CRITICALSTART Blog

Risk Expert Doug Jones on SON OF A BREACH! Podcast: Ransomware Drives Biggest Losses in Insurance

Ransomware attacks and cybercriminal gangs continue to make headlines as they create…

Zero-day Targeting Exchange Servers: Steps to Evaluate the Risk to Your Organization

By: Charlie Smith & Travis Farral A zero-day has been announced targeting E…

The Top Three Issues Robbing You Of SIEM ROI

Upon inception, the function of the Security Information and Event Management (SIEM)…

Rock your SOCs: SON OF A BREACH! Podcast

Do you know how to find the right talent and skillsets to build up your Security Ope…

Earning Your Business is Good. Earning Your Trust is Better.

The impact a company culture has on delivering value Company culture might fee…

No Kidding: SON OF A BREACH! Podcast Welcomes Dr. Anton Chuvakin for Detection Insights

What do a $10 billion funding request for cybersecurity, a massive collection of 3.2…

Navigate Aftermath of SolarWinds Attack With On-Demand Resources

The SolarWinds cybersecurity breach, also known as Sunburst, has made glob…

Data Privacy Program from Zero to Hero

By Cecil Pineda | Senior Director of GRC vCISO at CRITICALSTART As I promised last w…

Balancing Act: How MOBILESOC can Ensure Cybersecurity while Protecting Time with Family

By Tommy Scott, Senior Security Consultant | CRITICALSTART Closing the laptop a…

Windows Security Event Logs – What to Monitor?

The following is a table of event codes that I’ve found to be extremely valuable to …

How To Reverse Engineer the SolarWinds Hack

Author: Quentin Rhoads-Herrera, Director of Professional Services When it comes to s…

Second Round of Stimulus Provides New Opportunity for Online Scams

This week, Americans nationwide will begin receiving their second round of COVID-rel…

Sunburst: A Week in Review

2020 isn’t going down quietly, and what an awful week it has been for the security c…

Weighing the Value of Managed Security

A shortage of skilled personnel is one of the most serious issues affecting security…

Death to Vulnerability Management As We Know It

Vulnerability Management concepts are changing. The idea that vulnerability manageme…

Steps Educational Institutions Are Taking to Defend Their Infrastructures from Cyber Attackers

Just when we thought 2020 couldn’t get any worse, cyber attackers are finding new wa…

Once More Unto the Breach: An Exploration into Breach Prevention and Response

Organizations continue to learn the hard way that cybersecurity breaches can happen …

Multiple Vulnerabilities Discovered in Aviatrix

Versions Tested: Aviatrix Cloud Controller UserConnect-5.3.1516 Aviatrix VPN Client …

The Democratization of Security: Simplification and Direction for Content Management

Last week, we talked about how life could be made easier through the democratization…

Local Privilege Escalation Vulnerability Discovered in VMware Fusion

Summary:VMware Fusion contains a local privilege escalation vulnerability that allow…

The Democratization of Security

How Permissions Elevate both Transparency and Efficiency to Build Healthier Security…

Electronic Voting: 3 Ways to Strengthen Election Security

It is no secret that wildly different political views aside, the threat of foreign a…

CRITICALSTART & ePlus | National Cybersecurity Awareness Month Podcast

Full Transcript: LW: Welcome. Thanks for joining everyone, my name is Lee Waske…

How to Develop a Cybersecurity Playbook in 5 Steps

The imperative to develop an information security playbook to protect your organizat…

Exploiting Enterprise Passwords

No matter how much you think you’ve done to safeguard your data and systems against …

[2020 Updates] Gartner Endpoint Security Hype Cycle Insights

Gartner recently released their 2020 Hype Cycle for Endpoint Security, and the focus…

Attorney-Client Privilege and Cybersecurity: What’s Changed and How to Adapt

What does the recent Eastern District of Virginia decision mean for your c…

SIEM & MDR: What You Need to Know

A defense-in-depth security strategy is built upon the premise that no one tool or p…

