HackDig : Dig high-quality web security articles for hackers

Extend Your Incident Response Program to DevOps With Security Automation

One of the biggest challenges facing security teams when it comes to incident response is complexity. The continual growth in volume and severity of cyberattacks has led to increased business process and technical complexity as different threat vectors have required security leaders to purchase point solutions with unique user interfaces, custom APIs and bus
Publish At:2020-04-15 07:54 | Read:499 | Comments:0 | Tags:Incident Response Automation Collaboration Data Breaches Dev

4 Principles That Should Define Your Evolving Security Operations Model

I recently had the opportunity to speak at a security conference where I presented the operating models that an organization can embrace when managing cyberthreats and the guiding principles associated with them. It was a great chance to share some of my experiences with the greater community and foster intellectual curiosity around an increasingly important
Publish At:2020-03-20 09:20 | Read:568 | Comments:0 | Tags:CISO Risk Management Security Services Cloud Security Cybert

A Guide to Easy and Effective Threat Modeling

Threat modeling is a process by which potential threats can be identified, enumerated and prioritized, all from a hypothetical attacker’s point of view. The purpose of threat modeling is to provide defenders with a systematic analysis of the probable attacker’s profile, the most likely attack vectors and the assets most desired by an attacker. Ef
Publish At:2020-02-27 09:41 | Read:991 | Comments:0 | Tags:Application Security Security Intelligence & Analytics Appli

NetOps vs DevOps vs DevSecOps – What’s the Difference?

One thing I have noticed is that each industry comes up with their own terms and acronyms. Unfortunately, these inventions often vary depending on the person you speak to due to a lack of a governing body that decides on an exact definition. At times, acronyms can even overlap, causing further confusion. Therefore, when it comes to definitions, I always look
Publish At:2020-02-24 01:53 | Read:612 | Comments:0 | Tags:DevOps DevSecOps NetOps

Will Weak Passwords Doom the Internet of Things (IoT)?

Weak passwords can hurt any organization’s security efforts and make any device easily hackable, but could they also be the greatest point of failure for internet of things (IoT) security? Weak passwords certainly put companies deploying IoT devices at greater risk of falling victim to a cyberattack. We have already begun to see attacks targeting IoT d
Publish At:2020-02-15 17:18 | Read:576 | Comments:0 | Tags:Endpoint Risk Management IoT Authentication Connected Device

MOSE: Using Configuration Management for Offensive and Defensive Security

Post-exploitation can be one of the most time-consuming but worthwhile tasks that an offensive security professional engages in. Fundamentally, it is where you are able to demonstrate what an adversary may do if they compromise a business. A big component of this is trying to get as far as you can without alerting the defenders to what you’re doing. The best
Publish At:2020-02-15 17:09 | Read:652 | Comments:0 | Tags:IT Security and Data Protection BsidesSF DevOps MOSE

TROOPERS20 Training Teaser: Swim with the whales – Docker, DevOps & Security in Enterprise Environments

Containerization dominates the market nowadays. Fancy buzzwords like continuous integration/deployment/delivery, microservices, containers, DevOps are floating around, but what do they mean? What benefits do they offer compared to the old dogmas? You’re gonna find out in our training! We are going to start with the basics of Docker, Containers and DevO
Publish At:2019-12-02 05:15 | Read:1341 | Comments:0 | Tags:Misc DevOps Docker K8 kubernetes TROOPERS TROOPERS20

BASTA! Autumn 2019 – Security in DevOps

Some time ago I had the pleasure to speak at the BASTA! Autumn 2019 conference. There, I promised to publish my slides such that they can be used as a reference for developers and security guys like me. And with this blog post I would like to hold up to my promise. Overall, the talk was about the challenges of “How to bring security into modern DevOps proce
Publish At:2019-11-30 12:15 | Read:927 | Comments:0 | Tags:Building Events BASTA DevOps

"Continuous Opportunity - DevOps and Security"

 Thank you to everyone at the Minnesota ISSA chapter for the opportunity to share some background on DevOps and some ideas about how security teams can benefit by adopting DevOps practices & tools. The presentation slides are available here:Continuous Opportunity- DevOps and Securi
Publish At:2019-10-18 04:00 | Read:852 | Comments:0 | Tags:DevOps

"Exploring the DevSecOps Toolchain"

 The authors of the SANS Institute's DEV540 Secure DevOps & Cloud Application Security course created the Secure DevOps Toolchain poster to help security teams create a methodology for integrating security into the DevOps workflow. As you can see, the poster breaks DevOps down into
Publish At:2019-10-18 04:00 | Read:1164 | Comments:0 | Tags:DevOps SecDevOps Secure SDLC

CVE-2019-16928: Exploiting an Exim Vulnerability via EHLO Strings

by Ashish Verma In September, security researchers from the QAX-A-Team discovered the existence of CVE-2019-16928, a vulnerability involving the mail transfer agent Exim. Exim accounts for over 50% of publicly reachable mail servers on the internet. What makes the bug particularly noteworthy is that threat actors could exploit it to perform denial of service
Publish At:2019-10-10 10:00 | Read:1206 | Comments:0 | Tags:Vulnerabilities DevOps Vulnerability exploit

Use Infrastructure as Code they said. Easier to audit they said… (part 1)

Whilst there are some great examples of how to assess infrastructure as code dynamically with things like the Center for Internet Security‘s Docker benchmark and CoreOS‘s Clair, these kinda run a little too late in the pipeline for my liking. If we want to treat infrastructure as code then surely we ought to be performing code reviews and if we&#
Publish At:2019-09-19 17:35 | Read:1091 | Comments:0 | Tags:Blog auditing devops devsecops infradev orchestration seceng

Security Engineering – A manifesto for defensive security

Presentation on the need to re-examine how we engineer systems (taking service providers as an example) and the implications on how we quantify cyber risk if we want to take this message into the board room (as given at BT’s SnoopCon 2019 and Cisco’s June 2019 Knowledge Network webinar for service providers). Having delivered security consultancy
Publish At:2019-09-19 17:35 | Read:1093 | Comments:0 | Tags:Presentations C-Suite conference CRQ cyber risk quantificati

The Myth of Mutual Exclusivity: Making the DevOps Process More Agile Without Compromising Security

The marketplace is demanding agility, but many enterprises perceive the need for agility as an ongoing security risk. If applications are constantly evolving, they assume, the process will constantly open up new avenues for attackers to exploit. This worry has given rise to a widespread misconception that security or agility is a binary choice. But a growing
Publish At:2017-09-21 19:15 | Read:5453 | Comments:0 | Tags:Application Security CISO Agile DevOps SecDevOps Security Pr

Best Practices for Developing and Securing a Microservices Architecture

Co-authored by Chris Craig. To match the ongoing shift to cloud as a means of increasing agility when delivering services, the architectures supporting these services are also evolving. The cloud IT space is full of terminology such as infrastructure-as-code, highly scalable architectures and microservices architecture — a methodology that is gathering sig
Publish At:2017-08-15 11:45 | Read:3936 | Comments:0 | Tags:Cloud Security Cloud Cloud Adoption Cloud Computing Cloud Se

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud