Blog

3 Reasons You Should Be Using SIEM
Blog

3 Reasons You Should Be Using SIEM

By Bob Erdman on Wed, 03/24/2021
Security Information and Event Management (SIEM) solutions have been around for years, helping to identify and escalate critical security events. SIEM solutions have become integral to many organizations’ security portfolios. In fact, according to the 2021 SIEM Report by Cybersecurity Insiders, 74 percent of respondents ranked SIEM as very to extremely important to their organization’s security...
SIEM
Blog

How to Pen Test Against Orphaned and Privileged Accounts

Mon, 03/15/2021
The more pen-tests I do, the more I see that despite how every organization claims that they’re different, I see the same commonalities with how things are being managed inside the network. One of those commonalities that I see tends to vastly improve my odds of persistence and avoiding detection: how an organization handles orphaned accounts and service accounts. Let’s talk about a little theory...
Core Impact Tiered Pricing
Blog

How The Power of Core Impact is More Accessible Than Ever Before

Mon, 03/08/2021
Security teams are increasingly turning to penetration testing tools to advance their in-house programs through strategic exploitation automation. However, it can be challenging to round out a comprehensive and integrated pen testing toolset that meets both your organization’s requirements as well as your budget. In this blog, we’ll explore how Core Impact’s tiered offering provides flexibility...
Penetration Testing
Why Privileged Access Management Matters Now More Than Ever
Blog

Why Privileged Access Management Matters Now More Than Ever

Thu, 03/04/2021
If the last year has demonstrated any lessons for IT and security teams, it’s this: managing privileged access should be a top priority for the business. When a large portion of the workforce began working remotely, there was a frenzy to extend access so individuals could perform their jobs from home. Yet this may have unintentionally caused inappropriate access levels to be extended to employees....
PAM
connectors-gears-with-arrows
Blog

Three Ways an Identity Governance Solution Should Integrate with Enterprise Data

Thu, 02/18/2021
Chances are your organization is relying on an extensive number of enterprise applications, systems, and platforms to ensure successful execution of the business. According to an article in The Wall Street Journal, large organizations rely on an average of nearly 130 applications across their business, while smaller firms use around 70 applications on average. The ability to manage user access to...
IGA
The Importance of Source Code Audits and Application Pen Tests thumb
Blog

The Importance of Static Application Testing and Application Pen Tests

Mon, 02/15/2021
Pen testing is a well-established practice for many organizations. With such diverse environments consisting of different applications from different vendors, it’s safe to assume security weaknesses are lurking somewhere. But why aren’t these security flaws found earlier, by the creators themselves? In this blog, we’ll explore why applications should also go through security testing and review...
Penetration Testing
remote-workforce-access
Blog

Remote Work Is Here to Stay: How to Deal with Access Risks Across an Expanded Workforce

Thu, 02/11/2021
While no one could have anticipated the way in which COVID-19 would change the workforce over the last year, perhaps even more unexpected is the lasting impact the pandemic will have on remote work. With millions of employees still working from home, organizations are especially vulnerable because they lack visibility into the actual access levels employees possess across the collaboration tools...
IGA
3 Ways Core Impact Can Benefit Large Security Teams
Blog

3 Ways Core Impact Can Benefit Large Security Teams

Tue, 02/02/2021
As the need for regular security assessments continues to grow, penetration testing tools are helping organizations advance their in-house programs through strategic automation. However, there is a misconception that automated tools are best for those with a reduced headcount, like small teams or individuals. Fortunately, Core Impact is designed with every team in mind, and offers capabilities...
Penetration Testing
Blog

New Approaches to the SWIFT and PCI-DSS Framework

Mon, 02/01/2021
THE WORLD OF COMPLIANCE At the official start of summertime 2016 in Britain we are starting to consume the labour of last autumn, five gallons of alcoholic homemade cider (yum!) made from eight apple varieties grown in mine and my neighbors’ gardens. I’m very VERY careful sterilizing glassware, containers, and buckets: there was this unfortunate incident three years ago (no, you don’t want to hear...
PAM
IGA
Blog

Pros and Cons for Puppet's Configuration Management & Security

Mon, 02/01/2021
THE GOOD, THE BAD AND THE UGLY I was at the Red Hat Summit in Boston at the end of June. We had a lot of activity at our exhibitor stand, and a lot of discussions being passed on to me by our sales team I continued to have the same conversation again and again over the three days. This seems to be the year people have finished bedding down Puppet in their server/VM infrastructure, and are looking...
IGA
Securing IOT Devices
Blog

