SEGA: subscriber data and permission to send
A newsletter platform holds subscriber data and the ability to communicate under a brand’s name. The SEGA and ARARA case helps businesses test these two responsibilities with separate evidence.
Blog
Практические руководства по пентесту, исследованию уязвимостей и инструментам безопасности на базе ИИ.
Статьи публикуются на английском и португальском языках.
Другие статьи
135 публикаций
Baker Tilly: connect the notice to the affected dataset
An incident notice needs to be connected to the datasets a business actually shares. A documented reconciliation helps establish what to investigate and who owns the next decision.
ScreenConnect: separate containment from support recovery
Interrupted support needs to return through a path the team can validate. This workflow organizes the decision across the provider, technician device and customer environment.
United: who authorizes the agent’s action at its destination?
Permission given to an assistant needs to be checked against the rules of the service receiving its action. Use the United case to review destinations, intermediaries and evidence in enterprise agent workflows.
Maersk: map the legacy system and its integrations
An inherited application needs its own incident response boundary. The map should connect its origin, business workflows and integrations that remain active.
BroadWorks: what to ask your provider beyond “updated”
A platform-wide response can hide outstanding components. Connect each BroadWorks service to its owner, installed version and telephony continuity test.
MCP: compare dependencies across two restarts
A fixed server version can conceal changes in transitive dependencies. Compare the environment actually installed before accepting the next startup.
BluePhishing: trace the agents created after consent
One consent decision can start a family of agent identities. An assessment should trace what was authorized and what those identities can actually execute.
AntiFox and AWS: find successful calls among the denials
A sequence dominated by denied requests can still contain consequential access. Organize the investigation by identity, operation and resource before deciding what the available records establish.
Grok: decide who may use each published app function
An app built with AI can look internal while remaining accessible outside the company. Define its permitted audience and check each operation before putting real data into the workflow.