Articles In Security

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Documenting Data Flows: Navigating the Maze of Cybersecurity with Pac-Man In the world of cybersecurity, documenting data flows is as essential as navigating through a complex maze. Much like Pac-Man, the beloved arcade game character who zips around collecting dots and avoiding ghosts, organizations must meticulously track and understand the pathways that their data takes. This process is encapsulated in C... read more.

• April 29, 2025

By Bert Amodol, Posted in Security

When most individuals think about hacking, they often envision someone in a hoodie typing intensely in a dark room with green code streaming across the screen. Actual penetration testing is somewhat less cinematic; nevertheless, it remains an intriguing process that requires meticulous planning, extensive knowledge of cybersecurity and cybersecurity tools, and a strategic approach. In this post, we will provide insight into a real-world penetration test conducted for a mid-sized technology company. The det... read more.

• April 23, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Establishing and Maintaining a Data Classification Scheme: The "Sorting Hat" of Cybersecurity If you are a Harry Potter fan, you know the Sorting Hat plays a pivotal role in determining the future of young witches and wizards by categorizing them into one of the four Hogwarts houses: Gryffindor, Hufflepuff, Ravenclaw, or Slytherin. You probably also know which Hogwarts house you want to be in. This classifi... read more.

• April 22, 2025

By Ken Phelan, Posted in Security

I spent some time with the CrowdStrike team last month going through their annual Global Threat Report. If you haven’t seen it, please do. This should be required reading for every cyber operator - https://go.crowdstrike.com/2025-global-threat-report.html 79 is the percentage of breaches that occurred without malware. Hence the much-used quote, “hackers don’t break in, they log in.” For years a quick explanation of cyber-attacks read as follows: Software has vulnerabilities. Ha... read more.

• April 10, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Safeguarding your software ecosystem is crucial, and ensuring only authorized libraries are used is like assembling a trusted team of superheroes. CIS Safeguard 2.6: Allowlist Authorized Libraries epitomizes the meticulous selection process of the Avengers’ roster in the Marvel Universe. The Avengers' Assembly Just as Nick Fury carefully selects each Avenger based on their abilities and trustworthine... read more.

• January 28, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Ensuring that only trusted software can run on your systems is like casting a powerful spell to ward off dark forces. CIS Safeguard 2.5, "Allowlist Authorized Software," is akin to the protective enchantments used at Hogwarts School of Witchcraft and Wizardry to keep out dark magic. The Sorting Hat of Software Think of the allowlist as the Sorting Hat at Hogwarts. Just as the hat sorts students into houses... read more.

• January 21, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Keeping an accurate and up-to-date inventory of software is essential. CIS Safeguard 2.4, "Utilize Automated Software Inventory Tools," ensures that this task is handled with the precision and efficiency reminiscent of Tony Stark's (a.k.a. Iron Man) technological prowess from the Marvel Universe. Stark's Inventory Management Imagine Tony Stark, surrounded by his multitude of Iron Man suits and high-tech ga... read more.

• January 14, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation Keeping tabs on every device connected to your network is crucial for maintaining security and functionality. CIS Safeguard 1.4, "Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory," helps achieve this with the meticulous accuracy of Hermione Granger from the Harry Potter series. The Hermione of Networks Much like Hermione Granger, known for her encyclopedic knowled... read more.

• January 07, 2025

By Steve Gold, Posted in Security

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation In the world of cybersecurity, staying ahead of threats requires more than just vigilance; it demands a keen eye for detail and an ability to uncover hidden assets. This is where CIS Safeguard 1.3, "Utilize an Active Discovery Tool," comes into play, much like the legendary detective Sherlock Holmes. The Case of the Missing Assets Imagine Sherlock Holmes, with his magnifying glass in hand, meticulously sca... read more.

• December 17, 2024

By Steve Gold, Posted in Security

Well, that’s a wrap! Bryon Singh and I published a blog on all 56 cyber defense safeguards from CIS Critical Security Controls Implementation Group 1. These 56 safeguards are considered “essential cyber hygiene” for every organization. CIS recommends these safeguards as what every enterprise should apply to defend against the most common attacks. Transitioning from CIS Controls IG1 to IG2 Building a strong foundation with CIS Controls Implementation Group 1 (IG1) is just the beginning of... read more.

• December 10, 2024