Penetration Test
Piergiorgio Venuti
Penetration Testing and MFA: A Dual Strategy to Maximize Security
In a digital world where cyber threats are increasingly sophisticated, multi-factor authentication (MFA) represents a crucial defense against unauthorized access. However, the growing prevalence of phishing attacks aimed at bypassing MFA raises significant questions about post-authentication security and the overall effectiveness of security strategies. In this context, we examine how penetration testing can be used to assess and strengthen the…
Piergiorgio Venuti
Penetration Testing: Where to Strike to Protect Your IT Network
Introduction In an increasingly interconnected and digital world, cybersecurity has become a top priority for companies of all sizes. One of the most effective techniques to identify vulnerabilities and improve security is penetration testing, also known as pen testing or ethical hacking. But in a complex network with different environments, which ones are the most suitable for pen testing efforts?…
Giacomo Lanzi
Red Team, Blue Team and Purple Team: what are the differences?
When we talk about cybersecurity and find ourselves on the side of the attacked, we often limit ourselves to thinking in terms of defense, protection and containment of threats. However, the approach that works best is one in which you put yourself in the attacker’s shoes and treat your infrastructure as the target of their actions. Only in this way…
Piergiorgio Venuti
CIS Controls and Vulnerability Assessment: practical guide to adopting best practices
Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture. What is CIS (Center for Internet Security)?…
Piergiorgio Venuti
Protect your company with a continuous vulnerability assessment service: the perfect solution to integrate VA and PT
Cybersecurity has become a fundamental pillar of modern businesses, and with the increase of threats and risks, it is imperative to adopt ever more advanced protection measures. In this context, the Vulnerability Assessment (VA) and the Penetration Test (PT) play a crucial role. However, it is also necessary to consider the importance of an ongoing vulnerability assessment service to guarantee…
Piergiorgio Venuti
Why it is essential to carry out the Internal Penetration Test as well as the external one: a complete guide to IT security
In an increasingly connected and digitized world, cyber security has become a major concern for businesses. An effective protection system must provide for the implementation of both external and internal measures to ensure maximum security of data and company resources. In this article, we will explore the importance of performing Internal as well as external Penetration Testing and how Secure…
Giacomo Lanzi
The certifications of the SOD Red Team
In order to keep the eye on your IT infrastructure, hire a Red Team with certifications it is the ideal choice . The analyzes carried out by a certified Red Team are aimed at the protection and prevention of attacks and data losses. Obviously, an in house Red Team would require hefty hiring costs and a constant financial effort to…
Giacomo Lanzi
Ethical hacking: defending knowing how to attack
Ethical hacking means the application for good of hacking techniques. The term “hacker” was coined in the 1960s at the Massachusetts Institute of Technology (MIT) to describe experts who used their skills to re-develop mainframe systems, increasing their efficiency and allowing them to perform more tasks. Nowadays, the term normally describes experienced programmers who gain unauthorized access to computer systems…
Giacomo Lanzi
Does ISO 27001 standard require a Pentest?
A legitimate question that often arises is whether the Penetration Test is necessary for compliance with the ISO 27001 standard. To fully understand the answer, it is necessary to clarify what is meant by these terms and to understand the relationship between all the components of the certification. ISO 27001 standard A technical standard, also incorrectly called a standard, is…
Giacomo Lanzi
Computer network security: PT vs. VA
The security of computer networks is of vital importance for a company. With technologies increasingly relying on remote services, it is good to ensure that security is guaranteed. To do this, two tools are used: Vulnerability Assessment and Penetration Test. But what is the difference between them? The answer to this question is not as obvious as one might think….
Giacomo Lanzi
Security: pentest and verification of vulnerabilities
The computer security of a system is very important to avoid unpleasant inconveniences due to malicious attacks. In principle, it is not enough to set up a complete security system, you must also check that the above systems are working. To do this we turn to professionals who can carry out pentest (penetration tests) and carry out a vulnerability check….
Share
RSS
More Articles…
- NIS: what it is and how it protects cybersecurity
- Advanced persistent threats (APTs): what they are and how to defend yourself
- Penetration Testing and MFA: A Dual Strategy to Maximize Security
- Penetration Testing: Where to Strike to Protect Your IT Network
- Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer.
- Why IT audit and log management are important for Cybersecurity
- Red Team, Blue Team and Purple Team: what are the differences?
- Mercedes’ Oversight Puts Company Secrets at Risk: Why Cyber Threat Intelligence is Critical
Categories …
- Backup as a Service (18)
- Acronis Cloud Backup (11)
- Veeam Cloud Connect (4)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- ICT Monitoring (5)
- Log Management (2)
- News (24)
- ownCloud (4)
- Privacy (7)
- Secure Online Desktop (14)
- Security (203)
- Cyber Threat Intelligence (CTI) (8)
- Deception (4)
- Ethical Phishing (11)
- Netwrix Auditor (2)
- Penetration Test (11)
- Posture Guard (3)
- SOCaaS (65)
- Vulnerabilities (84)
- Web Hosting (15)
Tags
darkreading
- Lessons for CISOs From OWASP's LLM Top 10 April 23, 2024It's time to start regulating LLMs to ensure they're accurately trained and ready to handle business deals that could affect the bottom line.
- US Gov Slaps Visa Restrictions on Spyware Honchos April 23, 2024The State Department can now deny entrance to the US for individuals accused of profiting from spyware-related human rights abuses, and their immediate family members.
