James Berthoty’s Post

This topic is never discussed publicly; there are dozens of "secret lists" of approved vendors in the industry for service vendors. Entry to these lists is not often merit based, but primarily "connections" based i.e. You get on it if you take the right CISO out for golf & fancy dinner, or your company appears on the list purely because of alumni allegiance. There is no well-defined or merit based vetting process for the vendors. These secret lists dominate the decision process of many of the biggest US companies when it comes to vendor selection. Include Security is found on many of these lists, but we would rather be on public lists! As seen below, it is great to see the industry shift to public vendor lists and marketplaces. At IncludeSec we believe more transparency will ensure the best companies who provide value are being justly awarded work in our industry, not the companies with the most sales people. CC folks leading the charge on security/vendor transparency Lisa Hall James Berthoty Robert Hansen

This post explains how to use the deny permission in D365FO from AOT. #Dynamics #permission

If you are curious on how to utilize the deny permission in D365FO from the AOT, this blog post shows how you can perform this and some things to look out for! #msdyn365fo #xppgroupies #security

Part 3: Key Things to Know About APIs When considering APIs, there are a few key points to understand: 🔒 Security: Ensure the API is secure, protecting data from unauthorized access. 📚 Documentation: Good APIs come with comprehensive documentation, making it easier to integrate and use. 📈 Scalability: Check if the API can handle increased loads as your business grows. 🔗 Compatibility: Ensure the API is compatible with your existing systems. Understanding these aspects helps in selecting the right API for your needs and ensures smooth integration and operation.

💡Wrapped up an informative session at #BSides London, where Anant shared valuable insights on #SupplyChainSecurity. Have a sneak peek at what he unveiled: https://lnkd.in/dVTniQHg Stay tuned for more event highlights and cybersecurity tips! . . . #cyfinoid #supplychaininnovation #CybersecurityTalk #cloudsecurity

Intelmq leverages Shadowserver’s APIs. This is a way to check out the APIs. https://lnkd.in/gt4Q9ckx The APIs open synergistic opportunities. You can use the APIs to intergrate Shadowserver’s data with your other telemetry and risk indicators.

Just finished the course “Building an Application Security Program” by Tim Chase! From this course I was able to grasp knowledge on topics such as DAST, SAST that relates with application security. Check it out: https://lnkd.in/g_P47Nq5 #applicationsecurity #programdevelopment.

It is critical to maintain an updated awareness of potential vulnerabilities in the continually advancing world of cybersecurity. One such vulnerability you should be aware of is an attack strategy known as ASREPRoasting (Authentication Service Response Message Roasting). This method exploits specific configurations within Active Directory (AD) environments, which rely on the Kerberos authentication protocol. To dissect the issue and pinpoint potential solutions, we have written an expansive blog post explaining this phenomenon. Read the blog here: https://hubs.la/Q02c0wrJ0 Book a free consultation to speak to a cyber security specialist: https://hubs.la/Q02c0M3B0

Insightful webcast with a description of different application security scan approaches (Penetration tests, Runtime analytics, IAST, DAST, SAST, SCA) and their strengths and weaknesses for modern applications. #SANS #AppSec #APISec #SecDev #DevSecOps

Last week, we had this amazing webinar with Darren Meyer, if you missed it, I got you covered. In this webinar we delved into the cutting-edge realm of cryptographic artifact signatures and their pivotal role in bolstering security, quality, and compliance programs. 💼✨ Discover the essentials: 🔐 Deciphering Artifact and Code Signing: Unravel the mysteries behind these crucial security measures and understand how they form the bedrock of a robust defense strategy. ⏩ Accelerating Proactive Security Responses: Learn how to turbocharge your security arsenal with lightning-fast code-to-cloud traceability, ensuring you stay ahead of potential threats. ⚡️ Enhancing Reactive Security Responses: Explore the power of cloud-to-code traceability in swiftly mitigating security incidents, minimizing downtime, and safeguarding your assets. 💡 Unveiling Artifact Signing and Verification with Endor Labs: Gain insights into the innovative solutions offered by Endor Labs and discover how they can revolutionize your security framework. Have more questions, or would like to learn more? Let me know!