Mary Elliott


Running a marathon is a long-term commitment — just like continuously protecting your business from cyberattacks. Both require implementing the proper strategies, training, and upkeep to stray away from potential injuries or vulnerabilities that can hinder your end goal. 

Wednesday, October 6 2021, Cobalt’s SecTalks security conference will set your security team on track with proven strategies to evolve, improve, and advance to the next level. Security for the long run isn’t a sprint, it’s a steady race. It’s important to focus on how to measure the impact of your programs and how other businesses are learning, collaborating, and applying industry best practices. SecTalks will jump into topics covering communication, business acumen, what workflow changes can increase productivity, and more. And, it all doesn’t just happen overnight — slow and steady wins the security race. 

## A Look Into the Agenda for SecTalks 2021
Cyber crises are often unpredictable, but the right tips from industry professionals can prepare your team for reaching the finish line and focus on moving forward safely and securely. 

### The State of Pentesting 2021 
The State of Pentesting is one important tool to set your team up to run in the right direction. Based on 1600+ pentests, Cobalt experts will explore the most widespread vulnerabilities and how to prevent setbacks that can slow your remediation down. 

### How to Negotiate: Security Career Tips
Roadblocks along the way are inevitable, so learning how to handle tough conversations with leadership on budgets, organizational goals, team performance, and hiring can help overcome possible hurdles. Speakers will “coach” on how to effectively represent security in wider business conversations. 

### Make Security Stronger: Creating More Efficient Workflows 
The move to DevSecOps is accelerating, and security workflows strain to be faster, more agile, and collaborative to reach their end goal. This session will give insights into one team’s strategy to meet these demands with the right combination of tools and human ingenuity. 

### CXO AMA
Having access to pro tips is key to improving performance. A panel of C-suite executives will answer questions in this session about the most important security data points to bring to a board meeting, how to handle M&A activity, and more. 

## Introducing This Year’s Speaker Lineup
Here’s a sneak peek at a few of the speakers at the upcoming SecTalks — presenting key insights from decades of experience.

__Jennifer Czaplewski__ - Senior Director, Cyber Security at Target

Jennifer is an innovative cybersecurity leader known for building and delivering critical security functions. She is an industry leader in DevSecOps and frequently shares insights at thought leadership forums like RSA, the Cyber Security Summit, DevOps.com, and All Day DevOps. She is a patent holder and her work has been featured in SC Magazine and Dark Reading.

__Charles Nwatu__ - Engineering Manager, Corporate Security & Security, Technology Assurance & Risk (STAR) at Netflix

Charles works in the Information Security and Monitoring domain, known for creating dynamic teams that develop and engineer robust security capabilities.

__Jay Paz__ - Director of Pentest Operations and Research, Cobalt 

Jay has more than 12 years of experience in information security and 19+ years of information technology experience including system analysis, design, and implementation for enterprise level solutions. He has a robust background in developer supervision and training as well as in major programming languages, operating hardware and software, and major infrastructure application development.

__Tony Spinelli__ - Digital CIO & Cybersecurity Pioneer

Tony has worked for some of the world’s most critical companies, developed next gen digital tech, and pioneered new cloud and cybersecurity strategies. His recent focus has been on driving deeper digital insights with human and AI teaming, machine learning, and analytics, with cybersecurity as an enabling strategy. 

__Caroline Wong__ - Chief Strategy Officer at Cobalt

As CSO, Caroline leads the Security, Community, and People teams at Cobalt. She brings a proven background in communications, cybersecurity, and experience delivering global programs to the role. Caroline also hosts the Humans of InfoSec podcast, teaches cybersecurity courses on LinkedIn Learning, and has authored the popular textbook Security Metrics, A Beginner's Guide.

__Anne Marie Zettlemoyer__ - Business Security Officer | Vice President, Security Engineering at Mastercard

Anne Marie is a cyber-strategist with over 20 years of experience in eight industries. At the intersection of business, security, and analytics, Zettlemoyer has served as a trusted advisor for Fortune 500 companies, government agencies, startups, and think tanks. 