Critical Vulnerabilities Discovered in MoFi Routers

Versions Tested: MOFI4500-4GXeLTE V2 Firmware 3.6.1-std MOFI4500-4GXeLTE V2 Firmware…

Benefits of Security Orchestration, Automation, & Response

With threats to network security increasing in sophistication and expanding the rost…

A New MDR Managed SIEM Offering Powered by Devo

By Rob Davis, CEO of CRITICALSTART At CRITICALSTART, every idea begins with the ques…

Incident Response Teams: In-House vs Outsourced

How prepared is your organization for a security breach? That gap in time between fi…

Cyber Threat Concerns Grow as Schools Lean on Virtual Learning

With many school districts using distance learning due to the COVID-19 pandemic, con…

Once More unto the Breach – Lessons Learned From Billion Dollar Breaches

What can we learn from some of the most expensive data breaches in history? CR…

CRITICALSTART MDR Ranks 4.7/5 on Gartner Peer Insights

Recognizing the importance of peer reviews in an organization’s purchasing decisions…

CRITICALSTART’s TEAMARES Launches DeimosC2

Flexible, Open-Source Tool to Manage Post-Exploitation Issues – …

How the COVID-19 Pandemic Affects Hackers

Cybersecurity expert Rob Davis of CRITICALSTART talks to Hal of Fox 11 New in L…

EDR Tools: What They Are & Why You Need Them

EDR tools enable endpoint visibility and detection of threats via registry monitorin…

F5 BIG-IP Remote Code Execution Exploit – CVE-2020-5902

When TEAMARES began research into the vulnerability identified in the F5 TMUI R…

Webinar: Lessons Learned from Billion Dollar Breaches

Globally, breaches cost organizations billions of dollars every year. In the U.S., l…

Threat Hunting: Proactive Incident Response

Organizations often don’t realize they’ve been breached, giving malicious actors the…

Uncovering Your Security Blind Spots: Keys to Protecting your Organization from the Unknown

Many organizations are shocked to learn their systems have been breached, with attac…

MSSP vs MDR: Comparing Incident Response Capabilities

Three acronyms swirl around today’s security discussions: Managed Detection and Resp…

CSIRT vs. SOC: What’s the Difference?

Years ago, organizations relied primarily on their IT department to manage security….

Outer Space Meets Cyberspace: What Space Travel Can Teach Us About Cybersecurity

February 20, 1962: An Atlas LV-3B launch vehicle lifts off from Launch Complex 14 at…

Local Privilege Escalation Discovered in GlobalProtect App

Versions Tested: GlobalProtect App < 5.1.4 on Windows GlobalProtect App < 5.0….

How Security Teams Eliminate Risk Acceptance with MDR

Recent data shows that 83 percent of IT security professionals are feeling…

Securing Your Cookies: HTTPOnly Flag for Cookie Theft Defense

Missing HttpOnly flags on cookies are a common finding in Web Application penetratio…

Local Privilege Escalation Discovered in VMware Fusion

Versions Tested:VMware Fusion 11.5.3 Products: https://www.vmware.com/products/fusio…

Why a Proactive IR Strategy Is Critical

Breaches are a fact of life for every business. However, it is possible to stop brea…

COVID-19 Contact Tracing Methods Compared: Examining Privacy & Security Implications

Discussions about contact tracing have been ongoing since February 2020, when some e…

Zero-Trust and Micro-Segmentation

Adoption of Zero-Trust and Micro-Segmentation as core design principles can help imp…

Weaponizing Public Breach Data Dumps for Red Teamers

Public password dumps have been an excellent way for attackers to gain access to acc…

Ransomware and the CIA Triad: Considerations for Evolving Attack Methods

One thing is clear: no one is safe from ransomware attacks. What is changing, howeve…

What is EDR? And EDR vs. MDR vs. EPP – Security Compared

Proactive vs. Reactive Endpoint Security Really, there are two kinds of security pra…

