In today’s challenging economy, no company can afford to fall victim to cybersecurity trouble like a cyberattack or data breach. Companies can invest in a wide array of cybersecurity solutions to help safeguard their networks and data, but how can they be sure that they’re making the right security choices? Even with a solid investment in cybersecurity, a company could still have dangerous vulnerabilities that cybercriminals can exploit. Enter penetration testing.

Welcome to a new era of network penetration testing powered by vPenTest, an award-winning solution from Vonahi Security. vPenTest is changing the game, making regular penetration testing easy, affordable and highly effective for organizations of all sizes. That’s why vPenTest has been recognized as a top pentesting tool by G2.

On July 21st, Vonahi Security won 1st place against 7 other innovative companies in Channel Program’s monthly Pitch Event. Each company had exactly 7-minutes to pitch their product or service to the channel. Over 450 MSP attendees feasted their eyes on some hot new tech. At the end of each pitch, attendees had about two minutes to fill out a survey and vote for their favorite pitch.

Vonahi Security, as a member of the cybersecurity community committed to the prevention of all forms of harassment within our industry, hereby pledges its support for a workplace and community free from harassment and fear.

I recently discovered that all versions of Windows Server 2012 (but not Server 2012 R2) are affected by a DLL hijacking vulnerability that can be exploited for privilege escalation. Moreover, the flaw can be triggered by a regular user and does not require a system reboot. Sounds like a pretty big deal, right? Well, not according to Microsoft, unfortunately.

During a recent bug hunting binge I discovered my first two vulnerabilities that could be exploited to achieve remote code execution (RCE). No bragging rights were earned though, because finding and exploiting these issues was incredibly straightforward. I’m not humble bragging here (I wish). In fact, the issue underlying both vulnerabilities, which each affect a different content management system (CMS), is very basic and was literally the second thing I checked for.

Remember that high school teacher who was never more than one chapter ahead of their students? Well that is me, in this blog. ¯\_(ツ)_/¯

During a penetration test, it's not an uncommon practice for a penetration tester to launch a password attack against Active Directory. Many times this password attack uses a list of domain user accounts that were enumerated or even just a list of potential domain user accounts that were generated randomly. Many penetration testers will either perform just a single password attack or at least 2-3 attempts, depending on domain's password lockout policy is set to.

Research by Cybersecurity Ventures projects a doubling of the global cost of cybercrime in the 2015-2021 period from $3 trillion to $6 trillion. The escalation of cybercrime is closely related to the rapid expansion of the cyber attack surface. For instance, the total number of Internet users doubled between 2015 and 2018 from 2 billion to 4 billion, and is expected to hit 6 billion by 2022.

With 2019 nearly in the books, this post reflects on a few of the biggest cybersecurity developments of the past year, and on how these trends are likely to shape the industry in the coming year.