Michael Cobb

255 articles by Michael Cobb

• 5G security: Everything you should know for a secure network

  Feb. 24, 2026

• What is data masking?

  Oct. 22, 2025

• What is Triple DES and why is it disallowed?

  Sept. 3, 2025

• The differences between inbound and outbound firewall rules

  July 30, 2025

• ISO 31000 vs. COSO: Comparing risk management standards

  July 23, 2025

• Security log management tips and best practices

  July 9, 2025

• 12 smart contract vulnerabilities and how to mitigate them

  June 26, 2025

• What is a cyberattack? 16 common types and how to prevent them

  June 23, 2025

• Symmetric vs. asymmetric encryption: Understand key differences

  June 10, 2025

• 13 API security best practices to protect your business

  March 20, 2025

• What is a buffer overflow? How do these types of attacks work?

  March 17, 2025

• What is Kerberos and how does it work?

  March 10, 2025

• What is the RSA algorithm?

  Feb. 11, 2025

• What is physical security and how does it work?

  Feb. 7, 2025

• What is a certificate revocation list (CRL) and how is it used?

  Jan. 31, 2025

• What is biometric verification?

  Jan. 31, 2025

• What is DOS (Disk Operating System)?

  Jan. 31, 2025

• What is threat modeling?

  Jan. 23, 2025

• What is SSL (Secure Sockets Layer)?

  Jan. 23, 2025

• What is a private key?

  Jan. 21, 2025

• How to recover from a DDoS attack

  Dec. 4, 2024

• 10 API security testing tools to mitigate risk

  Nov. 4, 2024

• API security testing checklist: 7 key steps

  Nov. 1, 2024

• What is two-factor authentication (2FA)?

  Oct. 28, 2024

• DDoS mitigation: How to stop DDoS attacks

  Oct. 25, 2024

• How to detect DDoS attacks

  Oct. 22, 2024

• What is threat intelligence?

  Oct. 10, 2024

• What is cybercrime and how can you prevent it?

  Sept. 3, 2024

• What is SSH (Secure Shell) and How Does It Work?

  July 29, 2024

• How to implement an attack surface management program

  July 24, 2024

• How to protect port 139 from SMB attacks

  July 19, 2024

• What dangling pointers are and how to avoid them

  July 18, 2024

• Port scan attacks: What they are and how to prevent them

  June 20, 2024

• What is Data Encryption Standard (DES)?

  May 2, 2024

• Stateful vs. stateless firewalls: Understanding the differences

  April 18, 2024

• Key software patch testing best practices

  April 15, 2024

• OAuth (Open Authorization)

  April 12, 2024

• Agent vs. agentless security: Learn the differences

  March 25, 2024

• cloud encryption

  March 14, 2024

• asymmetric cryptography

  March 12, 2024

• Advanced Encryption Standard (AES)

  Feb. 20, 2024

• encryption

  Feb. 7, 2024

• Close security gaps with attack path analysis and management

  Feb. 6, 2024

• How to protect your organization from IoT malware

  Nov. 15, 2023

• The history, evolution and current state of SIEM

  July 12, 2023

• How API gateways improve API security

  June 26, 2023

• Use IoT hardening to secure vulnerable connected devices

  June 16, 2023

• Risk assessment vs. threat modeling: What’s the difference?

  June 15, 2023

• Top breach and attack simulation use cases

  May 24, 2023

• How to fix the top 5 API vulnerabilities

  April 11, 2023

• Trojan horse

  Dec. 2, 2022

• Industrial control system security needs ICS threat intelligence

  Nov. 17, 2022

• 6 ways to prevent privilege escalation attacks

  Oct. 24, 2022

• How to conduct a secure code review

  Aug. 24, 2022

• What is identity sprawl and how can it be managed?

  Aug. 18, 2022

• Data masking vs. data encryption: How do they differ?