NFL Draft: 5 Things Teams Need to Do Now to Guard Against Hackers

Ready or not, it’s NFL draft week. After much debate over how to hold the NFL draft,…

CRITICALSTART’s TEAMARES a Top Contributor to [email protected] in Global Fight Against COVID-19

In times like these, we all could use some good news and CRITICALSTART‘s TEAMAR…

Cybersecurity Needs for the Remote Workforce

Chicken Little was always running around saying the same thing… until it really happ…

Free MOBILESOC and Endpoint Protection for Remote Security Teams until June 15

Like many other organizations, we have deliberated on how CRITICALSTART ca…

Hard-Coded Administrator Password Discovered in OpsRamp Gateway

Version Tested:3.0.0 Product:https://www.opsramp.com/ CVE Numbers:CVE-2020-11543 CVS…

Vulnerabilities Discovered in CIPAce Enterprise Platform

Versions Tested:CIPAce Version < 6.80 Build 2016031401CIPAce Version < 9.1 Bui…

From the Trenches: Relaying Passwords for the Win!

As pentesters and red teamers, we know that it isn’t hard to get user passwords. The…

Telesploit: Open-Source Remote Vulnerability Assessment & Penetration Testing

Due to current events, your organization is more than likely experiencing disruption…

Authentication Bypass Vulnerability Discovered in Infinias eIDC32 WebServer

Versions Tested:Web Revision: 1.107, Board: 3.001, Firmware: 2.213 Product:https://w…

The Best Online Security Courses to Take in Your Downtime

With the daily routines of millions rapidly changing as we settle into a period of s…

Phishing Attacks: Beware of Online Financial Scams

Challenging times bring out the best in people – but also the worst. As the world de…

CRITICALSTART’s TEAMARES Research Is Aiding Global Fight Against COVID-19

What does a computer virus have in common with the Coronavirus (COVID-19)? Plenty, b…

Regex Revelry

Regular Expressions (Regex) are used to identify strings that defy simple search ter…

Vulnerabilities Discovered in Tiff Server from AquaForest

Versions Tested: Tiff Server 4.0 Product: https://www.aquaforest.com/en/tiffserver.a…

State Legislation May Drive Federal Security Compliance Regulations in 2020

State governments are taking the lead in developing cybersecurity regulations as cyb…

Vulnerability Focus: Exploits Impacting Organizations

No matter how much you think you’ve done to protect your data and systems, common vu…

SOAR And MDR: Finding The Best Fit To Augment Security

The well-documented shortage of experienced cybersecurity practitioners is…

4 Key Steps to Protect Your Organization Against Increased Cyber Threats

In today’s cyber threat landscape, it’s not just the military-industrial and defense…

Protecting Your Organization Against Ransomware Attacks

Attacks are increasing – a proactive approach to data protection can help you safegu…

Top 6 Cybersecurity Predictions for 2020

The pace of breaches and cybersecurity threats continues unabated. In 2019 alone, we…

That’s a Wrap: 2019 Cybersecurity Predictions Recap

As we close the books on 2019, we thought we’d take a look back at the predictions w…

Tips for Securing PowerShell

In 2020, system administrators will be using PowerShell. There is no tool more power…

The First Channel-Only MDR

When CRITICALSTART first opened for business in 2012, we pursued a service-led …

Retailers: Don’t Let Black Friday Cyberattacks Darken Holiday Shopping

Valentine’s Day, Mother’s Day, Independence Day, Back-to-School, and Halloween are d…

Reducing Vulnerabilities: Addressing Orphaned Systems and Weak Passwords

Luckily, it was only a test. During penetration testing for two international compan…

Cybersecurity 101: What to Look for in a Partner

The key to effective cybersecurity is to quickly stop an attack before it becomes a …

Testing a Flutter Application

As your app gets bigger, a good set of tests may help you save time, as tests can fi…

Research Report: The Impact of Security Alert Overload

CRITICALSTART conducted a survey of more than 50 Security Operations Center (SO…

SECURITY TOOLS

THREAT ANALYTICS SEARCH CHROME EXTENSION Current Version 4.0.4 – Updated on 8/26/201…

Cracking NTLMv2 Hashes with Cthulhu

Why Password Managers and MFA are Important in your Security Stack The subject of pa…

Cybercriminals Going after K-12? Yep, It’s a Thing.

