Showing 109–120 of 121 articles
Page 10 of 11
Web shells: remove the attacker’s access, not just one file
An unexpected server-side script may provide an attacker with continuing access. Removing that file is only one step; you also need to understand how it arrived and what else changed.
Read the visual guide
Ransomware entry points: close access before encryption begins
Ransomware response starts before files are encrypted. Compromised identities, exposed remote services, malicious messages, and vulnerable software can each provide an entry path.
Read the visual guide
Business email compromise: verify bank changes before paying
A convincing invoice can arrive from a real but compromised mailbox. Protect the payment decision with independent verification of changes to the beneficiary or account details.
Read the visual guide
Phishing beyond the email filter: verify the request, not the badge
An email that passes technical checks can still ask you to do something harmful. A trusted sender’s account may be compromised, and a plausible message may lead to an unsafe action.
Read the visual guide
TLS checks: protect the connection all the way to the service
A valid certificate at the public edge is only part of a secure connection. Review protocol settings, hostname validation, internal hops, and the origin that ultimately handles the request.
Read the visual guide
Cloud IAM escalation: when a small permission becomes admin access
A role can gain power indirectly by changing another identity, passing a privileged role, or altering a workload. Review what permissions make possible together, not only their individual names.
Read the visual guide
Public cloud storage: find exposed files and close access safely
A storage service can encrypt its data and still make it public. Review the paths to the files: identities, bucket or container policies, shared links, and any public delivery layer.
Read the visual guide
API business-logic abuse: valid requests can still cause harm
An API request can be correctly formatted and still misuse a workflow. Review the business outcome, especially repeated actions, ownership checks, and limits that span several requests.
Read the visual guide
Broken access control: can one user reach another user’s data?
Being signed in should not give a person access to every record. The server must check permission for the specific object and action on every request.
Read the visual guide
Stolen session cookies: why a password reset may not end access
A session cookie can let a browser continue using an account after sign-in. If a session is stolen, changing the password may not revoke every active session or connected application.
Read the visual guide
MFA push fatigue: what to do with unexpected approval requests
Repeated sign-in prompts can pressure someone into approving access they did not start. Treat an unexpected approval request as a signal to stop, verify, and investigate.
Read the visual guide
Stolen passwords: stop credential stuffing across every login route
An attacker can reuse a stolen password through more than the main sign-in page. Review mobile APIs, legacy access, and recovery routes alongside the login form.
Read the visual guide