• 28 Feb 2024

    3 resources to help with the SEC’s cybersecurity ruling on incident reporting

    There's been a lot of buzz in recent months regarding the new US Securities and Exchange Commission (SEC) cybersecurity ruling involving incident resporting. Check out the following resources I created for the folks at web application and API vulnerability scanning vendor Probely. We help you cut through the noise and understand what really matters in the context of incident reporting/response and, especially, its impact on overall application security. SEC Cybersecurity ...

    Continue Reading...
  • 10 Nov 2023

    Too many people, too many policies, too much busy work! Security has to wait…

    Busy, busy, busy...That's what everyone working in and around IT/security seems to be these days. Ditto for the average user. So many things to do and not enough time to do them. It appears that everyone is completely overwhelmed with work, putting out fires, rather than focusing on  productive work that moves the business forward. But is this really the case? Based on studies I've seen and things I witnessed ...

    Continue Reading...
  • 27 Aug 2023

    Cybersecurity All-In-One For Dummies – a new book my vulnerability and penetration testing content is featured in

    I was recently surprised to find out about this new book - Cybersecurity All-In-One For Dummies - that much of my Hacking For Dummies content is featured in. The following chapters from my book are included: Introduction to Vulnerability and Penetration Testing Cracking the Hacker Mindset Developing Your Security Testing Plan Hacking methodology Information Gathering Social Engineering Physical Security With all the other content included, this book is a very ...

    Continue Reading...
  • 10 Aug 2023

    The tautology of “Russian hacking” + why you can’t believe everything you hear/read

    Remember back in 2017/18 during the rise of the Trump regime, when the media kept repeating over and over and over again how the Russians were meddling in the election? It was convenient for them to talk about this so-called "Russian hacking" because those who control the messaging understand the average person knows very little about hacking. Interestingly, I happened to be writing a book of mine at the time ...

    Continue Reading...
  • 11 Jul 2023

    My health story is a reminder that we need to rely on the right experts

    I'm back! After quite the hiatus dealing with a rare health condition, I'm coming back to life and getting better every day! My story is quite complicated...I'm currently writing a book on the whole situation and I will share that here once it's out. Briefly...I've been dealing with debilitating neck issues, namely something called cervical instability that led to a rare condition called Eagle syndrome. My surgeon did a documentary ...

    Continue Reading...
  • 27 Apr 2022

    It’s here! Hacking For Dummies, 7th edition

    Hot off the press, the latest (7th) edition of my best-selling book on security vulnerability and penetration testing, Hacking For Dummies, is here! Hacking For Dummies is one of the oldest and most successful books on information and computer security and, as of 2019, it has been translated into 9 different languages. Who would've thought all the blood, sweat, and tears that I put in to the first edition of ...

    Continue Reading...
  • 18 Apr 2022

    Is it safe to give out your CISSP number?

    I recently had someone contact me claiming he needed to validate my CISSP certification for a client of mine via the (ISC)² verification page. Apparently, this validation was needed for an audit he was doing. He said the Credly badge (ISC)² offers that I have on my website was not good enough without him having to perform a "risk assessment" on that company. 🙄 I wasn't comfortable giving out my ...

    Continue Reading...
  • 22 Mar 2022

    Security assessment interviews/questionnaires versus reality

    Not long ago, I performed what I call a security operations review where I asked various questions about how IT and security are managed within an organization I was working with. One of the topics was on patching and vulnerability management. I got a lot of good information, including specific details on how Windows, macOS, and even third-party patches are taken care of. Everything sounded great and I expected to ...

    Continue Reading...
  • 16 Feb 2022

    Macs are secure…no need to test them?? You might want to rethink that approach.

    Macs are secure! Right...? They don't really need to be tested...including them in an overall vulnerability management program is likely overkill. It's an age-old philosophy coming from those who need some enlightenment...perhaps get caught up on their reading. The next time someone tells you that macOS is secure, respectfully push back and ask: How do you know? Here's a screenshot of the Tenable.io findings from just one scan of a ...

    Continue Reading...
  • 22 Oct 2021

    Veracode’s secure code training – a possible boost to your developer & security staff

    Something I found about not long ago is that Veracode is now offering a 114 day free trial of their Security Labs Enterprise appsec training program. Given the importance of application security and, especially, the big application security challenges I'm seeing in my work, this could be something beneficial for you and your team. Here's the link: https://info.veracode.com/security-labs-free-trial.html Hope this helps!...

    Continue Reading...