Louisiana Governor John Bel Edwards has issued a state of emergency due to a malware…

Mid-Year Check-In: 2019 Cybersecurity Predictions

Back in early January, I teamed up with my colleague, Jordan Mauriello, to write fiv…

Tackling the Cybersecurity Talent Shortage, One Alert at a Time

Reducing alert overload by integrating zero-trust technology as part of your securit…

The Industry’s First – and Only – MOBILESOC App Just Got Better

Instant triage and response to security alerts? We’ve got an app for that. We’re cha…

ManageEngine Privilege Escalation

Background:After running into ManageEngine products on a number of penetration tests…

The Threat of Systematic Cybersecurity Risk in Financial Services

It’s obvious that criminals follow the money, making financial services firms a top …

Drowning in Alerts? CRITICALSTART, Microsoft Defender ATP Collaboration Will Reduce Alerts by 99%

The rapidly changing threat landscape poses numerous challenges for all enterprise o…

Law Firms Beware: Data Breaches on the Rise

If your law firm hasn’t been breached, chances are very high it will. Cybersecurity …

The Last Watchdog Talks to CRITICALSTART About Radical Transparency

At CRITICALSTART, we’ve made the concept of “radical transparency” a cornerstone of …

The Rx for a Healthy Cybersecurity Strategy: A Look at CRITICALSTART Customer, Ardent Health Services

Of course, cybersecurity is a priority for businesses across all industries, but in …

The Boy Who Cried “Alert”

Later, he saw a REAL wolf prowling about his flock. Alarmed, he leaped to his feet a…

ManageEngine User Enumeration

Background:While conducting a penetration test of a client’s external network, I dis…

VMware Horizon Connection Server Information Disclosure

Background: While conducting a penetration test of a client’s external network,…

#BalanceForBetter: International Women’s Day 2019

This year’s International Women’s Day 2019 theme is #BalanceforBetter…

The Pastebin Treasure Hunter

IntroductionMalicious actors have multiple ways to share data they have stolen from …

Data is the New Source Code

The role of data in today’s business world cannot be overstated. Competitive intelli…

Information Disclosure in JForum 2.1.X – Syntax

BackgroundWhile conducting a penetration test for a customer, I encountered an unuse…

Abusing mshta.exe to Gain PowerShell Access

Background In my previous life, I spent a lot of time analyzing malware and figuring…

The Next Step of Social Engineering: Social Media Hoaxes

From Jonathan Swift’s fake almanac in 1708 to the modern Dihydrogen m…

Five Cybersecurity Predictions for 2019

2018 was another year of change in the cybersecurity industry. We’ve had some intere…

One Month Later: The Marriott Data Breach – What You Should Do

Just over a month ago, Marriott International, one of the world’s largest hotel chai…

Naughty or Nice: Cybercriminals’ Latest Targeting Strategies During the Holiday Season

Economics of Christmas: The Joy of Shopping Retailers solicit most fervently on a ha…

Phishing Attacks Today: DRIDEX and URSNIF Are Back

On the morning of December 12th, 2018, the CRITICALSTART CYBERSOC began se…

A Commitment to Getting It Right: Palo Alto Networks’ Expedition Migration Tool

Background: During a recent penetration test for a client, I came across a tool call…

Supporting Our Family: In Memory of Ricki Bateman

Today being the National Day of Giving, we come together to celebrate the gift of ge…

PRTG Network Monitor Privilege Escalation

Background:Recently I’ve seen a decent number of privilege escalations occurring on …

Cisco Umbrella Enterprise Roaming Client and Enterprise Roaming Module Privilege Escalation Vulnerability

CVE Numbers:CVE-2018-0437 – Cisco Umbrella ERC releases prior to 2.1….

