Practical content from industry professionals on digital forensics · data recovery · cyber security · KVKK compliance.
BAS is a validation approach that runs known attacker techniques automatically and continuously, measuring whether your defense catches them. The difference between installed and working, how BAS works, a table comparing it with penetration testing and red teaming, what BAS cannot measure, who it suits and common mistakes.
Read moreA physical penetration test measures, under authorization, whether an attacker can physically enter a building, server room or work area. Why physical security matters as much as digital, the areas the test covers, the authorization letter, its combination with social engineering and remediation recommendations.
Read morePTaaS is a continuous, platform based model replacing the once a year classic penetration test. Why classic pentest remains a snapshot, the three components of PTaaS, its difference from an automated scanner, a comparison with classic testing, who it suits and what to watch when choosing it.
Read moreA penetration test report is a decision document, not a technical list. The report sections, what CVSS scores (0 to 10) mean, why CVSS does not know business context, exploitability as the real proof, prioritizing findings with three questions, retesting and the most common mistakes when reading a report.
Read moreSIEM is the software collecting and correlating all logs in an organization, while SOC is the team watching those alerts and responding. The difference between them, SIEM's four stages, the tiered SOC model, the most common mistakes when building them and a comparison of in house SOC versus managed SOC (MSSP).
Read moreMITRE ATT&CK is a free knowledge base cataloguing attacker behaviors observed in real attacks. The tactic and technique distinction, the 14 tactic Enterprise matrix, seeing detection gaps, mapping SIEM rules, the common language for red and blue teams, ATT&CK misconceptions and the Enterprise Mobile ICS matrix variants.
Read moreXSS is when an attacker injects JavaScript into a web page and runs it in other users' browsers. The Stored, Reflected and DOM based types, session theft and account takeover impacts, the definitive solution of output encoding, additional layers such as CSP and HttpOnly, the role of modern frameworks and verification methods.
Read moreSQL injection is when user input mixes into a database query and changes its logic, and it remains one of the most common critical flaws. How it works, the types (classic, blind, time based), the definitive solution of parameterized queries, why hand cleaning is not enough, defense in depth and verification methods.
Read moreThe OWASP Top 10 is a free international reference listing the ten highest risk vulnerability categories in web applications. The full 2021 list, each category explained and defended, why Broken Access Control is first, how to use the OWASP Top 10 and its relationship with compliance standards.
Read moreYARA is a free open source malware identification tool that matches files and memory against patterns and goes beyond hash based detection. The three sections of a rule (meta, strings, condition), the art of writing good rules, the balance between too narrow and too broad, file and memory scanning, reducing false positives and a learning path.
Read moreThe Windows Registry is one of the richest evidence sources in forensics: which USB was plugged in, which program ran, which file was opened. The hive structure and on disk locations, the questions the registry answers, the difference between RegRipper Registry Explorer and RECmd, deleted key recovery, transaction logs and a learning path.
Read moreKAPE is a free triage tool that collects and parses only valuable artifacts from a Windows system within minutes. The difference between triage and full imaging, the Target and Module logic, which artifacts are collected, the relationship with Eric Zimmerman tools, a five step triage flow, evidence integrity rules and a learning path.
Read more