Tenable Blog

In Season 2 Episode 6 of Mr. Robot, Darlene and Angela continue with infiltration of the FBI and E-Corp, while Elliot is otherwise detained. Because Angela must plant the femtocell in E-Corp, members of F-Society help her learn the commands that are needed. They also offer an alternative called a “Rubber Ducky,” a USB device that registers itself as a Human Interface Device (HID) or keyboard. Since all systems trust HIDs, they are able to bypass policies that don’t allow USB storage devices. However, the infiltration plan is executed as planned with the femtocell device.

Moving beyond periodic certification of information systems to the Risk Management Framework requires standardizing and automating the assessment process.

Making decisions based on outdated information is a recipe for failure. No matter how good the data at the time it is collected, if it cannot be used quickly it loses its value for making critical cybersecurity decisions.

The Black Hat conference is one of the most fun and dynamic security conferences all year. Infosec analysts, hackers, researchers, pen-testers, practitioners and vendors all come together to challenge each other, to learn new techniques, and to renew friendships. If you missed the 2016 conference, held in Las Vegas July 30-August 4, Tenable’s Cris Thomas (aka Space Rogue) shares his observations on hot topics, trends, and news.

In Mr. Robot Season 2 Episode 4, as Darlene and Elliot watch a horror movie, Darlene suggests calling a dinner delivery service called Postmates - a service she hacked using code injection. As they chat, Elliot recalls his previous job. He remembers the details of his pen testing projects, and says it was his job to keep hacking until the company’s systems were “hacker proof.” I asked myself, what is “hacker proof” and is such a thing even possible?

Traditionally, vulnerability scanning—credentialed and/or non-credentialed—has been predominantly a security compliance exercise driven by regulations (e.g. HIPAA, FFIEC) or industry standards (e.g. PCI). The underlying rationale is that periodic scanning is a basic security hygiene process to identify and prioritize vulnerabilities and to demonstrate that security vulnerabilities are regularly patched or fixed. Most organizations perform quarterly scans, some monthly, some less than that.