After a security audit, you have been notified flaws. Critical, important, medium: do you know how this is assessed? We describe here our methodology, based on the OWASP* one, to estimate the severity of the risks associated with the vulnerability.

Phishing evolved a lot. Whereas fraudulent email was before easily detected by its obvious spelling mistakes and its exaggerated request or threats (immediate bank transfer, account completely deleted…), it uses nowadays codes of trusted institutions. Phishing email involves besides personalized demand or known contacts of the attacked person (a manager for example), which makes it hard to detect.

Phishing aims an interaction with a tricked email. It is the most used method in social engineering, a branch of cybercrime.
Social engineering targets human behaviour. Its purpose is to lead a user to reveal confidential information and to realise harmful actions for themselves or for an organisation the user belongs to. You can raise awareness of your team about this risk by conducting a social engineering audit. 

We will see in this article how to avoid different phishing strategies, which can be tricky even for experienced and attentive users.

[Article updated on November 8, 2022]

Have you used google dorks today? If you have searched for a word within quotes or combined two terms with AND, then the answer is yes.

Googles dorks are advanced search operators that allow you to better target your research.

They can even enable to identify vulnerabilities and strengthen your security, let’s see how.

Do you usually conduct application testing before releasing? In this article you will find out why conducting outsourced penetration testing can strongly strengthen your application security level and your brand image.

The need for web application firewalls

If you don’t perfectly see the difference between a firewall and a web application firewall, I recommend you read this article we published a few weeks ago, explaining the differences: Traditional Firewalls or Web Application Firewalls?
The reality of threats makes web application firewalls a real complementary approach to secure coding practices and security testing.
Global protection against known (and unknown) attacks, virtual patching and security events reporting are real added values.

Traditional firewalls protect IT environments against external attacks, by allowing and blocking connections to certain areas.

These firewalls control incoming and outgoing network traffic, based on a set of rules.

Here is a basic example:
Let’s suppose your company has a web server inside its infrastructure. In order for the web server to be reachable from outside your company, some rules will have to be established to authorize web traffic to and from that server.
Some “ports” will be open, on a given IP address (the one of your server).
Your company can choose to allow web traffic only, or allow other traffic according to its needs.

Some years ago this was a common question: should I conduct a pentest on my website? Today the real question is: how often should I conduct a pentest? This does not only apply to websites but more generally to all applications and software developed with web technologies. Although systems and servers also need security, in this article we will only focus on the application layer, which usually faces a lack of awareness regarding to its breaches.

Web Application Firewalls (commonly referred to as WAF) are mainly designed to protect web applications.
But what exact roles can they play in a web architecture?
Depending on how they are integrated in your web platform, their impact and ability to improve your security will differ.

Using a WAF as an attack mitigation solution

A WAF can be used to analyse inbound and outbound traffic in order to block malicious or dangerous items.

In this configuration, the threat detection engine of the firewall detects suspicious inbound traffic and decides to block the request. This means that the request will not reach the web server, and a generic response will be returned to the client.
To decide whether a request is innocuous or malicious, the WAF can use a positive or a negative security model:
The negative security model assumes that all transactions are innocuous, by default. It will look for threat cues and if judged dangerous, block the transaction.
The positive security model, on the other hand, assumes that all transactions can be dangerous and only allows those that are recognized as safe.

As cybersecurity issues increase, Web application filters and Web Application Firewalls are becoming more popular. These tools can be an excellent first step towards securing your applications. How do they work? What is the difference between them? Please read the following lines for an introduction of this topic.

Filters or WAF: Who’s who?

The first kind of defense is called “Filtering”. Whether implemented as part of a development framework or implemented by the developer himself, filtering is in the end part of the application.
Of course the efficiency of this protection will depend on the awareness of the developers on security and also on their experience in developing secure applications.

The second type of defense is called WAF (Web Application Firewall). This type of product is not to be confused with “usual firewalls”, in the sense that web application firewalls analyse the web traffic and don’t stop at filtering traffic based on a particular port number, address or protocol.
Web application firewalls can be implemented on the web server itself, or in front of the web server (between the end-user and the web server).

We assume here that your hosting environment is already secure, whether managed by yourself or by a hosting provider.
Let’s focus on the applications. What steps can you take to improve the security of a web application? How to reduce the attack surface and remove easily detectable risks? This article does not pretend to be the manual of the perfect web application defender, but recalls basic principles and presents a list of items to be considered and applied on a regular basis.