HackDig : Dig high-quality web security articles for hacker

[SANS ISC] My Little DoH Setup

I published the following diary on isc.sans.edu: “My Little DoH Setup“: “DoH”, this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in  HTTPS but it’s not the goal of this di
Publish At:2019-11-25 09:25 | Read:211 | Comments:0 | Tags:SANS Internet Storm Center Security DNS DoH PiHole SANS

Securing the Modern Endpoint the SANS Maturity Way

In Case You Missed It Bromium recently engaged in a series of communications and events on the topic of Securing the Modern Endpoint, covering timely and provocative concepts including: How detection consistently fails to secure the enterprise and why new thinking is desperately needed How to realign your defenses around a modern threat risk model using few
Publish At:2017-10-30 17:15 | Read:4104 | Comments:0 | Tags:Threats case study data sheet defenses detection endpoint mo

SANS Maturity Model Webinar Describes How to Grow Your Security Strategy

Setting your security strategy is a challenging task that comes with lot of opinions (and vendors!). SANS provides a rationale for growing protection that is logically calibrated to growth and expanding needs. Register for this webinar and even if you can’t make it, we’ll send you the recording (and a whitepaper). With so many security solution
Publish At:2017-10-21 16:25 | Read:4471 | Comments:0 | Tags:Innovation maturity model recording registration SANS Securi

A Cybersecurity Proof: The Application is the Endpoint

Vulnerable applications and browsers are the persistent data breach entry points—it’s not about the files Isolation is the only solution that can absolutely eliminate kernel-level exploits and malware escapes It’s time to rethink information security defense around fewer, smarter, yet more effective layers You have many more endpoints than you think. How m
Publish At:2017-10-21 16:25 | Read:3329 | Comments:0 | Tags:Threats access points application attack vector endpoint End

Hacker Mindset: SANS NetWars & Tools of the Trade

In my ongoing blog series “Hacker Mindset,” I’ll explore an attacker’s assumptions, methods and theory, including how information security professionals can apply this knowledge to increase cyber-vigilance on the systems and networks they steward.In this article, I share my thoughts on NetWars – a live interactive Capture the Flag training exercise at
Publish At:2016-07-27 16:35 | Read:3592 | Comments:0 | Tags:Events Featured Articles NetWars SANS security training

The Top 10 Information Security Conferences of 2016

In Part II of our 2015 Infosec Wishlist series, a number of security experts expressed their desire for the security community to renew its focus on collaboration, communication and unity in the New Year. To accomplish this goal, folks in information security will need to internalize this message and inject it into their dealings with one another. But how c
Publish At:2016-01-06 02:10 | Read:9213 | Comments:0 | Tags:Off Topic AppSec Europe black hat bsides Conferences DEF CON

Have You Crossed the Chasm with Your Endpoint Protection Strategy?

In the good old days of security endpoints, we used only desktops and deployed anti-virus solutions to protect them. But things have changed in the past couple of years.Today, the definition of endpoints has exploded thanks to the Internet of Things, a phenomenon marked by smart cars, smart appliances, and of course, mobile devices. In this new world of ubiq
Publish At:2015-09-25 15:15 | Read:3599 | Comments:0 | Tags:Featured Articles IT Security and Data Protection breach Dwa

Spam Campaign Continuing to Serve Up Malicious .js Files

A malicious spam campaign that’s been doling out zipped Javascript (.js) files remains an issue, the SANS Internet Storm Center warns.The campaign was spotted earlier this year, but Brad Duncan, a handler for the site and researcher with Rackspace’s information security operations center, claims he’s received a handful of notifications from
Publish At:2015-09-16 21:15 | Read:2396 | Comments:0 | Tags:Malware malicious .js files PhishMe SANS Spam spam campaign

Exploiting the Social Media Security Conundrum

It is 2015, and social media is everywhere. It is embedded in your smartphone, and its logos are printed on nearly every product packaging.A few years ago, having an online presence by way of a website for a company was enough. Today, consumers expect a company to have a presence on the App Store, Play Store, and every social media platform out there.It has
Publish At:2015-08-27 07:35 | Read:3369 | Comments:0 | Tags:Connecting Security to the Business Featured Articles CIA Pe

Bartalex Variants Spotted Dropping Pony, Dyre Malware

Some strains of Bartalex malware, a macro-based malware that first surfaced earlier this year, have recently been spotted dropping Pony loader malware and the Dyre banking Trojan.Primarily spread through spam, the first iterations of Bartalex were observed in late March embedded in Microsoft Word and Excel macros.Macros have been a popular infection method f
Publish At:2015-07-23 06:20 | Read:3468 | Comments:0 | Tags:Malware Microsoft Web Security Bartalex Dyre Malware malware

Industrial Control System (In)Security: Nearly Half of Attacks Go Unattributed

The rise in attacks against the nation’s critical infrastructure control systems – and the potentially devastating consequences these incidents could incur – have resulted in a growing concern among industry leaders and organizations.With many industrial control systems still relying on outdated software and protocols, bolstering the protection of these syst
Publish At:2015-06-25 04:50 | Read:2960 | Comments:0 | Tags:Latest Security News Critical Infrastructure ics Industrial

Playing with IP Reputation with Dshield & OSSEC

[This blogpost has also been published as a guest diary on isc.sans.org] When investigating incidents or searching for malicious activity in your logs, IP reputation is a nice way to increase the reliability of generated alerts. It can help to prioritize incidents. Let’s take an example with a WordPress blog. It will, sooner or later, be targeted by a
Publish At:2015-06-09 21:00 | Read:4613 | Comments:0 | Tags:Logs Management / SIEM OSSEC Security API IP address Reputat

Tales from the Datacenter: Vulnerability Management Nightmares

Posted May 27, 2015   Dave ShacklefordVulnerability management is a discipline that encompasses many varied activities in the realms of information security and IT operations. Vulnerability scanning, threat management, risk analysis, patching, and configuration management are some of the major activities usually associated with vulnerability m
Publish At:2015-05-28 03:45 | Read:2711 | Comments:0 | Tags:Vulnerability Management david shackleford SANS vulnerabilit

SANS SEC575 Mentor class

Hi everyone,Great news! I will be mentoring SANS 575: Mobile Device Security and Ethical Hacking in Luxembourg on Thursday evenings 18:00-20:00, starting from January 15, 2015.Mentor classes are special, 10 week-format SANS classroom sessions that give the students time to absorb and master the same material with the guidance of a trained security professio
Publish At:2014-09-29 20:20 | Read:2644 | Comments:0 | Tags:Android iOS Luxembourg mentor mobile SANS SEC575

SNMP DDoS Scans Spoof Google Public DNS Server

Update: The SANS Internet Storm Center this afternoon reported SNMP scans spoofed from Google’s public recursive DNS server seeking to overwhelm vulnerable routers and other devices that support the protocol with DDoS traffic.“The traffic is spoofed, and claims to come from Google’s DNS server. The attack is however not an attack against Google. It is likely
Publish At:2014-09-16 09:00 | Read:3188 | Comments:0 | Tags:Vulnerabilities Web Security DDoS Johannes Ullrich SANS SNMP


Share high-quality web security related articles with you:)


Tag Cloud