Eoin & The Security

I recently was interviewed by the Irish times on why is everything getting hacked and how can we change the game.... https://www.irishtimes.com/special-reports/cybersecurity-focus/criminals-have-an-inbuilt-advantage-in-the-great-cyber-arms-race-1.4651078  A recording of the Panel with Andy Purdy, CSO of Huawei North America. https://www.youtube.com/watch?v=cQJ1uSQ4IEk&t=33s Both are decent and worth a listen.

  Attack Surface Management (ASM), a new sexy approach to cyber security visibility.  "How about we try to see what systems are exposed to the public Internet  so we can make sure they are being secured." ASM is not Vulnerability management (detection of cyber security weaknesses) but rather takes a step back to answer the question, "What do I need to secure?" but is can also help identify the SBoM (Software Bill of Materials) across deployed systems. Attack Surface Management (ASM) which provides you the ability to see all services exposed to the public internet across your global estate. As new systems are deployed, decommissioned or a system changes, ASM can inform you of the event.  This is done in real-time and on a continuous basis in most cases. I wrote a bog in 2018   when we first introduced Edgescan's ASM solution which has evolved since by including both API discovery and multi-region monitoring. API discovery  locates exposed API endpo...

  The cyber security industry is full of solutions to make you more secure. Some are unproven and other approaches work if deployed properly. Our industry is very fragmented. for example a recent "Cyber Defense" award I noticed has 195 categories!  I suppose we need to ask ourselves as companies from time to time why we do what we do?  So, the following post is, I guess, the reason we developed Edgescan and why we believe its a decent solution to help organizations improve and be more resilient in relation to cyber security and system protection.... Vulnerability scanning alone did not work. The idea of software testing software for vulnerabilities is a good one but both sides of the equation may have bugs. Bugs in one side (The target) may result in vulnerabilities, whilst bugs on the other side (Scanner) may result in false negatives and false positives.  Accuracy : To that end we built edgescan as a combination of automation to discover vulnerabilities at scale bu...

BBQ Cyber Security Thoughts...... During lockdown, I've taken to standing over the BBQ staring at the temperature gauge, lifting the lid occasionally and slow cooking various meats. Given the lockdown situation this provided a focal point for the day; something to attend to for the afternoon.  When standing there in a mindful stasis things go through your head, these are some of mine... "Software testing Software, who thought that would work?" "Using systems with potential vulnerabilities to discover potential vulnerabilities in systems" "Shift Left would make more sense if development was linear" "The reliance on automation to defend against a human adversary, sounds fair.....💀" "We cant improve what we cant measure; We cant secure what we cant see." "We accept false positives in scanners (Software getting it wrong) but we don't accept vulnerabilities (Software getting it wrong)." - Software testing software. "T...

  Web Application Scanning...Evolution For the past 24 months Edgescan has been developing a new Web Scanning engine, namely " Weasel ". Its a core component to the edgescan SaaS web security aspect of the service. We built it for many reasons: Faster Assessment speed. Increased coverage. Better Accuracy. More user control and configuration. Improved API support and navigation. More metrics. Javascript/Single-Page-Application (SPA) improvement. Improved content discovery. Dynamic Learning A cool thing about weasel is it has a dedicated team that not only consists of developers but also analysts and researchers. This was exciting as some of our penetration testers trained and pushed the engine and our developers implement ongoing changes. Developing a web scanning engine is certainly a treadmill and a never-ending process. Change is good, and to change often is to live well. Dynamic Learning - Once aspect that is exciting for us is the idea of continuously integrated test ca...

For the third year running Edgescan contributed to the Verizon DBiR . The DBiR is recognized as the defacto cyber report which casts a wide net across all types of cyber security and breaches, this includes vulnerability management in both infrastructure and applications. Edgescan vulnerability data is curated and validated, sanitized and reflects tens of thousands of assessments we deliver globally across the full stack to our clients. As stated by Gabriel Basset of Verizon " I think there’s a positive story around how vulnerability scanning, patching, and filtering are preventing exploiting vulns from being the easiest way to cause a breach but that asset management is needed to identify and patch unpatched systems... " A few things that stand out to me in the report are as follows: Nearly half of breaches involved Hacking and 70% of breaches were external threat actors. To me this makes sense as in our experience most large enterprises h...

Our Traditional approach to penetration testing, even large scale global penetration testing is to perform an annual/bi-annual pen test on our web applications. Question is who said once a year is enough? Most applications undergo at least quarterly updates and changes if not to provide value for customers but to ensure the web applications are fresh and to address any (hopefully) minor bugs. Cyber attackers can perform a continuous scan on your site to detect changes (code drops) and probe such changes to assess if any vulnerability has been introduced. Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability. The main reasons for a one-off test per year are simply economics: Testing takes resources Resources cost money Resources are scarce Push to deploy is stronger than push to secure Organisa...

"Are we secure?...." A major issue with enterprises is "are we secure?" (what does that even mean...). If you are asked by the CEO whilst sharing a lift to the 10th floor,what do you answer??? eh..em yes..er no...well sort-of..... A few important aspects in attempting to figure out "Are we secure?" from an web security standpoint are (1) How do we make sure the security of our current public facing Internet web landscape is *pretty* robust (not 100% secure)? - Test, maintain, patch, measure, observe..... (2) So how do we make sure systems in design/development are not going to introduce new risk to your business? - Security: Design, Dev,Test, Review, Deploy, Maintain, Patch. ..........So how do we track ongoing assurance efforts, prioritization of technical issues, appoint appropriate risk, track remediation, identify root cause, technology adoption weakness, mixed with securing new deployments (1) & (2) above? - Excel Spreadsheets, Memor...