Quick Cookie Notification

This site uses cookies, including for analytics, personalization, and advertising purposes. For more information or to change your cookie settings, click here.

If you continue to browse this site without changing your cookie settings, you agree to this use.


View Cookie Policy for full details

Rapid7 Blog

Guillaume Ross  

AUTHOR STATS:

8

From the trenches: Breaches, Stories, Simple Security Solutions - from MacAdmins at PSU

Over the last few months, Jordan Rogers and I have been speaking about the benefits of doing the basics right in information security. Reducing noise, avoiding the waste of precious budget dollars on solutions that will not be used to their fullest, as well as…

Revoking and Pinning Certificate Authorities in Windows

Situations come up relatively frequently where a specific certificate authority, trusted by browsers and operating systems, acts in a way that the users of those products would consider untrustworthy.In the enterprise, with services exposed to the Internet and employees traveling, working from Wi-Fi and…

12 Days of HaXmas: What Home Alone Can Teach About Active Defense

This post is the fourth in the series, "The 12 Days of HaXmas." As you venture from the world of defense, including protecting and monitoring systems, into the realm of active defense, who can be your mentor? Who can make you as cool…

Reduced Annoyances and Increased Security on iOS 9: A Win Win!

Introduction Early this year, I posted an article on iOS Hardening that used animated GIFs to explain most of the recommended settings. Since then, iOS 9 was released, bringing along many new features, including better support for Two-Factor Authentication, as iMessage and FaceTime now work…

Microsoft Attack Surface Analyzer (ASA): It's for defenders too!

Attack Surface Analyzer, a tool made by Microsoft and recommended in their Security Development Lifecycle Design Phase, is meant primarily for software developers to understand the additional attack surface their products add to Windows systems. As defenders, this tool can be very useful. The tool…

Reducing Windows Attack Surface with User Rights Assignment

As we know, attackers leverage legitimate credentials to move through systems, escalate privileges or get access to data.Managing privileged accounts such as administrator accounts, shared accounts and service accounts is a difficult problem to solve.Even if service account passwords are managed securely, they…

Are you really protected against Group Policy Bypass and Remote Code Execution? MS15-011 & MS15-014

In February, Microsoft published two hotfixes to address issues with Group Policies.Microsoft Security Bulletin MS15-011 - CriticalMicrosoft Security Bulletin MS15-014 - ImportantTogether, these patches address the following issues:CVE-2015-0008 MS15-011: Vulnerability in Group Policy Could Allow Remote Code Execution (3000483) | Rapid7CVE-2015-0009 MS15-014: Vulnerability in…

Top 10 list of iOS Security Configuration GIFs you can send your friends and relatives

Easily share these animated iOS Security tips with friends and relatives! While iOS is generally considered to be quite secure, a few configuration items can improve its security. Some changes have very little functionality impact, while others are more visible but probably only needed in…