Security Information and Event Management (SIEM) solutions are known for their ability to provide visibility into IT environments by monitoring data sources for unusual activity and contextualizing them for security insights.

As organizations have made the transformational shift to a remote and hybrid workforce, IT and security teams are feeling increased pressure to better manage access to sensitive data and systems. The rise of a remote and expanded workforce has put additional strain on organizations and increased the potential for identity-related access risks.

Did you know the first instance of ransomware was in 1989? Though we’ve moved on from floppy disks containing malware and cashier’s checks used to pay attackers, we are far from moving past ransomware. Instead, ransomware has become more streamlined, and is one of the most popular tools of both amateur and expert threat actors. Just about anyone can purchase a ransomware strain off the dark web or can have the work done for them with ransomware-as-a-service (RAAS).

Vulnerabilities can be found in just about any type of software—and even some pieces of hardware. Threat actors are all too eager to take advantage of these vulnerabilities, leveraging them to gain access to or escalate privileges in an organization’s IT infrastructure. When these vulnerabilities are discovered before the vendor is aware, these are known as zero-day threats.

The PrintNightmare flaw is aptly named—the serious remote code execution vulnerability in the Microsoft Windows Print Spooler service, CVE-2021-34527, can give an attacker the keys to the kingdom. The Print Spooler service does not restrict access to the RpcAddPrinterDriverEx function, allowing a remote authenticated account with low privileges to gain access from a single shared computer.

It’s no secret that keeping track of who has access to what in your organization has grown more complicated during the last year. Companies today are especially vulnerable because they often lack full visibility into the actual access levels employees possess and may not have the full picture of devices across their network infrastructure. Managing devices and user access is made even more challenging with millions of employees still working from home, leveraging devices, systems, applications, and collaboration tools that make remote work possible.

In the first Inside the Mind of an Attacker series, we walked through scenarios of potential attacks on Active Directory, as well as techniques on how to identify and avoid breaches. In this series, we’ll transition to what happens after a successful compromise of Active Directory, in which an attacker attempts to gain persistence after the initial breach.

The latest release of Core Impact has arrived! Version 21.1 demonstrates our commitment to allowing users to conduct advanced penetration tests effortlessly and efficiently. This release includes new features focused on increased visibility and ease of use, along with a simplified update process.

As data breaches continue to dominate the headlines, suggestions for enhancing your cybersecurity stance are everywhere. While much of this advice may be worth following, it’s often complicated, entailing multi-step processes or requiring expert intervention. However, before you start exploring advanced options, it’s important to begin with the basics. When it comes to cybersecurity, the simplest advice is to always implement patches.

Relying on outdated methods to manage user access is both a constant struggle and a persistent risk to your business. Manually keeping track of users and entitlements is costly, time-consuming, and daunting. But with a modern role-based approach, you can embrace a smarter, simpler, more secure way to manage user access.

Penetration testing has become an increasingly standard exercise, with organizations using either pen testing services or in-house teams to uncover weaknesses and assess their security posture.

Security Information and Event Management (SIEM) solutions have been around for years, helping to identify and escalate critical security events. SIEM solutions have become integral to many organizations’ security portfolios. In fact, according to the 2021 SIEM Report by Cybersecurity Insiders, 74 percent of respondents ranked SIEM as very to extremely important to their organization’s security posture.

Security teams are increasingly turning to penetration testing tools to advance their in-house programs through strategic exploitation automation. However, it can be challenging to round out a comprehensive and integrated pen testing toolset that meets both your organization’s requirements as well as your budget.

If the last year has demonstrated any lessons for IT and security teams, it’s this: managing privileged access should be a top priority for the business. When a large portion of the workforce began working remotely, there was a frenzy to extend access so individuals could perform their jobs from home. Yet this may have unintentionally caused inappropriate access levels to be extended to employees. This becomes especially problematic if those access levels are elevated or privileged within the business.

Chances are your organization is relying on an extensive number of enterprise applications, systems, and platforms to ensure successful execution of the business. According to an article in The Wall Street Journal, large organizations rely on an average of nearly 130 applications across their business, while smaller firms use around 70 applications on average.

Pen testing is a well-established practice for many organizations. With such diverse environments consisting of different applications from different vendors, it’s safe to assume security weaknesses are lurking somewhere. But why aren’t these security flaws found earlier, by the creators themselves? In this blog, we’ll explore why applications should also go through security testing and review during the development stage.

While no one could have anticipated the way in which COVID-19 would change the workforce over the last year, perhaps even more unexpected is the lasting impact the pandemic will have on remote work. With millions of employees still working from home, organizations are especially vulnerable because they lack visibility into the actual access levels employees possess across the collaboration tools and applications that make remote work possible.

As the need for regular security assessments continues to grow, penetration testing tools are helping organizations advance their in-house programs through strategic automation. However, there is a misconception that automated tools are best for those with a reduced headcount, like small teams or individuals.

These days, an organization’s technology stack isn’t merely computers and servers. The Internet of Things (IoT)—a catch all term for the many different devices that have sensors or software that connect them to the Internet—has carved out a foothold in every industry. Hospitals are filled with devices that monitor patient status, farmers are using sensors placed in the ground to obtain data about soil, and utility plants rely on SCADA systems to keep things running.

Authored by: Julio Sanchez

As a new year looms bright with possibility in front of us, how can we prepare for a world that looks profoundly different than it did a year ago? On the cybersecurity front, we can always anticipate continuing battles with familiar foes, as well as a few new challenges on the horizon. Though we may not have a crystal ball, based on our observations and discussions, here are six predictions for the upcoming year.

As 2020 comes to an end and we anticipate gleefully tossing our calendars in the garbage, we can all agree it was one of the most tumultuous years in recent history. It was a difficult time for almost every person and industry, and cybersecurity was certainly no exception, with shocking breaches, mass transitions to remote working, and threat actors thriving as the pandemic raged on. Though we’re as eager as everyone else to look forward, let’s look back at 2020 one more time to identify trends that may help you plan for a better 2021.

It’s no secret that organizations today face a constant onslaught of identity-related access risks within the current threat landscape. One of the most critical and potentially damaging access risks that can exist under the surface of an organization is the lack of controls to ensure adequate segregation of duties (SoD).

The latest release of Core Impact has arrived! Version 20.3 showcases our commitment to creating a comprehensive, streamlined process for testing the defenses of any IT environment. At the forefront of this effort is the debut of exciting new interoperability capabilities with our red teaming platform, Cobalt Strike.

These days, encountering malware like viruses, ransomware, trojans, or worms has become all too common—it’s almost an inevitability. In fact, according to the 2020 Malware Report by Cybersecurity Insiders, 88% see malware as an extreme or moderate threat, and 75% believe malware and ransomware will increase in the next year.