• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

War Room

Shells from above

RSM logo

  • Home
  • About
  • Blog
  • Talks/Whitepapers
  • Tools
  • Recreation

Defense

The State of Ransomware

July 8, 2021 By AJ Hammond

Ransomware as a concept isn’t exactly bleeding edge. For years, cybercriminals have been using ransomware along with a variety of different attack vectors to compromise companies both big and small around the globe.   What is new, however, is the recent uptick in the quantity and frequency of ransomware-based attacks. According to Verizon's 2021 Data Breach Investigations ... READ MORE

Mapping Government Cybersecurity Initiatives to the NIST CSF

June 21, 2021 By Jonathan Slusar

On May 12, 2021, a press release was released by the Biden Administration regarding intentions to improve the nation’s cybersecurity and protections for federal government networks. The press release cites recent incidents (e.g. SolarWinds and the recent Colonial Pipeline ransomware incident) as reminders that cybersecurity threats are constantly evolving. More recently, there ... READ MORE

Mass Mailing Attack from NOBELIUM

June 1, 2021 By Ken Smith

On May 25, 2021, the campaign escalated as NOBELIUM, the same group behind the 2020 SolarWinds attacks, leveraged the legitimate mass-mailing service, Constant Contact, to masquerade as a US-based development organization and distribute malicious URLs to a wide variety of organizations and industry verticals. Using the legitimate mass mailing service Constant Contact, NOBELIUM ... READ MORE

Combating Ransomware for Tomorrow – The Other Pandemic

May 13, 2021 By Todd Willoughby

Another year and another record topping year of even higher ransomware payments; something has to change if we want this to get any better. Some stats first: 51% of all businesses in 2020 were targets of ransomware Overall 40% surge in global ransomware hits in 2020 Average ransomware payments in Q3 of 2020 were over $233,000. A new 2021 report shows that average is up ... READ MORE

Microsoft Exchange – CVE-2021-26855+

March 5, 2021 By Luke Emrich

On March 2, 2021, Microsoft released several security updates to address at least seven critical vulnerabilities in supported versions of on-premise Microsoft Exchange Server. These vulnerabilities were observed being used in limited targeted attacks; however, due to the critical nature and publication of these vulnerabilities, Microsoft released guidance that all customers ... READ MORE

How to have effective Enterprise Identity & Access Management (EIAM)

January 18, 2021 By Erik Kuhrman

Your business operations can be complex and require multiple technologies such as applications, platforms, services and infrastructure. Effectively overseeing and controlling who has access to what across this landscape can be a daunting challenge. Unfortunately, there are numerous horror stories of failed IAM projects and many companies continue to struggle with effective IAM ... READ MORE

Building a Lab Network – Faux Corporate Networks

August 18, 2020 By Ken Smith

Last month, I mentioned the possibility of setting up a second virtual firewall in a lab environment to simulate a corporate network with mock internal and external spaces. I frequently do this for CTFs, student pentesting projects, and more. Offensive security training is rapidly moving towards realistic environments. Organizations like HackTheBox which historically have ... READ MORE

Building a Lab Network in Proxmox and Sophos UTM9

July 13, 2020 By Ken Smith

One of the best ways to acquire and maintain an offensive security skill set is to build a home lab and populate it with intentionally vulnerable machines. The most straightforward option is to simply spin up VMs in VirtualBox or VMWare Player and manage everything locally. To take things to the next level, however, you really need a hypervisor like ESXi or Proxmox. Nowadays, ... READ MORE

Using EDR as an Incident Response Tool

June 9, 2020 By Zack Doyle

What is EDR? Endpoint detection and response (EDR) has been a buzzword in the world of cybersecurity for the last couple years, but what does that really mean? EDR tools are designed to continuously monitor systems for anomalous or malicious activity. A monitoring agent runs in the background, ideally on every endpoint in the environment, and the end user experiences little ... READ MORE

COVID-19 and Palo Alto’s GlobalProtect

March 13, 2020 By Tim Lambes

With the recent issues involving COVID-19, and the recent closure announcements of college campuses, organizations are beginning to review their capacity to support a larger than normal remote workforce. In the event an office closing, is your organization prepared to support the influx of users attempting to gain access to the corporate network remotely. Can your organization ... READ MORE

  • « Go to Previous Page
  • Go to page 1
  • Go to page 2
  • Go to page 3
  • Go to page 4
  • Go to page 5
  • Go to Next Page »

Primary Sidebar

Categories

  • Defense
  • Forensics
  • Offense
  • Physical
  • R&D

Most Viewed Posts

  • DLL Injection Part 1: SetWindowsHookEx 10.8k views
  • Sophos UTM Home Edition – 3 – The Setup 10.8k views
  • Leveraging MS16-032 with PowerShell Empire 10k views
  • Bypassing Gmail’s Malicious Macro Signatures 9.8k views
  • How to Bypass SEP with Admin Access 8.9k views

Footer

  • RSS
  • Twitter
  • Tools
  • About
  • RSM US LLP

+1 800 903 6264

1 S Wacker Dr Suite 800
Chicago, IL 60606

Copyright © 2023 RSM US LLP. All rights reserved. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit for more information regarding RSM US LLP and RSM International.