Vulnerabilities
Input Validation vs Sanitisation: Difference and How to Apply Both
Validation rejects bad data at the boundary while sanitisation cleans data that must pass through, creating two distinct defence layers against injection attacks.
Malware Brief Handbook Desk
The Malware Brief Handbook Desk is the part of the Malware Brief newsroom that covers reference guides that explain the ideas behind the headlines. It is a newsroom desk, not a single person. Sections: Guides. Guides are drafted with AI assistance, carry no invented statistics and are reviewed when the facts change. It has published 68 articles so far. See the editorial policy or report an error.
Cyber Attacks
Email Filtering System: Mechanics, Blind Spots, and Configuration
An email filtering system does not stop attacks; it shifts the burden of analysis from your users to automated logic that inevitably produces false positives.
Threat Intelligence
Difference Between Red Teaming and Penetration Tester: Scope and Intent
Red teaming simulates full adversary campaigns to test organisational response, whereas penetration testing isolates technical vulnerabilities within agreed boundaries.
Cloud Security
What is a DevSecOps Engineer: The Role That Shifts Security Left
A DevSecOps engineer embeds automated security checks into the deployment pipeline, catching flaws before they reach production environments where fixes cost significantly more.
Vulnerabilities
What is prototype pollution: how object inheritance fails
Prototype pollution allows attackers to inject properties into base objects, corrupting logic and enabling remote code execution without direct memory access.
Threat Intelligence
Intelligence Cycle Diagram: How the Loop Drives Security Decisions
The intelligence cycle diagram reveals that analysis creates value, not collection, and that ignoring feedback loops guarantees repeated failures in defensive operations.
Data Breaches
Third-Party Data Breach Mistakes: 7 Errors That Expose Your Systems
Assuming a vendor’s security posture mirrors your own is the primary error, as supply chain attacks bypass your perimeter defences entirely.
Data Breaches
How Common Misconfigurations Trigger Silent Data Leaks
Most data exfiltration stems from routine administrative oversights rather than sophisticated external attacks, leaving sensitive records exposed to anyone with a web browser.
Cyber Attacks
Phishing Kits: Definition, Mechanics and Operational Reality
Phishing kits are pre-packaged criminal toolsets that standardise deception, allowing attackers to bypass security filters by mimicking trusted interfaces with surgical precision.
Cloud Security
Cloud Shared Responsibility Model: Who Fixes What
The provider secures the cloud infrastructure itself, while you remain liable for every configuration error and data leak within your tenant.
Cyber Attacks
SIM Swapping Explained: How Attackers Steal Your Identity
Attackers convince mobile carriers to move your phone number to their device, bypassing security checks that rely on text messages for verification.
Threat Intelligence
Pass-the-Hash Attacks: Mechanics, Risks and Mitigation
Attackers bypass password verification by reusing cryptographic hashes, rendering complex passphrase policies ineffective against lateral movement.
Cloud Security
Cloud API Insecurity Myths: What You Get Wrong About Interface Risks
API security fails not because of weak encryption, but because developers assume the cloud provider handles logic flaws and identity verification.
Cloud Security
Cloud Audit Logs: 7 Common Mistakes That Blind Your Security Team
Most cloud audit logs fail not because data is missing, but because noise drowns out the signal, rendering detection impossible without strict filtering.
Threat Intelligence
Detect Remote Desktop Abuse: Logs, Signals and Hidden Blind Spots
Remote desktop abuse often leaves no login failures, only unusual process trees and data movement that standard alerts miss.
Cyber Attacks
How Zero-Click Attacks Work: Step-by-Step Analysis
Zero-click attacks bypass user interaction by exploiting how software processes data in memory, turning routine updates into silent compromises.
Threat Intelligence
Detecting Credential Dumping: Signals, Logs and Blind Spots
Credential dumping often leaves no malware trace, relying instead on legitimate system calls that blend into normal administrative activity.
Data Breaches
Protected Health Information: Why It Changes Security Decisions
Treating protected health information differently forces teams to build defences that withstand long-term data retention and complex supply chains.
Threat Intelligence
How to Implement Red Teaming: A Practical Step-by-Step Framework
Effective red teaming requires simulating adversary tactics to validate detection gaps, rather than simply testing for known vulnerabilities in isolation.
Cyber Attacks
MFA Fatigue Attack Response: Stop, Contain and Recover
Approving notifications in exhaustion grants attackers full access, making immediate credential rotation and session termination the only effective recovery path.
Cloud Security
Cloud Landing Zones: Benefits, Limits and When to Deploy
Landing zones prevent configuration drift but introduce architectural complexity that slows initial deployment and masks underlying policy failures.
Malware & Ransomware
Sandboxing Mistakes: How to Avoid Detection Evasion
Most sandboxing failures stem from static analysis limits that allow malware to remain dormant until execution in a live environment.
Threat Intelligence
Hacktivism Explained: Motives, Methods and Technical Realities
Hacktivism relies on low-sophistication tools and public data, making attribution difficult but technical defence straightforward through standard hardening.
Malware & Ransomware
Zero-Day Malware: Why Unknown Threats Dictate Security Strategy
Zero-day exploits bypass signature checks, forcing defenders to rely on behavioural analysis and strict access controls rather than simple detection tools.