in our penetration testing. My goal is to run through the process at a high level, and then cover some of the steps you can take to mitigate your risk. Specifically, this post will cover a memory scraping utility known as Mimikatz. Mimikatz has been out in the wild for roughly five years now, but its ability to obtain passwords is still relevant today. The tools effectiveness [...]

Mimikatz – How it is Used to Exploit your Network2019-02-22T18:27:42+00:00

Saying Goodbye to NetBIOS

2019-02-22T18:29:20+00:00

NetBIOS (Network Basic Input/Output System) was created in the early 1980's, but is surprisingly still alive and well on many networks today. Microsoft Windows still uses it for its name resolution function (often by default), when DNS is not available. Network resiliency and access to resources is a good thing, but keeping NetBIOS enabled for that reason, is not. There are many security concerns with NetBIOS; and disabling its support on your network and devices is strongly recommended. Disabling the use and support of NetBIOS can help to mitigate an attacker's ability to: poison and spoof responses, obtain a user's [...]

Saying Goodbye to NetBIOS2019-02-22T18:29:20+00:00