Bring CI ( Continuous Integration ) to Vulnerability Management
Enough time has passed and far too many data breaches have been uncovered to warrant a fresh look at how organizations look at pro-active security efforts. Account and access management has evolved and organizations are much more vigilant to ensure multi-factor authentication is setup for customer and employee access to services and data. Data suggests […]
PCI Compliance : Make it effective and easy with ThreatWatch
Everyone in the technology industry processing credit card data is familiar with PCI DSS and the associated process to get attested on a quarterly basis from a QSA ( Qualified Security Assessor ). In addition to the quarterly attestation , organizations also have to go through audits both internal and external audits to maintain PCI […]
Do you use Apache Struts ? You need to upgrade.
Upgrade to Apache Struts version 2.3.35 or 2.5.17 ASAP ! If you use Apache Struts ( remember Equifax ? ) please upgrade to the versions mentioned above. As always NVD is lagging behind on details so dont depend on your scanning solutions to detect this in your environment just yet, CVE-2018-11776
Vulnerabilities – Are you looking at all the right places ?
The National Vulnerability Database (NVD) is considered to be the single source of truth for all software / hardware vulnerabilities that are in the public domain. However a few things get overlooked which makes it far less desirable to be relied upon when it comes to designing your vulnerability management program. Lets look at them. […]
Prevent vulnerability creep in your software
With organizations moving towards higher levels of digitalization, the role of software has increased multifold. This has led to increased numbers of data breaches and the average size [1] of data breach has increased 1.8 in 2017. A breach is defined as an event in […]
Vulnerability Alerts for Amazon Web Services
One of the previous blogs on this topic provided an overview about vulnerability management for cloud environments using ThreatWatch. As the blog mentioned , there are two essential aspects to be able to meet that objective. Getting alerted when a cloud provider makes new patches available. Adopting a risk based approach towards applying patches and […]
Vulnerability Management for Cloud Deployments
Overview: As organizations move to greater cloud adoption via traditional cloud app environments or serverless architectures for edge and IoT, they depend heavily on cloud providers to ensure the operating environment remains secure. That doesn’t always happen at a cadence that is desired and even when it does, verification remains an important aspect to ensure […]
Post Mortem of a Breach – The Panama Papers
Summary: In May of 2016 , a massive security breach resulted due to the hack of servers at Mossack Fonseca, a major law firm involving emails, pdf files, photo files and excerpts of an internal database. It was around 2.6 TB of data that spanned a period of more than 40 years. This is the […]
The Vulnerability Lifecycle
In some ways software vulnerabilites have close resemblance with a living organism. It goes through much the same stages of lifecycle from being born ( discovered ) to information getting added , exploits getting published , patches made available by vendors / reserachers and systems and services eventually getting patched and newer things getting discovered […]