  Aug. 2, 2022

• How micropatching could help close the security update gap

  May 16, 2022

• man-in-the-middle attack (MitM)

  April 28, 2022

• How endpoint encryption works in a data security strategy

  March 15, 2022

• Privacy-enhancing technology types and use cases

  Feb. 25, 2022

• How to use PKI to secure remote network access

  Feb. 23, 2022

• Protect APIs against attacks with this security testing guide

  Jan. 28, 2022

• What is shellcode and how is it used?

  Jan. 25, 2022

• smart card

  Dec. 29, 2021

• How to mitigate Log4Shell, the Log4j vulnerability

  Dec. 21, 2021

• 7 best practices to ensure GDPR compliance

  Nov. 4, 2021

• Is bitcoin safe? How to secure your bitcoin wallet

  Aug. 6, 2021

• How to prevent software piracy

  July 15, 2021

• How to implement machine identity management for security

  July 12, 2021

• How to get started with security chaos engineering

  June 15, 2021

• The top 6 SSH risks and how regular assessments cut danger

  June 10, 2021

• ethical hacker

  May 21, 2021

• 6 SSH best practices to protect networks from attacks

  April 16, 2021

• How to manage third-party risk in the supply chain

  Feb. 25, 2021

• How to prevent supply chain attacks: Tips for suppliers

  Feb. 24, 2021

• How to achieve security observability in complex environments

  Feb. 23, 2021

• How to address and prevent security alert fatigue

  Feb. 10, 2021

• Using content disarm and reconstruction for malware protection

  Feb. 9, 2021

• Extended detection and response tools take EDR to next level

  Jan. 14, 2021

• Weighing remote browser isolation benefits and drawbacks

  Nov. 24, 2020

• Oversee apps with these 3 application security testing tools

  Sept. 29, 2020

• Format-preserving encryption use cases, benefits, alternative

  Sept. 22, 2020

• 3 steps to secure codebase updates, prevent vulnerabilities

  Sept. 15, 2020

• 10 RDP security best practices to prevent cyberattacks

  Aug. 18, 2020

• How to send secure email attachments

  Aug. 5, 2020

• The case for cybersecurity by design in application software

  Aug. 3, 2020

• How to fortify IoT access control to improve cybersecurity

  June 1, 2020

• The risks and effects of spyware

  May 6, 2020

• SSL certificate best practices for 2020 and beyond

  April 29, 2020

• Updating the data discovery process in the age of CCPA

  March 11, 2020

• 5G network slicing security benefits IoT, mobile

  March 10, 2020

• How to use TODO comments for secure software development

  Feb. 27, 2020

• Windows IIS server hardening checklist

  Feb. 27, 2020

• AI and machine learning in cybersecurity: Trends to watch

  Jan. 6, 2020

• Comparing Diffie-Hellman vs. RSA key exchange algorithms

  Nov. 20, 2019

• Zero-trust framework creates challenges for app dev

  Nov. 11, 2019

• What it takes to be a DevSecOps engineer

  Sept. 12, 2019

• DevOps security checklist requires proper integration

  Aug. 17, 2019

• How to start building a DevSecOps model

  Aug. 5, 2019

• Boost application security in DevOps with DevSecOps

  July 8, 2019

• How infrastructure as code tools improve visibility

  April 26, 2019

• The security benefits of using infrastructure as code

  April 22, 2019

• Protect your enterprise against shadow IT in the cloud

  March 26, 2019

• 5 common web application vulnerabilities and how to avoid them

  March 19, 2019

• Weighing the cost of mitigating Spectre variant 2

  Feb. 21, 2019

• How NIST is preparing to defend against quantum attacks

  Jan. 10, 2019

• How a flaw in Apple DEP misuses an MDM server

  Dec. 13, 2018

• How did WhatsApp vulnerabilities get around encryption?

  Dec. 7, 2018

• How can users remove Google location tracking completely?

  Dec. 6, 2018

• How does TLS 1.3 differ from TLS 1.2?

  Dec. 5, 2018

• How do L1TF vulnerabilities compare to Spectre?

  Dec. 4, 2018

• What are the security risks of third-party app stores?

