The paper introduces the case study for attack surface analysis and monitoring with practical application of open-source intelligence (OSINT) methods. The case is based on the perimeters of healthcare organizations and aims to introduce the threat landscape of healthcare industry as well as methods to collect information about entry points and assets on network perimeter. Techniques and tools in this paper are not limited by organization type and can be applied for different network assets to prepare initial information during first stage of penetration testing and red team operations.
Denis Makrushin
Denis Makrushin
Denis is chief technology officer of cybersecurity product line at telecommunications company. He is responsible for product development, defining technology strategy and driving future technical innovation.
Designed the “Application Security Fundamentals” course for Information Security students of my alma mater, I’m giving back and together with my friends from industry cultivate the design thinking of next generation alumni: shift the mindset from problem discovery to solution architecture.
Three years after launching, to increase the impact of this course, we made our lectures open to every Russian-speaking student. Just register yourself using the link from the first comment and wait for the announcement of open lecture tomorrow.
The photo illustrates how a typical class looks like – somewhere with laptop. Grab your device, headset and join!
Security Audit Logging in Microservice-Based Systems: Survey of Architecture Patterns
Service-oriented architecture increases technical abilities of attacker to move laterally and maintain multiple pivot points inside of compromised environment. Microservice-based infrastructure brings more challenges for security architects related to internal event visibility and monitoring.
The research paper published by Alexander Barabanov in “Cybersecurity Issues” provides helpful resources to application and product security architects, software, and operation engineers on existing architecture patterns to implement trustworthy logging and audit process in microservice-based environments. We performed threat modeling for typical architecture pattern of logging system, defined threat mitigation strategy, and, as a result, provided bunch of high-level security requirements for audit logging system.
Что общего между инвестированием и кибер-безопасностью? Риски.
Организованной толпой с Chief-друзьями из Positive Technologies и Kaspersky, под пристальным вниманием здвездного продюсера Павла Кушелева, мы обсуждаем тренды на сложных технологичесих рынках ИТ и кибер-безопасности, рассказываем о своих стратегиях инвестирования и управления рисками. Простым и понятным языком.
Запилили уже 4 выпуска подкаста “IT’s Positive Investing” и сложили их в Apple Podcasts и Яндекс Подкасты.