Defending Layer 8

Security awareness training is broken. Read the news any day of the week and you can…

Unauthenticated Command Injection Vulnerability in VMware NSX SD-WAN by VeloCloud

Exploits for network devices including routers, switches, and firewalls have been ar…

Fall of Sudo – A Pwnage Collection

Introduction Finding Linux servers heavily reliant on Sudo rules for daily managemen…

Finding Enterprise Credentials in Data Breaches

In the age of the breach, it’s a safe assumption that almost every public account’s …

Cryptojacking Attack: Everyone is a Target

An evolution has occurred with the preferred attack method among hackers. With its h…

Putting the NEXT in Next Generation Firewall: Tales From the Field

You’ve purchased a next-generation firewall. You understand the why, but h…

Spectre and Meltdown: Why No One Should Implicitly Trust Hardware

Everyone should be wary of downloading, installing, or running unknown scripts or so…

KRACK Attacks!

What’s the big deal? Mathy Vanhoef of imec-DistriNet, KU Leuven has discovered a ser…

Bluetooth Blues

The proliferation of wireless devices in the world is astounding, and one of the mos…

Security Automation and Orchestration: An Analyst Perspective

Security Automation and Orchestration (SAO) Platforms are the newest players in the …

The New Ransomware that Makes WannaCry Wanna Cry

Today, 27 June 2017, a new malware has begun attacking networks around the world. Pe…

The Devil’s in the Subtitles

Widespread malware affecting media players On May 23rd, 2017, Checkpoint f…

WannaCry Recap

Friday could not have come sooner for some last week. For the rest of us, we may hav…

WannaCry? You Might.

Urgent Information Regarding WanaCrypt/WannaCry/WCry Ransom-ware Outbreak Today, 12 …

WannaCry IOCs and Technical Details

Technical Details It is currently unclear whether this payload is delivered via mali…

Mitigating Against the Shadow Broker Exploit Dump

On Friday, April 14, a group called “Shadow Brokers” released multiple exploits and …

Picking the Right Silver Bullet

With the current state of cybersecurity, the market has become inundated with “solut…

Hijacking the CEO’s Email Account

Why Security Teams Need a Second Set of Eyes During a recent penetration test, I hij…

On the Reliance of Client-Side Security

I recently conducted a penetration test of a web application. Because of design deci…

What Are the Mistakes That Get Hackers Arrested?

At CRITICALSTART, we use a concept called the Defendable Network and map&n…

Risk Expert Doug Jones on SON OF A BREACH! Podcast: Ransomware Drives Biggest Losses in Insurance

Ransomware: Be a Victor, Not a Victim.

Azure Sentinel: Notifications of New Detection Rules

SON OF A BREACH! Podcast: CFO Andrew Kaufman Calculates Cost of Risk

Is Your Cybersecurity Answering the Right Question?

Women in Cybersecurity: Meredith Dishman

Secure the Cloud—All Hands on Deck

Women in Cybersecurity: Katy Lietzau

MOBILESOC: You’ll Take this Threat Alert to Go.

Didi Dayton Joins SON OF A BREACH! Podcast to Celebrate Women in Cybersecurity

Zero-day Targeting Exchange Servers: Steps to Evaluate the Risk to Your Organization

The Top Three Issues Robbing You Of SIEM ROI

Rock your SOCs: SON OF A BREACH! Podcast

Earning Your Business is Good. Earning Your Trust is Better.

No Kidding: SON OF A BREACH! Podcast Welcomes Dr. Anton Chuvakin for Detection Insights

Navigate Aftermath of SolarWinds Attack With On-Demand Resources

Data Privacy Program from Zero to Hero

Balancing Act: How MOBILESOC can Ensure Cybersecurity while Protecting Time with Family

Windows Security Event Logs – What to Monitor?

