domain controller hero image

What is a Domain Controller, When is it Needed + Set Up

A domain controller is a server that responds to authentication requests and verifies users on computer networks. Domains are a hierarchical way of organizing users and computers that work together on the same network. The domain controller keeps all of that data organized and secured. The domain controller (DC) is the box that holds the keys to the kingdom- Active Directory (AD). While attackers have all sorts of tricks to gain elevated access on networks,…

min read 0

Most Popular

GDPR Requirements in Plain English
Master Fileless Malware Penetration Testing!
Active Directory: Difference Between Windows and Azure AD
Top Podcast Episodes

Get the latest security news in your inbox.

GDPR, American-Style: Preview of Proposed Federal US Privacy Law, Part I

GDPR, American-Style: Preview of Proposed Federal US Privacy Law, Part I

The General Data Protection Regulation (GDPR) has, for good reason, received enormous coverage in the business and tech press in 2018. But wait, there’s another seismic privacy shift occurring, and it’s happening here in the US. There is now a very good chance that significant data privacy legislation will come to the US soon. I’ll go out on a limb, and say in 2019. But if not next year, then certainly in 2020. Yes, we’ll…

min read 0
blue and red scale

The Likelihood of a Cyber Attack Compared

While the cost of a cyber attack is often discussed, we seldom hear about just how common these attacks actually are. Numerous security experts believe that a cyber attack or breach of catastrophic proportions is no longer a matter of if, but a matter of when. According to the World Economic Forum’s 2018 Global Risks Report, the top three risks to global stability over the next five years are natural disasters, extreme weather and cyber…

min read 0
CEO vs. CSO Mindsets, Part III: Value at Risk For CSOs

CEO vs. CSO Mindsets, Part III: Value at Risk For CSOs

To convince CEOs and CFOs to invest in data security software, CSOs have to speak their language. As I started describing in the previous post, corporate decision makers spend part of their time envisioning various business scenarios, and assigning a likelihood to each situation. Yeah, the C-level gang is good at poker, and they know all the odds for the business hand they were dealt. For CSOs to get through to the rest of the…

min read 0

For IT Pros Only

Lets be clear: this is for IT people. Not because IT people are better looking and drive cooler cars than the general populace (which is true: most IT departments look like extras from the set of The Fast and Furious), but because unless you're familiar with things like the dark blackness that grips your soul when you discover that two NICs have the same MAC address on your network - you probably aren't going to appreciate this at all.

Get Your Cards Now
min read 0
Data Security
data classification title

What is Data Classification? Guidelines and Process

by  in Data Security
In order to protect your sensitive data, you have to know what it is and where it lives. Data Classification Defined Data classification is the process of analyzing structured or unstructured data and organizing it into categories based on the file type and contents. Data classification is a process of searching files for specific strings of data, like if you wanted to find all references to “Szechuan Sauce” on your network. Or if you needed…
min read 0
Compliance & Regulation
nydfs cybersecurity regulation title and logo for

NYDFS Cybersecurity Regulation in Plain English

by  in Compliance & Regulation
In 2017, the New York State Department of Financial Services (NYDFS) launched GDPR-like cybersecurity regulations for its massive financial industry. Unusual at the state level, this new regulation includes strict requirements for breach reporting and limiting data retention. Like the GDPR, the New York regulation has rules for basic principles of data security, risk assessments, documentation of security policies, and designating a chief information security officer (CISO) to be responsible for the program. Unlike the…
min read 0
Data Security
cybersecurity TED talks

12 TED Talks That Will Change the Way You Look at Business Cybersecurity

by  in Data Security
The cybersecurity landscape is constantly evolving. New security threats pop up daily, and threat actors can be an employee in the next cubicle or a blackhat hacker in a coffee shop in Bangkok. Additionally, cybersecurity has real-world implications that reach far beyond the boardroom — everything from Internet-connected teddy bears to the stability of world governments is impacted by cyber. As such, it’s more important than ever that everyone in your organization is up to…
min read 0
IT Pros

