PRO+ Premium Content/Information Security
Access your Pro+ Content below.
White hat Dave Kennedy on purple teaming, penetration testing
This article is part of the Information Security issue of October 2018, Vol. 20, No. 5
Dave Kennedy is renowned in the security industry as a co-author of Metasploit: The Penetration Tester's Guide (No Starch Press, July 2011). The bestselling book offers guidance on using the Ruby-based open source "framework" to exploit vulnerabilities in computer systems. The framework is widely used by security testers -- and hackers. A former CSO, Kennedy led the global security program at Diebold Inc. prior to starting TrustedSec, an information security assessment and consulting firm based in Strongsville, Ohio. He is also the co-founder and chief hacking officer at Binary Defense, a managed endpoint detection and response provider, located in nearby Hudson; the company's technology incorporates the Penetration Testing Execution Standard that he co-founded. In addition to his work as a white hat hacker, Kennedy is a frequent speaker at industry events and one of the founders of DerbyCon, a security conference in Louisville, Kentucky. Here, he chats with Marcus Ranum -- once a skeptic of penetration testing -- about purple ...
Features in this issue
-
Cloud-first? User and entity behavior analytics takes flight
The power and cost savings associated with software as a service are tempting companies to consider applications for security analytics both on premises and in the public cloud.
-
Beware of the gray hat hacker, survey warns
Close to 40% of security professionals either know, or have known, a legitimate security practitioner who has participated at some point in black hat activities.
News in this issue
-
Industries seek to improve third-party security risk controls
Healthcare security leaders are developing industry best practices for better third-party risk management using common assessment and certification standards.
Columns in this issue
-
Kurt Huhn discusses the role of CISO in the Ocean State
A strategy focused on widespread training and education leads to progress against one of the state's biggest threats, says the Rhode Island CISO.
-
White hat Dave Kennedy on purple teaming, penetration testing
Russia and other nation-states use application control bypass techniques because they don't "trigger any alarms," the chief hacking officer says.