Here we identify 4 practical steps SMEs can plan for and implement when they become a victim of a website hack. With the massive growth in cyber-crime, itâs a sad fact that itâs highly likely to become a question of âwhenâ rather than âifâ. Below…
Defence in Depth â Final Part â Update software, Isolate services
Update software and components Whether itâs a serverâs operating system, a web server, a database server or even a client-side JavaScript library, an application should not be running software with known vulnerabilities. Updating, removing or replacing software or components with known vulnerabilities sounds obvious, but…
Defence in Depth â Part 4 – Validate everything, Parameterize SQL queries
Trust no one, validate everything Unfortunately, most vulnerabilities at the application layer canât simply be patched by applying an update. In order to fix web application vulnerabilities, software engineers often need to correct mistakes within the application code. Itâs therefore ideal for software engineers to…
New Invicti update includes security checks for Joomla! Core RCE, improved XXE tests and more
New updates have been released that test for a new Joomla! remote code execution vulnerability affecting versions 1.5.0 through 3.4.5 CVE-2015-8562. Other updates also include improved XML External Entity (XXE) testing, multiple Cross-site Scripting tests in commonly used libraries and other improvements/bug fixes. Below is the…
Webroot report shows SMBs unprepared to counter cyber security attacks
A number of big name retailers, insurance providers and companies have hit the headlines with their cyber attacks and data breaches over the last year or two. But what about the small and medium businesses? Thereâs no doubt they have their own security incidents but…
In the headlines: Mr Grey hacker, Vtech hack, US government office hack and more
FBI hunting âMr Greyâ hacker and his 1.2 billion stolen logins In a massive botnet operation which stole data from over 420,000 websites, the FBI are now zoning in on one member of a Russian crime ring known as âCyberVorâ, with their target being known…
Defence in Depth – Part 3 – The Least Privilege Principle
An application does not need to use the root (MySQL), sa (Microsoft SQL Server), postgres (PostgreSQL) or SYSDBA (Oracle Database) to connect to the database. Likewise, itâs a bad idea to run daemons or services as root (Linux) or Administrator (Microsoft Windows), unless there is…
Highlights from Security Leaders in Sao Paulo
Sunlit Technologies the Invicti distributor for Brazil, exhibited at the 6th edition of Security Leaders in Sao Paulo on 18th and 19th November 2015, at FecomĂŠrcio / SP – Rua Doutor Plinio Barreto, 285 – Sao Paulo. Since 2010, Security Leaders and the Brazilian IT market have been following a…
Takeaways from the VTech Hack, and the Vigilante Side of Security Breaches
Anyone following the news this week likely learned of the massive breach exposing the personal data of millions of parents and their children. VTech, a Hong Kong-based toy maker was hacked, exposing everything from childrenâs names and home addresses, to pictures (reportedly, 190GB worth of…