5 min read
WordPress Security
WordPress runs a huge share of the web, which makes it a standing target. The updates, plugin hygiene, and access limits that prevent the common compromises.
Read the post →Blog — page 11
Research and analysis
The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
113 posts
- 3 min read
Why you need a DMZ
A flat network means one compromised host reaches everything. What belongs in a DMZ, what controls it needs, and how segmentation limits a breach.
Read the post → - 2 min read
Attack Surface Management
External attack surface management means finding what you expose to the internet before somebody else does. Why the inventory is always bigger than expected.
Read the post → - 1 min read
What are Weak Hashing Algorithms
Your scanner flagged an SSL certificate signed with a weak hashing algorithm. What that actually means, why SHA-1 fails, and how to replace the certificate.
Read the post → - 3 min read
Data Privacy Day
Data privacy is not the same as data security, and the difference matters when regulators ask. What personal data you hold, and the steps to protect it.
Read the post → - 2 min read
OWASP Top Ten – Injection
If one vulnerability class deserves to be called a classic, injection is it. SQL, command, and cross-site scripting, why they persist, and how to stop them.
Read the post → - 1 min read
TutorTrac Multiple Stored XSS
Brackish researchers found authenticated stored XSS in several locations in TutorTrac 4.2.170210. Where the injection points were, and how to remediate them.
Read the post → - 2 min read
OWASP Top Ten – Insufficient Logging & Monitoring
The OWASP entry nobody notices is missing until an incident, when there is nothing to investigate with. What to log, what to watch, and free tools to start.
Read the post → - 1 min read
OWASP Top Ten – Vulnerable and Outdated Components
Your application is mostly other people’s code, and that code ages. How outdated dependencies become the easiest route in, and how testing surfaces them.
Read the post → - 4 min read
Why Your Business Needs A Penetration Test
What a penetration test is, the types available, and what you actually get out of one. A plain introduction for businesses that have never commissioned one.
Read the post →