- Russia's Fancy Bear Pummels Windows Print Spooler Bug April 23, 2024The infamous Russian threat actor has created a custom tool called GooseEgg to exploit CVE-2022-38028 in cyber-espionage attacks against targets in Ukraine, Western Europe, and North America.
- Teetering on the Edge: VPNs, Firewalls' Nonexistent Telemetry Lures APTs April 23, 2024State-sponsored groups are targeting critical vulnerabilities in virtual private network (VPN) gateways, firewall appliances, and other edge devices to make life difficult for incident responders, who rarely have visibility into the devices.
- Licensed to Bill? Nations Mandate Certification & Licensure of Cybersecurity Pros April 23, 2024Malaysia, Singapore, and Ghana are among the first countries to pass laws that require cybersecurity firms — and in some cases, individual consultants — to obtain licenses to do business, but concerns remain.
- ToddyCat APT Is Stealing Data on 'Industrial Scale' April 22, 2024The threat actor is deploying multiple connections into victim environments to maintain persistence and steal data.
- Nespresso Domain Serves Up Steamy Cup of Phish, No Cream or Sugar April 22, 2024An open direct vulnerability in the Nespresso Web domain lets attackers bypass detection as they attempt to steal victims' Microsoft credentials.
- MITRE ATT&CKED: InfoSec's Most Trusted Name Falls to Ivanti Bugs April 22, 2024The irony is lost on few, as a nation-state threat actor used eight MITRE techniques to breach MITRE itself — including exploiting the Ivanti bugs that attackers have been swarming on for months.
- Zero Trust Takes Over: 63% of Orgs Implementing Globally April 22, 2024Though organizations are increasingly incorporating zero-trust strategies, for many, these strategies fail to address the entirety of an operation, according to Gartner.
- Where Hackers Find Your Weak Spots April 22, 2024The five intelligence sources that power social engineering scams.
Full Disclosure
- BACKDOOR.WIN32.DUMADOR.C / Remote Stack Buffer Overflow (SEH) April 19, 2024Posted by malvuln on Apr 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/6cc630843cabf23621375830df474bc5.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Dumador.c Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The malware runs an FTP server on TCP port 10000. Third-party adversaries who can reach the server can send a specially […]
- SEC Consult SA-20240418-0 :: Broken authorization in Dreamehome app April 19, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 19SEC Consult Vulnerability Lab Security Advisory < 20240418-0 > ======================================================================= title: Broken authorization product: Dreamehome app vulnerable version:
- MindManager 23 - full disclosure April 19, 2024Posted by Pawel Karwowski via Fulldisclosure on Apr 19Resending! Thank you for your efforts. GitHub - pawlokk/mindmanager-poc: public disclosure Affected application: MindManager23_setup.exe Platform: Windows Issue: Local Privilege Escalation via MSI installer Repair Mode (EXE hijacking race condition) Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz (Eviden Red Team) Proposed mitigation:...
- CVE-2024-31705 April 14, 2024Posted by V3locidad on Apr 14CVE ID: CVE-2024-31705 Title : RCE to Shell Commands" Plugin / GLPI Shell Command Management Interface Affected Product : GLPI - 10.X.X and last version Description: An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. […]
- SEC Consult SA-20240411-0 :: Database Passwords in Server Response in Amazon AWS Glue April 14, 2024Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 14SEC Consult Vulnerability Lab Security Advisory < 20240411-0 > ======================================================================= title: Database Passwords in Server Response product: Amazon AWS Glue vulnerable version: until 2024-02-23 fixed version: as of 2024-02-23 CVE number: - impact: medium homepage: https://aws.amazon.com/glue/ found:...
- [KIS-2024-03] Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability April 11, 2024Posted by Egidio Romano on Apr 10------------------------------------------------------------------------------ Invision Community
- [KIS-2024-02] Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability April 11, 2024Posted by Egidio Romano on Apr 10-------------------------------------------------------------------- Invision Community
- Multiple Issues in concretecmsv9.2.7 April 11, 2024Posted by Andrey Stoykov on Apr 10# Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 # Date: 4/2024 # Exploit Author: Andrey Stoykov # Version: 9.2.7 # Tested on: Ubuntu 22.04 # Blog: http://msecureltd.blogspot.com Verbose Error Message - Stack Trace: 1. Directly browse to edit profile page 2. Error should come up with verbose stack trace […]
- OXAS-ADV-2024-0001: OX App Suite Security Advisory April 11, 2024Posted by Martin Heiland via Fulldisclosure on Apr 10Dear subscribers, We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack. This advisory has also been published at https://documentation.open-xchange.com/appsuite/security/advisories/html/2024/oxas-adv-2024-0001.html. […]
- Trojan.Win32.Razy.abc / Insecure Permissions (In memory IPC) April 11, 2024Posted by malvuln on Apr 10Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/0eb4a9089d3f7cf431d6547db3b9484d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Win32.Razy.abc Vulnerability: Insecure Permissions (In memory IPC) Family: Razy Type: PE32 MD5: 0eb4a9089d3f7cf431d6547db3b9484d SHA256: 3d82fee314e7febb8307ccf8a7396b6dd53c7d979a74aa56f3c4a6d0702fd098 Vuln ID: MVID-2024-0678...
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
{subscription_form_1}Products and Solutions
Partners
Cloud Models
News
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
- Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer. March 6, 2024
Google Reviews
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2023 Secure Online Desktop s.r.l. All Rights Reserved. Registered Office: via dell'Annunciata 27 – 20121 Milan (MI), Operational Office: via statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Tax code and VAT number 07485920966 – R.E.A. MI-1962358 Privacy Policy - ISO Certifications