6 Steps to Better Securing the Internet of Things (IoT)

Tue, 01/19/2021
These days, an organization’s technology stack isn’t merely computers and servers. The Internet of Things (IoT)—a catch all term for the many different devices that have sensors or software that connect them to the Internet—has carved out a foothold in every industry. Hospitals are filled with devices that monitor patient status, farmers are using sensors placed in the ground to obtain data about...
Penetration Testing
Phishing
gettting inside the mind of an attacker part 5
Blog

Getting Inside the Mind of an Attacker Part 5: Final Words of Advice

Mon, 01/11/2021
Authored by: Julio Sanchez In part four of this series, we examined a penetration testing engagement that the Core Security Services team performed, exploring an insider attacker engagement that showed one of the ways an attacker can escalate their privileges using Kerberos tickets. The four scenarios presented over the course of this series demonstrate the many types of attacks, both internal and...
Penetration Testing
Phishing
Blog

Ways Hackers Look to Exploit State and Local Governments

Mon, 12/28/2020
Don’t for a minute think that bad actors have no interest in the information you collect in your state or local office. Whether you work for the City Water Department or the Department of Tax and Revenue for your county, you are collecting data that is critical to not only your job – but for all of the organizations and people that work and live within your territory. Even if you aren't employed...
2021 predictions
Blog

Adapting to a Changed World: 6 Cybersecurity Predictions for 2021

Tue, 12/22/2020
As a new year looms bright with possibility in front of us, how can we prepare for a world that looks profoundly different than it did a year ago? On the cybersecurity front, we can always anticipate continuing battles with familiar foes, as well as a few new challenges on the horizon. Though we may not have a crystal ball, based on our observations and discussions, here are six predictions for...
Penetration Testing
Threat Detection
PAM
IGA
pen testing for a remote workforce
Blog

Finding Clarity in the Chaos: 5 Cybersecurity Trends of 2020

Tue, 12/22/2020
As 2020 comes to an end and we anticipate gleefully tossing our calendars in the garbage, we can all agree it was one of the most tumultuous years in recent history. It was a difficult time for almost every person and industry, and cybersecurity was certainly no exception, with shocking breaches, mass transitions to remote working, and threat actors thriving as the pandemic raged on. Though we’re...
Penetration Testing
Phishing
SIEM
Threat Detection
PAM
IGA
segregation-of-duties-in-identity-governance
Blog

Why Identity Governance Is Essential for Segregation of Duties (SoD)

Fri, 12/18/2020
It’s no secret that organizations today face a constant onslaught of identity-related access risks within the current threat landscape. One of the most critical and potentially damaging access risks that can exist under the surface of an organization is the lack of controls to ensure adequate segregation of duties (SoD). Throughout this blog, we will examine what it means to segregate duties...
IGA
cobalt strike interoperability with core impact thumb
Blog

Interoperability with Cobalt Strike and Other Notable New Features in Core Impact 20.3

Tue, 12/15/2020
The latest release of Core Impact has arrived! Version 20.3 showcases our commitment to creating a comprehensive, streamlined process for testing the defenses of any IT environment. At the forefront of this effort is the debut of exciting new interoperability capabilities with our red teaming platform, Cobalt Strike. Additionally, this latest release includes new features focused on both...
Penetration Testing
Red Team
3 Reasons You May Need to Rethink Your Virus Protection Strategy thumbnail
Blog

3 Reasons You May Need to Rethink Your Virus Protection Strategy

Tue, 12/08/2020
These days, encountering malware like viruses, ransomware, trojans, or worms has become all too common—it’s almost an inevitability. In fact, according to the 2020 Malware Report by Cybersecurity Insiders, 88% see malware as an extreme or moderate threat, and 75% believe malware and ransomware will increase in the next year. As this threat continues to loom, almost all organizations have antivirus...
Threat Detection
A day in the life of a pen tester thumbnail
Blog

A Day in the Life of a Pen Tester

Mon, 12/07/2020
When someone says “pen test,” you’re not alone if you pictured someone clicking a ball point pen top, drawing scribbles to see if any ink comes out. But if you keep listening, it actually seems like pen testers are paid to hack into computers all day long. So what do they actually do? We went behind the scenes, taking a closer look at the day in the life of a pen tester.
Penetration Testing
Phishing
What is?
Blog

What is Privileged Account Management?

Fri, 12/04/2020
Day after day, we see the evidence of an increased number of breaches. As a Privileged Account Management (PAM) provider, we are also seeing a similar increase in requests for proposals on our Core Privileged Access Manager (BoKS) solution. What is most interesting is that a large number of security professionals who contact us indicate that they are not not even sure what privileged accounts are...
PAM