Web applications are exposed. Unlike internal network applications, everyone can get to a web application; all they need is an internet connection. That includes hackers too. In fact, an automated tool may be attacking the web applications you depend on as you read this article.But developers often overlook web application security. Teams frequently spend all their energy on the code, the visual...

Last updated on April 24, 2020.Web security, your site and your networkWeb sites are unfortunately prone to security risks. And so are any networks in which web servers are connected. Setting aside risks created by employee use or misuse of network resources, your web server and the site it hosts present your most serious sources of security risk.Web servers by design open a window between your...

REST APIs have allowed us to create modern web and mobile applications; By using the power of an API, we can open up the world of services – pulling in data and sharing information and oiling the wheels of the internet.But building an API-enabled service also means that you potentially open up your web or mobile application to cybercriminals.In the first nine months of 2019, 7.9 billion data...

This article was originally published on HelpNetSecurity on April 16, 2020.Finding security holes in information systems is as old as the first commercially available computer. Back when a “computer” was something that sat in a computer room, users would try to bypass restrictions, sometimes simply by trying to guess the administrator’s password.Later when Bulletin Board Systems (the primitive...

This article was originally published on Enterprise Management 360 on March 31, 2020.Penetration testing is the Marmite of cybersecurity: you either love it or you hate it. Taking a neutral stance on the matter, it’s easy to see both sides. On one hand, pen testing provides indisputable evidence of vulnerabilities for organisations to action. Pen testers are also often able to identify even the...

Across the world, companies like Google, Microsoft, Amazon, Twitter, and yes, Fortra, have asked their employees to work from home in response to the Coronavirus (Covid-19) pandemic. As employees move from on-premises offices to their homes, businesses will be faced with the challenge of managing and securing both company-owned and employee-owned devices as they access company resources from...

Accepting credit card payments is an everyday task all small business owners and merchants must perform when conducting transactions. However, if you handle consumers’ credit card information, there are inherent data security risks to manage and mitigate.Security holes in your payment processing system can result in stolen client information or identity theft, and you’ll have to pay your bank a...

It seems many cybercriminals have begun to set their sights on Managed Service Providers (MSPs). In fact, 80% of MSPs say their organization has been targeted by ransomware.Not unlike the rest of us, cyber attackers want to work smarter, not harder. If they are able to successfully infiltrate one MSP’s network, they can potentially gain access to all of their clients’ systems as well. The more...

The tester’s aim when performing a website or system test is to ensure that the product being tested is protected as much as possible. Application security testing is typically performed to secure these networks and systems. To perform this type of test, it is necessary to consider which attacks are most likely to occur. One of the most common types of attacks is SQL injection (SQLi). These are...

On one level, cybersecurity is all about electronics – securing machines, networks and so forth. But, even the most technologically advanced cyber attacks are driven by human motivation.Humans motivate cyberattacks, and humans also, often unknowingly, facilitate cyberattacks. People are essential to mounting a defence as well – as much as automated tools are a powerful barrier.It’s no surprise,...

At the ripe old age of 30, ransomware could be considered antique in the malware world. This particular type of malicious software has been around since 1989, when the first version was created by the “Father of Ransomware”, Joseph L. Popp. Disseminated via mailed floppy disks, the program demanded a hefty ransom of $189 to free victims’ data.A lot has changed since then and ransomware has matured...

Cybersecurity threats are growing in size and prevalence – and the nature of cybersecurity is continuously shifting. In particular, operational technology (OT) such as industrial control systems – e.g. SCADA – are newly at risk. In this article we discuss why OT is so vulnerable, what vulnerabilities you should watch out for and what your company can do to protect against OT threats.Why...

We live in an online world in which more and more people rely on services provided over the internet. Being able to access so much through a smartphone has certainly ushered in a great deal of convenience. No more trips to the bank to deposit paychecks and no more weekends stuck behind a shopping cart—today, with a few clicks, we can transfer money and order much-needed supplies online from Amazon...

As of January 14, 2020, Microsoft will discontinue Windows 7 support as planned for the operating systems’ End of Life (EOL). To some organizations, this operating system (OS) might seem like a distant memory. However, nearly 30% of the world’s computers – or more than 400 million - still run Windows 7 and are only now contemplating migration to Windows 10. Millions of users will be depending on...

This past year was a big year for data breaches, new privacy laws and cracking down on existing regulations. British Airways faces a £183m fine after hackers stole credit card details from nearly 400,000 customers. Many other big names were hit too. Facebook. Equifax. Twitter. Marriott. Google. They’ve all been hacked. The reason? Sometimes it was due to outdated security systems and other times...

Testing for behavior vs versionThe primary requirement for a Vulnerability Assessment solution is accurate testing. Ease of use and clear reports are important, but if accuracy isn’t there then little else matters. Poor accuracy in Vulnerability Assessment produces two kinds of testing error. Overlooking a vulnerability (a false negative) leaves a security flaw you don’t know about. Reporting a...

Why Vulnerability Management got a bad rapThe number of servers, desktops, laptops, phones and personal devices accessing network data is constantly growing. The number of applications in use grows nearly exponentially. And as known vulnerabilities grew in number, IT managers found that traditional vulnerability management tools could easily find more problems than could be fixed with their...