Blog Home

SecurityTrails Blog

Why Not to Set Domains to Private IPs.
SecurityTrails Blog · Jan 21 · by Gianni Perez

Why Not to Set Domains to Private IPs

“An ounce of prevention is worth a pound of cure.” ― Benjamin Franklin The concept of risk is ubiquitous across the cybersecurity landscape. In this day and age, it is difficult to envision any security-conscious organization not having alluded, hopefully more than once, to the serious consequences attached to avoiding the subject, particularly when it comes to protecting its most sensitive digital assets and personal data.

Attack Surface Monitoring: Definition, Benefits and Best Practices.
SecurityTrails Blog · Jan 19 · by Sara Jelen

Attack Surface Monitoring: Definition, Benefits and Best Practices

The firewall, IDSs, EDR platforms and proxies are your first line of defence. They’re the locks to your entire network, and your scanners are the security cameras that allow you to see what goes on inside. And while these security controls traditionally help to achieve a decent security posture, the threat landscape is rapidly and constantly changing—along with your attack surface.

Top 5 Tips for Securing Your Dev & Test Environments, and Why You Should.
SecurityTrails Blog · Jan 07 · by Gianni Perez

Top 5 Tips for Securing Your Dev & Test Environments, and Why You Should

In his seminal work, The Mythical Man-Month, Frederick Brooks Jr. tells us that software development is homologous to a tar pit where many efforts flounder regardless of the appealing nature of the task or the relative tractability of the underlying physical medium. In what he calls one of the “woes of the craft”, the author goes on to explain that the pervasive optimism among programmers regarding the conception of a software project is rarely maintained after we take into account the set of complex interdependencies commensurate with others’ skills and objectives.

Infrastructure as Code: Is It as Secure as It Seems?.
SecurityTrails Blog · Dec 30 2020 · by Esteban Borges

Infrastructure as Code: Is It as Secure as It Seems?

Alongside the rise of public clouds, managing the infrastructure of private clouds has never been easier. Tools like Terraform are available, but increasing dependence on them means it’s necessary to understand the security implications they present. After all, your entire infrastructure is dependent on, and accessible through, such a configuration—it’s essentially infrastructure as code, or “IAC”, passed through a tool like Terraform.

JARM: A Solid Fingerprinting Tool for Detecting Malicious Servers.
SecurityTrails Blog · Dec 23 2020 · by Gianni Perez

JARM: A Solid Fingerprinting Tool for Detecting Malicious Servers

The literature on defensive security unanimously recognizes one fact: every so often, a tool comes out that provides blue teamers with an important advantage over their adversaries. This ever-elusive quest features essential requirements and commonalities, such as the ability to proactively seek and detect malicious hosts, or the capacity to swiftly respond to targeted network threats. And with a sharp rise in the number of incidents involving some form of malware or command and control (C2) activity resulting in data theft, vendors are in a tight race to gain their customers’ trust—by leveraging newer alternatives to legacy solutions amidst shrinking budgets.