If you don't include Wordpress plugins in your patching cycle it will eventually lead to your site getting hacked.
“... Breaking into an unpatched WordPress installation in under two minutes...”
Thursday, February 1, 2018
Infosec quotes - internal password re-use
I think password re-use risks also apply to internal devices at companies too. If you set multiple servers, databases, devices , service accounts, etc to different accounts but the same password then you're simplifying the attackers life by making it trivial for them to laterally move across your network. Take that extra step and create unique passwords.
“... once fraudsters have managed to guess one password, they’ll have access to your entire online life...”
https://www.thinkmoney.co.uk/news-advice/using-the-same-password-for-multiple-accounts-could-cost-you-0-5849-0.htm
Infosec quotes - upgrade Powershell
Why upgrade Powershell? If nothing else just so your security team can see attacks happening !
“... PowerShell 2.0 ... provides very little evidence of attacker activity ... Microsoft has been taking steps to improve the security transparency of PowerShell in recent versions. The most significant improvements, such as enhanced logging, were released in PowerShell version 5.0 ...”
https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
Infosec quotes - Powershell unrestricted
“... The lowest Execution Policy is Unrestricted, which permits all scripts to run ... If you do choose the Unrestricted setting, and a script comes along and clobbers you ... be prepared to own up to your decision when you're explaining how a virus wiped out your environment...”
https://technet.microsoft.com/en-us/library/2008.01.powershell.aspx
Infosec quotes - password vs encryption
Hard drive encryption is important. Don't disable it. A password does not protect a hard drive that an attacker has physically stole. If he physically holds an unencrypted hard drive he can access its contents.
@gattaca said ““All the stolen $company laptops were password-protected, although not all were encrypted.” < *facepalm*”
https://twitter.com/gattaca/status/958853959099322369
Infosec quotes - flash with active exploits
Patch your Flash player. Even if you don't normally rush to patch, this is a good example where you would want to rush and patch. Critical vuln being actively exploited.
“... allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2018-4878 exists in the wild ... attacks leverage Office documents with embedded malicious Flash content distributed via email...”
https://helpx.adobe.com/security/products/flash-player/apsa18-01.html
Infosec quotes - adaptive phishing
#phishing pages that change the look & feel based on your email address!
“... It grabs the favicon from the email address domain and re-uses it on the fake webpage. This is a simple but cool way to make the webpage more attractive....”
https://isc.sans.edu/forums/diary/23299/
Subscribe to:
Posts (Atom)