article thumbnail

Businesses Secretly Pentest Partners as Supply Chain Fears Grow

eSecurity Planet

Howard Taylor, CISO of Radware, goes so far as to call it the “death of trust.” As a result, some are now taking extra precautions such as hiring specialized companies to conduct penetration testing audits on externally facing partner resources. And they may not even be aware that they have them.

Insurance 116
article thumbnail

What is the CISO Experience in a Red Team Exercise?

NetSpi Executives

You’re about to have your first Red Team experience, or maybe your first one in the CISO seat of your organization. Threat groups tend to cluster around a smaller set of TTPs than our Red Team because they apply them at Internet scale across many organizations. How Often Should I Plan for Red Team Testing?

CISO 119
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

NetSPI [Un]Wrapped: Our Top Hits from 2023 

NetSpi Executives

In this article, we explain how the shift to proactive security is rooted in always-on monitoring of known and unknown internet-facing assets. While conducting an Entra Penetration Test, we discovered a simple misconfiguration in Entra ID that allowed us to bypass MFA.

article thumbnail

GUEST ESSAY: Recalibrating critical infrastructure security in the wake of evolving threats

The Last Watchdog

Unitronics systems are exposed to the Internet and a single intrusion caused a ripple effect felt across organizations in multiple states. Eventually, more organizations may want to consider appointing their CISOs to head all of IT. Unitronics software is used by critical infrastructure (CI) organizations throughout the U.S.

article thumbnail

Attack Surface Management for the Adoption of SaaS

CyberSecurity Insiders

Earlier this year, I had the opportunity to speak before a group of CISOs about the topic of attack surface management (ASM). DNS subdomain scanning is a useful tactic to discover internet-exposed SaaS application portals and their APIs. By Alfredo Hickman, head of information security, Obsidian Security. It does not make sense.

article thumbnail

Vulnerability Management Policy Template

eSecurity Planet

Testing must be performed to verify that resources have been installed, configured, integrated, and secured without error or gap in security. Active Vulnerability Detection Vulnerability scans and penetration testing will be performed [quarterly] and after significant changes to resources to test for unknown vulnerabilities.

article thumbnail

ROUNDTABLE: Why T-Mobile’s latest huge data breach could fuel attacks directed at mobile devices

The Last Watchdog

According to the attackers, this was a configuration issue on an access point T-Mobile used for testing. The configuration issue made this access point publicly available on the Internet. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

Mobile 306