  Dec. 4, 2018

• How to configure browsers to avoid web cache poisoning

  Nov. 15, 2018

• How is Plead malware used for cyberespionage attacks?

  Nov. 9, 2018

• What is behind the growing trend of BEC attacks?

  Nov. 8, 2018

• How does site isolation defend against Spectre vulnerabilities?

  Nov. 7, 2018

• How does the public Venmo API pose a threat for users?

  Nov. 6, 2018

• How can U2F authentication end phishing attacks?

  Nov. 5, 2018

• The implications of the NetSpectre vulnerability

  Oct. 18, 2018

• How does Apple’s Quick Look endanger user privacy?

  Oct. 12, 2018

• How did Netflix phishing attacks use legitimate TLS certificates?

  Oct. 11, 2018

• How do hackers use legitimate admin tools to compromise networks?

  Oct. 10, 2018

• How was Google Firebase security bypassed?

  Oct. 9, 2018

• How does TLBleed abuse the Hyper-Threading feature in Intel chips?

  Oct. 8, 2018

• How does the SynAck ransomware use Process Doppelgänging?

  Sept. 14, 2018

• How does Telegram malware bypass end-to-end encryption?

  Sept. 13, 2018

• How does Android Protected Confirmation provide security for users?

  Sept. 12, 2018

• What issues can arise from hardware debug exception flaws?

  Sept. 11, 2018

• How does the Android Rowhammer exploit affect users?

  Sept. 10, 2018

• How the STARTTLS Everywhere initiative will affect surveillance

  Sept. 6, 2018

• Weighing privileged identity management tools’ pros and cons

  Aug. 24, 2018

• How to mitigate the Efail flaws in OpenPGP and S/MIME

  Aug. 16, 2018

• Facebook user data: How do malicious apps steal user data?

  Aug. 10, 2018

• UPnP vulnerability: How is the UPnP protocol being misused?

  Aug. 9, 2018

• How do SDKs for ad networks cause data leaks?

  Aug. 8, 2018

• What does the expansion of MANRS mean for BGP security?

  Aug. 7, 2018

• Microsoft’s NTFS flaw: What are the potential consequences?

  Aug. 6, 2018

• Domain fronting: Why cloud providers are concerned about it

  July 19, 2018

• Drupalgeddon 2.0: Why is this vulnerability highly critical?

  July 13, 2018

• How can cryptojacking attacks in Chrome be stopped?

  July 12, 2018

• What are the implications of DNS over HTTPS for privacy?

  July 11, 2018

• What effect does GDPR have on the WHOIS database?

  July 10, 2018

• How did an old, unpatched Firefox bug expose master passwords?

  July 9, 2018

• How can domain generation algorithms be used to bypass ad blockers?

  June 8, 2018

• How lattice-based cryptography will improve encryption

  June 7, 2018

• How does a SAML vulnerability affect single sign-on systems?

  June 7, 2018

• How did cryptomining malware exploit a Telegram vulnerability?

  June 6, 2018

• What risks do untrusted certificates pose to enterprises?

  June 5, 2018

• How bad is the iBoot source code leak for Apple security?

  June 4, 2018

• Are Meltdown and Spectre real vulnerabilities or mere flaws?

  May 17, 2018

• How will the new WPA3 protocol strengthen password security?

  May 4, 2018

• IoT botnets: How are new Mirai variants impacting systems?

  May 3, 2018

• How were Android Pixel vulnerabilities exploited?

  May 2, 2018

• How did an Electron framework flaw put Slack at risk?

  May 1, 2018

• What is included in the mPOS security standard from PCI SSC?

  April 30, 2018

• How a Blizzard DNS rebinding flaw put millions of gamers at risk

  April 5, 2018

• How can improper certificate pinning be stopped by the Spinner tool?

  March 9, 2018

• How does a WPAD attack work and how can it be prevented?

  March 8, 2018

• How can users deal with app trackers that collect customer data?

  March 7, 2018

• How does Tizi spyware affect Android apps?