Koadic: Security Defense in the Age of LoL Malware, Part IV

by  in IT Pros
One of the advantages of examining the gears inside Koadic is that you gain low-level knowledge into how real-world attacks are accomplished. Pen testing tools allow you to explore how hackers move around or pivot once inside a victim’s system, and help you gain insights into effective defensive measures. Block that Hash Passing Pass the Hash (PtH) is one approach, not the only, for moving beyond the initial entry point in the targeted system. It’s…
min read 0
Data Security
powershell vs cmd hero

Windows PowerShell vs. CMD: What’s The Difference?

by  in Data Security
Back in the day, booting the then-cutting-edge IBM 8086 from the floppy brought you to a green text screen with a cursor blinking at the familiar C:\> prompt. Hacking boot.ini and config.sys to get my games to run was my first introduction to programming. Eventually that C:\> got replaced with a pretty GUI and boot from hard disk. That command prompt (CMD) still lived on for decades. Only recently did CMD get an upgrade, or…
min read 0
Data Security

Zero-Day Vulnerability Explained

by  in Data Security
A zero-day vulnerability is a software bug or exploit that hasn’t been patched. It’s like a hole in the bottom of your shoe that you haven’t noticed yet, but a curly-mustachioed villain has found it and is considering putting rusty nails on your gas pedal. Hackers can use these bugs and exploits to steal your data before you’re able to find and patch the weakness. What are Vulnerabilities? Vulnerabilities allow attackers to slip past your…
min read 0
Data Security

California Consumer Privacy Act (CCPA) vs. GDPR

by  in Data Security
Data privacy laws are fast becoming a primary element in any data security conversation: from the EU’s GDPR to the California Consumer Privacy Act to Japan’s Act on the Protection of Personal Information, the ability to protect consumer data is top of mind. For companies that are built around consumer data, consumer trust becomes a vital part of their business model. On May 25, 2018, the EU General Data Protection Regulation (GDPR) went into effect.…
min read 0
C-Level

CEO vs. CSO Mindsets, Part II: Breach Risk, Security Investment, and Thinki...

by  in C-Level
In the last post, I brought up the cultural differences between CEOs and CSOs. One group is managing and growing the business, using spreadsheets to game plan various money making scenarios. The other is keeping the IT infrastructure going 24/7, and studying network diagrams while tweaking PowerShell scripts. I think you know which is which. The point of this series is to bridge the divide between these two different tribes. In this post, I’ll be…
min read 0
Compliance & Regulation

How Varonis Helps with the California Consumer Privacy Act (CCPA)

by  in Compliance & Regulation
The California Consumer Privacy Act (CCPA) is set to go into effect on January 1, 2020. It not only gives ownership and control of personal data back to the consumer but holds companies accountable for protecting that data. What is the California Consumer Privacy Act? The CCPA gives California residents four basic rights in relation to how companies collect and store their personal information: Transparency: the right to know what personal information a company is…
min read 0
Data Security
ids vs ips

IDS vs. IPS: What is the Difference?

by  in Data Security
Intrusion Detection Systems (IDS) analyze network traffic for signatures that match known cyberattacks. Intrusion Prevention Systems (IPS) also analyzes packets, but can also stop the packet from being delivered based on what kind of attacks it detects — helping stop the attack. How Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) Work Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are both parts of the network infrastructure. IDS/IPS compare network packets to a…
min read 0
Data Security

Koadic: Implants and Pen Testing Wisdom, Part III

by  in Data Security
One of the benefits of working with Koadic is that you too can try your hand at making enhancements. The Python environment with its nicely organized directory structures lends itself to being tweaked. And if you want to take the ultimate jump, you can add your own implants. The way to think about Koadic is that it’s a C2 server that lets you deliver JavaScript malware implants to the target and then interact with them from…
min read 0
Data Security
Brute Force Attack

What is a Brute Force Attack?

by  in Data Security
A brute force attack (also known as brute force cracking) is the cyberattack equivalent of trying every key on your key ring, and eventually finding the right one. 5% of confirmed data breach incidents in 2017 stemmed from brute force attacks. Brute force attacks are simple and reliable. Attackers let a computer do the work – trying different combinations of usernames and passwords, for example – until they find one that works. Catching and neutralizing…