NetScaler high availability: did remediation reach both sides?
Updating the appliance serving traffic is part of the work. Review needs to demonstrate what happens when the second member takes over.
Blog
Практические руководства по пентесту, исследованию уязвимостей и инструментам безопасности на базе ИИ.
Статьи публикуются на английском и португальском языках.
Исследования
135 публикаций
Carbonato: does permission to create containers reach the host?
Publishing an image and administering its execution are different powers. Follow the identity creating a workload and the capabilities that workload receives.
JadePuffer in Azure: who can delete what recovery depends on?
A copy helps only when the business can preserve and use it. Connect the power to delete resources with the access required to recover a service.
FortiBleed: who can recover administrative control of a firewall?
The device controlling entry also needs a recovery plan. Review who can act when the usual administration path stops working.
The Mabna case: following academic accounts into digital libraries
An academic account can reach services administered by different organizations. Assessment needs to follow that path and identify where each permission ends.
Research partnerships: connect funding decisions with access
A contract may identify who funds a project without showing who can access its results. Follow funding, deliverables and permissions throughout the partnership.
Warlock and SharePoint: who can distribute changes across the network?
Securing the entry server and controlling a distributed change are complementary tasks. Follow who authorizes each stage and who confirms its outcome.
After an invoicing incident: who can change where a payment goes?
Knowing an invoice does not establish authority to change its receiving account. Review how a request is confirmed, approved and executed.
The key changed hands. What about the company car’s digital access?
Returning a physical key may leave accounts and histories associated with the vehicle. Define who may view information and how to verify that an association has ended.