  March 6, 2018

• The Keeper browser extension flaw: How can users stay secure?

  March 5, 2018

• Why the Bleichenbacher attack is still around

  March 1, 2018

• Fight a targeted cyberattack with network segmentation, monitoring

  Feb. 5, 2018

• Bypassing facial recognition: The means, motive and opportunity

  Feb. 1, 2018

• The ROCA vulnerability: How it works and what to do about it

  Jan. 4, 2018

• How machine learning-powered password guessing impacts security

  Dec. 7, 2017

• How does the GhostHook attack bypass Microsoft PatchGuard?

  Dec. 1, 2017

• Use caution with OAuth 2.0 protocol for enterprise logins

  Nov. 30, 2017

• How to prepare for potential IPv6 DDoS attacks

  Nov. 9, 2017

• How app libraries share user data, even without permission

  Oct. 19, 2017

• How the Docker REST API can be turned against enterprises

  Oct. 5, 2017

• Securing endpoints with supplementary tools protects data

  Oct. 2, 2017

• How can users detect dangerous open ports in mobile apps?

  Sept. 14, 2017

• How is Pegasus malware different on Android than on iOS?

  Sept. 11, 2017

• Are biometric authentication methods and systems the answer?

  Aug. 9, 2017

• How did a Moodle security vulnerability enable remote code execution?

  Aug. 8, 2017

• How did flaws in WhatsApp and Telegram enable account takeovers?

  Aug. 7, 2017

• SHA-1 collision: How the attack completely breaks the hash function

  July 27, 2017

• What made iOS apps handling sensitive data vulnerable to MitM attacks?

  July 12, 2017

• How can a NULL pointer dereference flaw create a DoS attack?

  June 9, 2017

• The Apple Notify flaw: How does it allow malicious script injection?

  June 8, 2017

• Adobe Acrobat Chrome extension: What are the risks?

  June 6, 2017

• How effective is geofencing technology as a security method?

  May 5, 2017

• Why did the PHPMailer library vulnerability have to be patched twice?

  May 4, 2017

• Same-origin policy: How did Adobe Flash Player’s implementation fail?

  May 3, 2017

• Panasonic Avionics IFE systems: How serious are the vulnerabilities?

  May 1, 2017

• Identity and access management strategy: Time to modernize?

  April 20, 2017

• How have ARM TrustZone flaws affected Android encryption?

  April 7, 2017

• How did firmware create an Android backdoor in budget devices?

  April 3, 2017

• 1024-bit encryption keys: How ‘trapdoored’ primes have caused insecurity

  March 30, 2017

• Attack by TIFF images: What are the vulnerabilities in LibTIFF?

  March 10, 2017

• How can attacks bypass ASLR protection on Intel chips?

  March 8, 2017

• How can the Dirty COW vulnerability be used to attack Android devices?

  March 7, 2017

• SHA-1 certificates: How will Mozilla’s deprecation affect enterprises?

  March 6, 2017

• What caused the ClixSense privacy breach that exposed user data?

  Feb. 10, 2017

• What global threat intelligence can and can’t do for security programs

  Feb. 9, 2017

• How did a Signal app bug let attackers alter encrypted attachments?

  Feb. 7, 2017

• How does Overseer spyware work on infected Android apps?

  Feb. 6, 2017

• How can two-factor authentication systems be used effectively?

  Jan. 4, 2017

• FIDO authentication standard could signal the passing of passwords

  Jan. 3, 2017

• How to buy digital certificates for your enterprise

  Jan. 3, 2017

• SWIFT network communications: How can bank security be improved?

  Dec. 23, 2016

• Can an HTML5 document with a digital signature be authenticated?

  Oct. 25, 2016

• Preventing privilege creep: How to keep access and roles aligned

  Oct. 24, 2016

• Planning for an IPv6 attack: DDoS, neighbor discovery threats and more

  Sept. 2, 2016

• How can the AirDroid app phone hijacking be prevented?

  July 4, 2016

• Why signature-based detection isn’t enough for enterprises

  May 18, 2016

• How can Kerberos protocol vulnerabilities be mitigated?

