Blog

Blog

What is Vulnerability Assessment?

Behind every successful organization, within any industry, is an IT system. Everyone in the workforce, from top to bottom, utilizes this system's assets on a daily basis. Think about it. Making quick internet searches, emailing potential clients, and storing data in the cloud, to give you an example, can't be done without an IT device. However, everything comes with a price. Organizations that...
Blog

What is SOC 2?

SOC 2 is a set of compliance requirements for companies that use cloud-based storage of customer data. In this post, you’ll learn the basics of SOC 2, its difference from SOC 1 and SOC 3, how SOC 2 works, SOC’s five trust principles, and a few best practices for SOC 2 compliance.Definition of SOC 2SOC 2 (Systems and Organizations Controls 2) is both an audit procedure and criteria. It’s geared for...
Vulnerability Research

ESXi OpenSLP RCE Vulnerability

ESXi OpenSLP Remote Code Execution (RCE) Vulnerability On October 20th, VMWare disclosed the presence of an RCE vulnerability with the OpenSLP within ESXi. Exposure of the vulnerability is through TCP port 427 and yields a CVSSv3 score of 9.8. The vulnerability is referenced by CVE-2020-3992 and was provided a patch by VMWare on the same day as disclosure. Products affected are ESXi, Workstation...
Blog

Social Engineering Attacks: Common Techniques and How to Prevent Them

Most companies spend significant time and energy protecting sensitive data from hackers by investing in the latest firewalls, anti-virus software, and access control management solutions. However, all this effort is useless without considering the human factor.Social engineering is the most powerful tool in a hacker's arsenal and can help them gain access quickly, quietly, and easily into your...
Blog

7 Reasons to Schedule Your Next Penetration Test

A foundational component of any security program is ensuring that the organization has a clear understanding of where risk resides. One of the most effective ways to understand infrastructure weaknesses and test your defenses is with a penetration test (aka: ethical hacking) assessment.The growing number of malware and ransomware attacks is a key indicator of the severity of risk for organizations...
Blog

What is HIPAA Compliance?

Learn about the Health Insurance Portability and Accountability Act (HIPAA) and the requirements for HIPAA compliance in Data Protection 101, our series on the fundamentals of information security.
Blog

What is PCI Compliance?

These days, companies are continually falling prey to attacks from thieves who get past their cyber security measures and steal consumer and financial data. They target system vulnerabilities to acquire the information they seek, which is usually cardholder data.Until 2004, there were no set regulations or standards for merchants and vendors to follow for preventing cardholder theft. Major credit...
Blog

Financial Sector Cybersecurity: How Do You Compare To Your Peers?

Comparing and quantifying your cybersecurity posture against peer organizations in the financial sector provides valuable context for how your cybersecurity program performs relative to others in your industry. Digital Defense’s Insight peer comparison report in the Fortra Vulnerability Management platform vulnerability and threat management platform provides actionable and detailed intelligence...
Blog

Microsoft Domain Controller “ZeroLogon” and RCE Vulnerabilities

Microsoft Domain Controller “ZeroLogon” VulnerabilityA recent disclosure by Dutch security firm Secura B.V. has highlighted how dangerous a Netlogon vulnerability (CVE-2020-1472) included in the August 2020 Patch Tuesday release can be to a network. To exploit this vulnerability, an attacker with an established foothold in an internal network could exploit the weak cryptographic algorithm used by...