Slack Desktop Application Remote Code Execution (RCE) Vulnerability A RCE flaw was disclosed on August 31st, 2020, which affects the users of the Windows, Mac OS, and Linux desktop application versions of Slack. Users that click on an HTML injected image, will be redirected to an attacker’s server where a malicious javascript payload will be executed within the Slack application on their local...

Policy alone is rarely enough to influence change. Lasting impact requires buy-in from the organization and is best achieved using a mix of different influence levers.

While pen testing has been around since the 1960s, not all organizations have yet perfected the art of conducting them. In fact, not all companies are taking advantage of them, but that’s a conversation for another time.Below are a few common pitfalls that even experienced security teams fall victim to from time to time.Wrong FrequencyPenetration tests evaluate your security posture at the moment...

This article was originally published on Techaeris on August 07, 2020.For centuries, the automotive industry has benefited from the rapid development of technology. From the introduction of Ford’s Model A back in 1903 till in recent times, when cars are being equipped with assistive sensors helping the driver park safely, with the evolution of multimedia systems, or the computerized engine systems...

With the increased normalization of remote work, many organizations are dealing with an attack surface that has expanded beyond traditional network bounds. A new imperative exists for IT and security teams to adopt broader work-from-home security practices. This includes updating vulnerability scanning and management strategies to monitor both remote endpoints and network assets effectively. A...

CISM (Certified Information Security Manager) is an advanced certification designed for IT professionals who focus on information security management. Here, we’ll discuss what CISM is, the CISM certification process, and the benefits of being CISM-certified.

In the early days of the internet, cybersecurity was fairly straightforward, with all solutions and strategies geared toward prevention. While prevention remains critical, cybersecurity has also had to evolve, with businesses layering their defenses and regularly evaluating the status of their safeguards to adapt to change—whether those be organizational or within the wider cybersecurity sphere.

Developing software today requires a keen sensitivity to creating secure code. Even NIST admits that "Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure the software being developed is well secured."This is why NIST developed the secure software development...

“BootHole” GRUB2 Bootloader Secure Boot BypassAs of July 29th, a buffer overflow vulnerability has been disclosed in the way that GRUB2 parses its configuration file, grub.cfg that can lead to full control over an affected system before OS boot. This bypass vulnerability has been assigned CVE-2020-10713. GRUB2 is utilized on almost all modern Linux systems, Windows systems since 2012 that...

Now more than ever, businesses are adapting to long-term remote work policies. This causes staff to greatly rely on personal devices to access corporate networks, which often contain sensitive data. But being away from the office, and the in-house security infrastructure presents new opportunities for malicious actors to breach your network.Furthermore, newer technologies, such as the IoT, present...

While fuzzing may sound like just another buzzword in the cybersec landscape, it has continued to gain popularity over the last several years and shows no signs of going away. Development teams know that unless their developers all just came down from Mount Olympus, there are likely to be security holes in their applications - and they need tools that can be used by anyone to simulate real attacks...