How To Reverse Engineer the SolarWinds Hack

Second Round of Stimulus Provides New Opportunity for Online Scams

Sunburst: A Week in Review

Weighing the Value of Managed Security

Death to Vulnerability Management As We Know It

Steps Educational Institutions Are Taking to Defend Their Infrastructures from Cyber Attackers

Once More Unto the Breach: An Exploration into Breach Prevention and Response

Multiple Vulnerabilities Discovered in Aviatrix

The Democratization of Security: Simplification and Direction for Content Management

Local Privilege Escalation Vulnerability Discovered in VMware Fusion

The Democratization of Security

Electronic Voting: 3 Ways to Strengthen Election Security

CRITICALSTART & ePlus | National Cybersecurity Awareness Month Podcast

How to Develop a Cybersecurity Playbook in 5 Steps

Exploiting Enterprise Passwords

[2020 Updates] Gartner Endpoint Security Hype Cycle Insights

Attorney-Client Privilege and Cybersecurity: What’s Changed and How to Adapt

SIEM & MDR: What You Need to Know

Critical Vulnerabilities Discovered in MoFi Routers

Benefits of Security Orchestration, Automation, & Response

A New MDR Managed SIEM Offering Powered by Devo

Incident Response Teams: In-House vs Outsourced

Cyber Threat Concerns Grow as Schools Lean on Virtual Learning

Once More unto the Breach – Lessons Learned From Billion Dollar Breaches

CRITICALSTART MDR Ranks 4.7/5 on Gartner Peer Insights

CRITICALSTART’s TEAMARES Launches DeimosC2

How the COVID-19 Pandemic Affects Hackers

EDR Tools: What They Are & Why You Need Them

F5 BIG-IP Remote Code Execution Exploit – CVE-2020-5902

Webinar: Lessons Learned from Billion Dollar Breaches

Threat Hunting: Proactive Incident Response

Uncovering Your Security Blind Spots: Keys to Protecting your Organization from the Unknown

MSSP vs MDR: Comparing Incident Response Capabilities

CSIRT vs. SOC: What’s the Difference?

Outer Space Meets Cyberspace: What Space Travel Can Teach Us About Cybersecurity

Local Privilege Escalation Discovered in GlobalProtect App

How Security Teams Eliminate Risk Acceptance with MDR

Securing Your Cookies: HTTPOnly Flag for Cookie Theft Defense

Local Privilege Escalation Discovered in VMware Fusion

Why a Proactive IR Strategy Is Critical

COVID-19 Contact Tracing Methods Compared: Examining Privacy & Security Implications

Zero-Trust and Micro-Segmentation

Weaponizing Public Breach Data Dumps for Red Teamers

Ransomware and the CIA Triad: Considerations for Evolving Attack Methods

What is EDR? And EDR vs. MDR vs. EPP – Security Compared

NFL Draft: 5 Things Teams Need to Do Now to Guard Against Hackers

CRITICALSTART’s TEAMARES a Top Contributor to [email protected] in Global Fight Against COVID-19

Cybersecurity Needs for the Remote Workforce

Free MOBILESOC and Endpoint Protection for Remote Security Teams until June 15

Hard-Coded Administrator Password Discovered in OpsRamp Gateway

Vulnerabilities Discovered in CIPAce Enterprise Platform

From the Trenches: Relaying Passwords for the Win!

Telesploit: Open-Source Remote Vulnerability Assessment & Penetration Testing

Authentication Bypass Vulnerability Discovered in Infinias eIDC32 WebServer

The Best Online Security Courses to Take in Your Downtime

Phishing Attacks: Beware of Online Financial Scams

CRITICALSTART’s TEAMARES Research Is Aiding Global Fight Against COVID-19

Regex Revelry

Vulnerabilities Discovered in Tiff Server from AquaForest

State Legislation May Drive Federal Security Compliance Regulations in 2020