Web App Security

Bd07d58f0d31d48d3764821d109bf165

Heartbleed Should Give You Cardiac Arrest

April 09, 2014 Added by:Tripwire Inc

Estimates are over 66% of active websites on the internet may be vulnerable to this bug, found in OpenSSL, an open source cryptographic library used in the Apache web server and ignx when creating communications with users.

Comments  (0)

7ddc1f3000a13e4dfec28074e9e7b658

Websites Must Use HSTS in Order to Be Secure

April 07, 2014 Added by:Electronic Frontier Foundation

So why haven't more websites enabled HSTS? The biggest reason, we fear, is that web developers just don't know about it.

Comments  (0)

Fafdf1720f4df1d41c6eacbd2429a06b

Remote Desktop’s Restricted Admin: Is the Cure Worse Than the Disease?

April 01, 2014 Added by:Tal Be'ery

One of the new security features in the latest Windows release (Windows 8.1) is the “Restricted Admin mode for Remote Desktop Connection”. This measure is meant to enhance Windows credential protection against attacks such as Pass-the-Hash and Pass-the-Ticket. However, it appears that cure might be worse than the disease as the new “Restricted Admin mode” opens a new attack surface for the...

Comments  (0)

76e662e7786bf88946bd6c010c03ac65

We Have to Find Ways to Reinforce Trust

March 29, 2014 Added by:Jarno Limnéll

We are losing the battle for cyberspace. Not because malicious actors are taking over the digital world, but because we are forgetting what is the element that makes us feel safe and secure in any world: the ability to trust.

Comments  (0)

37c1b0270687e8148e56508e805f8b8e

The Windows XP Rundown is Really About Security

March 18, 2014 Added by:Praveen Manohar

Now is an appropriate time to discuss the implications of the end of XP support and explore what the rundown is really all about: security.

Comments  (0)

65c1700fde3e9a94cc060a7e3777287c

Zero Trust and the Age of Global Connectivity

February 27, 2014 Added by:Simon Moffatt

The internal 'trusted' network no longer exists. Employees often pose the biggest threat to information assets, even though they are trusted with legitimate accounts on protected internal machines. Zero Trust is a recent security approach that looks to move away from network segmentation and focus more on data and resources and who can access them, when and from where.

Comments  (0)

306708aaf995cf6a77d3083885b60907

Apple Fixes iOS SSL Validation Flaw That Enables Man-in-the-Middle Attacks

February 21, 2014 Added by:Mike Lennon

Apple has released iOS 7.0.6 which patches a flaw in iOS that enables a man-in-the-middle attack of encrypted (SSL) connections

Comments  (1)

B64e021126c832bb29ec9fa988155eaf

Getting a Remote Shell on an Android Device using Metasploit

February 19, 2014 Added by:Dan Dieterle

In this post we will show you how to get a remote shell on an Android by using Metasploit in Kali Linux.

Comments  (0)

9fb165a9b7dfef2a9f8ac7d69b22a42c

Vertical Password Guessing Attacks Part II

February 19, 2014 Added by:Vince Kornacki

Attackers utilize a variety of tools to automate password guessing attacks, including Hydra, Nmap in conjunction with the http-form-brute script, and homegrown scripts. In this post, Vince explains how to conduct Vertical Password Guessing Attacks.

Comments  (0)

39eb20ce0f68b66e0bd72c5d1e2954fe

Vulnerabilty Remediation Tips

January 29, 2014 Added by:Krishna Raja

Discovering vulnerabilities is often the main objective of security teams within large organizations. This is achieved through initiatives such as penetration testing and source code review. But as we know, this is only the first step towards a secure organization.

Comments  (2)

022aafe7eef823af1fa3931a5539ae49

How SAMM Addresses Outsourced Development

January 28, 2014 Added by:Nima Dezhkam

Despite SAMM’s comprehensive guidelines around establishing an organization-wide security program and integrating security into in-house software development life-cycle, it does not elaborate as much on third-party vendor security and outsourced software development.

Comments  (0)

9fb165a9b7dfef2a9f8ac7d69b22a42c

Horizontal Password Guessing Attacks Part II

January 20, 2014 Added by:Vince Kornacki

In our last installment we started planning our horizontal password guessing attack by identifying the ten most common passwords. But what about usernames?

Comments  (1)

9fb165a9b7dfef2a9f8ac7d69b22a42c

Horizontal Password Guessing Attacks Part I

January 20, 2014 Added by:Vince Kornacki

Let's step into the shoes of a malicious attacker and brainstorm a horizontal password guessing attack. Grab your Cheetos and Mountain Dew and let's get this party started.

Comments  (0)

6d117b57d55f63febe392e40a478011f

Office 365 Vulnerability Allowed Unauthorized Administrator Access

January 19, 2014 Added by:Anthony M. Freed

Security researcher Alan Byrne has disclosed a Cross Site Scripting (XSS) vulnerability in Microsoft Office 365 that would allow an attacker to obtain administrator privileges and access to the Email and SharePoint content across the network, as well as the ability to make configuration changes.

Comments  (0)

219bfe49c4e7e1a3760f307bfecb9954

The NIST Cyber Security Framework Completely Misses the Mark

January 06, 2014 Added by:Rohit Sethi

The NIST Cyber Security Framework completely lacks any mention of application security. We predict that organizations will likewise adopt the framework with scant attention paid to secure software, which will lull them into a false sense of security.

Comments  (0)

31b3b31a1c2f8a370206f111127c0dbd

Are You Playing Security ‘Elf on the Shelf’?

December 23, 2013 Added by:Steve Lowing

While your end users may act like children from time to time, your security practices shouldn’t treat them like they are. Gain visibility and control before being placed on the naughty list.

Comments  (0)

Page « < 1 - 2 - 3 - 4 - 5 > »