Resilience
8 matching posts.
The Event Was Visible. The Detection Still Needed Context.
Endpoint Security can deliver macOS authorization requests and event notifications, but an event is not yet a verdict. A defensible design preserves timing, sequence gaps, process identity, policy version, privacy, outcome, and the resulting system effect.
One ATM Was Contained. The Fleet Trust Path Was Not.
The final ATM assessment chapter: test remote support, software deployment, segmentation, monitoring, transaction integrity, containment, and reconciliation as fleet-wide control planes.
The Device API Was Standard. Authorization Was Assumed.
Part four of the ATM assessment series: test XFS-style middleware, caller identity, service providers, peripheral state, PIN boundaries, and transaction context with emulators and denied requests—not live device effects.
The Desktop Was Hidden. The Execution Boundary Was Not.
Part three of the ATM assessment series: validate kiosk containment, application control, service identities, maintenance states, secrets, updates, and off-host telemetry without turning UI escape testing into a payload exercise.
The BIOS Had a Password. The Boot Chain Still Needed Trust.
Part two of the ATM assessment series: an evidence-driven method for validating firmware recovery, Secure Boot, measured boot, disk-unlock policy, update integrity, and off-host detection without publishing a hardware-bypass playbook.
The ATM Was Locked Down. The Transaction Path Was Not.
An evidence-driven methodology for authorized ATM security assessments: test the trust boundaries between the kiosk, operating system, device middleware, EPP, service network, monitoring plane, and transaction switch without turning the engagement into a cash-out exercise.
The Red Team Reached Domain Admin. The Exercise Still Failed.
Domain Admin is a capability, not a business objective. This field methodology turns an authorized red team operation into a testable chain of objective, runtime authority, technical action, defender signal, response decision, evidence, and verified recovery.
The Last Two Steps Are Not in Scope. What Makes Them Survivable Is.
Part five of testing the ransomware playbook: an assessment stops before exfiltration and encryption, and it should. But the two properties that decide how bad either gets — egress and backup reachability — are fully testable, and almost never in scope.