  May 6, 2016

• Breaking down the DROWN attack and SSLv2 vulnerability

  April 21, 2016

• How does the M-Pesa service work and what are the risks?

  April 13, 2016

• What’s the difference between two-step verification and 2FA?

  March 22, 2016

• Microsoft Device Guard tackles Windows 10 malware

  Jan. 11, 2016

• Should the RC4 cipher still be used in enterprises?

  Dec. 30, 2015

• How can software transplants fix bad code?

  Dec. 28, 2015

• Secure Hash Algorithm-3: How SHA-3 is a next-gen security tool

  Oct. 30, 2015

• Getting to the bottom of the software vulnerability disclosure debate

  Oct. 12, 2015

• Can a new encryption trick prevent reverse engineering?

  Aug. 17, 2015

• How can I mitigate the risks of alternative Android browsers?

  Aug. 13, 2015

• Is third-party access the next IAM frontier?

  Aug. 3, 2015

• Certificate authorities are limited but new TLS versions can help

  July 15, 2015

• From SSL and early TLS to TLS 1.2: Creating a PCI DSS 3.1 migration plan

  July 13, 2015

• SSL/TLS security: Addressing WinShock, the Schannel vulnerability

  Feb. 6, 2015

• The POODLE vulnerability and its effect on SSL/TLS security

  Jan. 16, 2015

• Detecting backdoors: The Apple backdoor that never was?

  Jan. 7, 2015

• Can setting a cache-control header improve application data security?

  Dec. 1, 2014

• Are LibreSSL and BoringSSL safe OpenSSL alternatives?

  Dec. 1, 2014

• SHA-2 algorithm: The how and why of the transition

  Oct. 17, 2014

• Authentication caching: How it reduces enterprise network congestion

  March 28, 2014

• Preventing plaintext password problems in Google Chrome

  Jan. 30, 2014

• The value of 2,048-bit encryption: Why encryption key length matters

  Oct. 7, 2013

• Can an unqualified domain name cause man-in-the-middle attacks?

  Sept. 10, 2013

• What risk does the Apple UDID security leak pose to iOS users?

  Feb. 12, 2013

• Windows Server 2012 security: Is it time to upgrade?

  Jan. 8, 2013

• Examining Kindle Fire security, Silk browser security in the enterprise

  May 7, 2012

• OAuth 2.0: Pros and cons of using the federation protocol

  Nov. 9, 2011

• Comparing relational database security and NoSQL security

  Oct. 17, 2011

• How to mitigate the risk of a TOCTTOU attack

  Aug. 31, 2011

• How MAC and HMAC use hash function encryption for authentication

  Aug. 30, 2011

• Can smartphones get viruses and spread them to the network?

  Feb. 28, 2011

• Why it’s important to turn on DEP and ASLR Windows security features

  July 5, 2010

• MD5 security: Time to migrate to SHA-1 hash algorithm?

  May 19, 2010

• Performing a security risk analysis to assess acceptable level of risk

  April 16, 2010

• What is an encryption collision?

  Oct. 23, 2009

• How to prevent ActiveX security risks

  Sept. 22, 2009

• What are new and commonly used public-key cryptography algorithms?

  Aug. 28, 2009

• What are the export limitations for AES data encryption?

  Aug. 25, 2009

• How does a Web server model differ from an application server model?

  Feb. 11, 2009

• Is it impossible to successfully remove a rootkit?

  Oct. 21, 2008

• Is Triple DES a more secure encryption scheme than DUKPT?

  March 27, 2008

• Preparing for uniform resource identifier (URI) exploits

  Oct. 11, 2007

• How does SSL ‘sit’ between the network layer and application layer?

  July 31, 2007

• How secure is the Windows registry?

  July 26, 2007

• What are the drawbacks to application firewalls?

  May 31, 2007

• How secure are document scanners and other ‘scan to email’ appliances?

  May 30, 2007

• How can header information track down an email spoofer?

  May 2, 2007