Latest News

Threat actors around the world have been trying to take advantage of the coronavirus pandemic situation by registering coronavirus related domains and selling them at a discounted price on the dark web. The average number of registrations for such domains have increased almost 10 times over the past few weeks.

Covid-19

Image Source: The Hacker News

Mr Builder: ‘I only had 14 days to build this web app, I don’t have time to keep up with the demands of continuous testing and security.’

Mr Breaker: ‘Your application has insufficient transport layer protection and insecure direct object references and don’t even get me started on the security misconfigurations’.

Mr Builder (Yellow) loves to build, and Mr Breaker (Red) loves to break. It is no wonder why these two do not get along. In many cases, the builders would wait for a penetration test excel sheet from the breakers, google their way to change a few configurations of the code and get back to their job of building more apps/ softwares.

Orange Team

In 2019, attackers are phishing targets to retrieve sensitive information that ultimately leads to data compromise. Phishing is the technique where a malicious actor lures a victim into revealing sensitive information. This can be through large “spray-and-pray” type campaigns involving multiple recipients or, a more targeted approach crafting attacks for specific individuals, known as Spear Phishing. Phishing has been around since the early days of the Internet as one of the oldest vectors of attack.

Phishing

An ADC (Account Data Compromise) event occurs when a third-party attacker or a group of attackers gain unauthorised access to cardholder data that is held within an organisation in either electronic or physical form. Even though the number of ADC events may vary year by year, it takes only one ADC event to negatively impact an organisation.

Account Data Compromise steps

It is a wrap!

Privasec's DroneSec team had a great time at the Singapore Airshow (Asia' largest Aerospace and Defence event) and Global Drone Security Network (GDSN) last week.

DroneSec CTO

Many organisations don’t fully understand the difference between vulnerability scanning, a penetration test, and Red Teaming.

In our latest article, we discussed the difference between a vulnerability scan and a penetration test. Read the full article here.

This article explains the difference between a red team assessment and a penetration test and which assessment is best suited for your organisation.

Vulnerability scan vs penetration testing

As more business processes increase their reliance on data, information security is not just a technical issue anymore. The bigger question, however, is around adoption of an effective risk management framework that not only quantifies risk but also improves executive decision making.

One such structured and defensible framework is FAIR (Factor Analysis of Information Risk).

FAIR Framework

A vulnerability scan detects and classifies system weaknesses in computers, networks, and communications equipment. A penetration test, on the other hand, is the practice of testing a computer system, network or web application to identify insecure business processes, poor security settings, or other weaknesses that a hacker could exploit.

Vulnerability scan vs penetration testing

According to Gartner, the public cloud services market grew by 17.5 percent in 2019 ($214.3 billion up from $182.4 billion in 2018).

As cloud investments will continue to surge in the future, organisations would face a big challenge of managing cloud security risks. Here are a few trends that will shape cloud security in 2020:

Cloud Security

The Privasec team consists of information security professionals from all professional and personal backgrounds. We are an inspirational and supportive family who love having a fun place to work and supportive community within which we can grow professionally.

Privasec Hiring