A general DevSecOps lifecycle can be outlined with key activities integrated into an Agile development framework. Here’s a broad overview: Plan and Design: This phase involves planning the development process, including security considerations. Security requirements are identified, and threat modeling may be performed …

Read More

In a DevSecOps environment, several types of security professionals are typically involved to ensure a comprehensive approach to security. These may include: Security Engineers/Analysts: They focus on designing, implementing, and maintaining security measures within the DevSecOps pipeline. Application Security …

Read More

To check the status of the Windows firewall with PowerShell, type the following: $FWProfiles = (Get-NetFirewallProfile); Write-Host "Windows Firewall Profile Statuses" -Foregroundcolor Yellow; $FWProfiles | %{ If($.Enabled -eq 1){ Write-Host "The Windows Firewall $($.Name) profile is enabled" -Foregroundcolor Green …

Read More

Make sure to execute these command from an Elevated Prompt! ** Add a startup key as additional authentication method: Adds a TPM and startup key protector for the operating system drive C:. The generated startup key will be stored on the removable drive E:. The effect of this command is that the removable drive on …

Read More

On Wednesday 3 October 2018 the Apache Software Foundation has released information about an Open Redirect vulnerability in Apache Struts 2. The vulnerability received identifier CVE-2018-11784. The vulnerability announcements describes the vulnerability as follows: When the default servlet returned a redirect to a …

Read More

A security vulnerability exists in the firmware of certain Infineon Trusted Platform Module (TPM) chipsets. The vulnerability weakens key strength. It is weakened so much that it is possible to derive the private key from the public key for RSA key pairs of up to 2048-bit. This page contains a number of manners in …

Read More

When running the WSUS Server Cleanup Wizard from the MMC snap-in, it can occur that you receive the following WSUS database error: Error: Database Error An error occurred when trying to perform a database operation. This can happen if the database is very busy, if the database service is stopped, if the connection to …

Read More

With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. This vulnerability has been assigned CVE-2017-0143. The vulnerability is also often nicknamed EternalBlue. This page explains how you can scan for it from a Windows machine using nmap. The …

Read More

On March 6, 2017, Apache disclosed a vulnerability in the Jakarta multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on the targeted system using a crafted Content-Type header value. This vulnerability has been assigned CVE-ID CVE-2017-5638. This page explains how you can …

Read More

In the AutoIt scripting language it is possible to hash data using the _Crypt_HashData() function. The hashing functionality is however limited to the MD2, MD4, MD5, and SHA1. Computers running Windows XP SP3 or higher also have support for the newer SHA2 hashing functions, being SHA256, SHA384, and SHA512.
If you …

Read More