Plainsea’s Post

The recent CyberStrike incident serves as clear evidence that crucial testing phases were overlooked. In our current technological era, the presence of bugs in applications is alarmingly common and unacceptable. It's imperative for organizations to now recognize the importance of intensive testing to maintain software integrity and security. Solid testing is necessary at this moment.

Don't let test administration complexities overwhelm you! Embrace technology for enhanced security, time-saving tools, and efficient data management. Discover 5 ways tech simplifies monitoring, allowing you to focus on what matters—ensuring a fair and accurate testing experience for everyone.

🍂Our first release of the the Autumn focuses on improving platform stability with 111 bug fixes! 🍁 Key updates include enhancing the Ultimate Report, improving the accuracy and speed of the External Scanner, refining API integration, and boosting overall platform performance. Read more here: https://ow.ly/VRbZ50TmlIe #VulnerabilityScanner #PatchNotes #CyberSecurityPlatform

How easy is it for you to get a read on your current Risk Exposure? We find that if you simplify your risks in order to track your risk profile they become hard to action, but if you capture the entirety of the threats and vulnerabilities to your operation you end up loosing sight of the wood for the trees. We love trees at Illuminet which is why we plant them every time we work with a customer. We also love helping customers which is why we solved the problem in our software. You can capture as much detail as you should and still see what is happening by using our innovative Risk Radar software.

Are you waiting for your annual pentest to find and fix vulnerabilities like business logic flaws and privilege escalation weaknesses? Automated scanners are great in filling in the gaps. But they can't detect every vulnerability. Cytix brings the results of your annual pentest forward by orchestrating both manual and automated testing at the time of development change. So you know what to test, where to test and how to test before any changes hit production.

NetAlly's blog outlines a checklist for minimizing risks associated with active vulnerability scanning. While crucial for identifying network weaknesses, such scans can disrupt operations. To mitigate these risks: 1.      Target specific network domains or IP ranges to minimize impact. 2.      Choose Nmap scripts carefully, focusing on clear vulnerability identification and low false positives. 3.      Schedule scans during off-peak hours to reduce disruption, or vary intervals to evade detection. 4.      Utilise CyberScope's AutoTest to standardise and consistently execute customised vulnerability scans within your organisation. Read More Here: https://lnkd.in/eU35Ky7p

Today was an insightful day spent discussing use case framework, threat models, compliance as code, and chaos engineering with three different SOC teams. All three expressed challenges around automation, not just in response but also with the challenge of detection lifecycle management. It makes me wonder how many others are missing the value of their control investments as efficacy degrades with time. Red teams can help, but they're a blunt instrument for ensuring detections remain reliable as software stacks and versions change. One concern that still worries me is how vendors fail to map their events to ATT&CK or similar. What is event 37, and should you care? It's important to have a clear understanding of your security events and how they map to industry standards.

"Security is the outcome of quality." Insightful video highlighting the critical role of testing, quality control, and change management—principles that transcend industries.

Domain-based Message Authentication Reporting and Conformance (DMARC) is a great tool which stops attackers from spoofing your domain and making their emails look like they come from inside your organisation. Read all about DMARC here > http://ow.ly/FYaQ30syCTO

CrowdStrike Preliminary Post Incident Review (PIR) TL;DR: A previous content update of a particular type was tested and worked fine, and the bad content update was similar enough to this previous one that it met criteria to be essentially "grandfathered" and released without testing, and due to another bug in the validator, the update had an out-of-bounds memory exception that triggered the BSOD.