Eoin & The Security

  What’s the worst that can happen…..An Ode to Risk Risk a widely used word in many walks of life but do we understand what it means… “ Risk  involves uncertainty about the effects/implications of an activity with respect to something that human’s value (such as health, well-being, wealth, property or the environment), often focusing on negative, undesirable consequences .” Cyber security often talks about risk....  A high-risk vulnerability or the risk of an event occurring.  So, risk is related to statistical occurrence of an event and the negative outcome…. We often talk about likelihood and impact. The chance of something happening and the effect the of it happening. As CISO’s or cyber security professionals we try to first address items with the highest risk or combination of likelihood and impact we call this prioritization. The reason we need to prioritize is because we can’t fix all the issues and not every vulnerability is created equal . We ...

For the third year running Edgescan contributed to the Verizon DBiR . The DBiR is recognized as the defacto cyber report which casts a wide net across all types of cyber security and breaches, this includes vulnerability management in both infrastructure and applications. Edgescan vulnerability data is curated and validated, sanitized and reflects tens of thousands of assessments we deliver globally across the full stack to our clients. As stated by Gabriel Basset of Verizon " I think there’s a positive story around how vulnerability scanning, patching, and filtering are preventing exploiting vulns from being the easiest way to cause a breach but that asset management is needed to identify and patch unpatched systems... " A few things that stand out to me in the report are as follows: Nearly half of breaches involved Hacking and 70% of breaches were external threat actors. To me this makes sense as in our experience most large enterprises h...

Our Traditional approach to penetration testing, even large scale global penetration testing is to perform an annual/bi-annual pen test on our web applications. Question is who said once a year is enough? Most applications undergo at least quarterly updates and changes if not to provide value for customers but to ensure the web applications are fresh and to address any (hopefully) minor bugs. Cyber attackers can perform a continuous scan on your site to detect changes (code drops) and probe such changes to assess if any vulnerability has been introduced. Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability. The main reasons for a one-off test per year are simply economics: Testing takes resources Resources cost money Resources are scarce Push to deploy is stronger than push to secure Organisa...