How will your team apply industry best practices and panel insights to get faster, smarter, and stronger and stay ahead of the curve? Be sure to [register](https://cobalt.io/sectalks) for Cobalt’s virtual SecTalks security conference on Wednesday, October 6 2021, to learn more about the latest in cybersecurity from industry experts.

[![Sectalks 2021: faster, smarter, stronger cybersecurity event](//images.contentful.com/9snkwzlabuv8/7fJBXGhn49JwA94ALmUQZ1/43593937db2d0dded498a51de75fa62f/Sectalks_2021_-_faster__smarter__stronger_cybersecurity_event.webp)](https://cobalt.io/sectalks)

Faster, Smarter, Stronger: Get on Track for Cybersecurity Success with SecTalks 2021

Analysts at 451 Research are lauded for their data-driven, global insights. For anyone who isn’t familiar with this leading research and advisory organization: the team of analysts engages with IT industry leaders to share key market findings and trends that can be pivotal for technology and service advisors.

Recently, 451 did a deep dive on Cobalt — our business model, differentiators, and value prop — along with a SWOT analysis. Here’s what analyst Aaron Sherrill had to say: 

Organizations are discovering the ways traditional penetration testing engagements aren’t measuring up to a modernized approach. __Traditional pentesting provides only a point-in-time snapshot of an enterprise’s risks, weaknesses, and vulnerabilities, and often fails to:__

- Deliver the outcomes needed for rapid development cycles
- Provide interaction with testers during or after testing 
- Maximize retesting capabilities to ensure issues have been fully remediated
- Give the insights needed for a data-driven security program

With that in mind, these shortcomings of traditional pentesting are becoming ever more critical. 451 Research’s recent *Voice of the Enterprise: DevOps, Organizational Dynamics* survey collected data that suggests a growing percentage of organizations are accelerating or newly introducing initiatives to add security to DevOps workflows. Because of this acceleration of adding security to DevOps, the time is here for traditional pentesting to evolve.

## Introducing: The Cobalt Platform

Cobalt’s Pentest as a Service (PtaaS) platform aims to modernize the traditional penetration testing model by delivering programmatic, on-demand, manual penetration testing services for web, mobile, and desktop applications, APIs, internal and external networks. In as quick as 24 hours, Cobalt can begin penetration testing and delivering the people and process innovation required to drive better security.

> “Organizations of every size and industry are seeking to improve their cybersecurity posture; however, access to frequent security testing has been beyond the scope of expertise and resources of most organizations. Cobalt’s flexible, tailored and integrated approach to on-demand, programmatic security testing is designed to meet the needs of both rigorous testing approaches and organizations that are just beginning their security testing initiatives.”

Interested in learning more about how Cobalt’s modernized Pentest as a Service (PtaaS) platform can provide value to your business security? Read more in the full [Market Insight Report](https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf). 

<a href= "https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf "> ![451 Research](//images.contentful.com/9snkwzlabuv8/4zGktLiTp70lkOb7tcN60G/44f6a2850536546dbcbd202efa0c9a03/Content_Image_-_CTA_-blog_assets-.png) </a>

*Source: 451 Research, Coverage Initiation: Cobalt aims to  modernize traditional penetration testing with its pentest-as-a-service model, June 2021, All Rights Reserved*

451 Research Takes a Close Look at Cobalt in Latest Report

Nikola Velkovski

*This post was originally published on <a href="https://cloudlad.io/" target="_blank">cloudlad.io</a>*

The most frequently used Terraform commands, plan, apply, and destroy, are the first things I learned when I started using Terraform. Primarily because those commands are a crucial part of Terraform’s cycle. Over time, as Terraform and its community grew, the features of Terraform grew in parallel. Now there are a lot more commands, options, arguments, and functions. Some are not used as often, and some do not even show when invoking the help menu.

In this blog post, I want to talk about the not-so-very common commands, arguments, and use cases.

## Terraform Console

This command is my current personal fav, the console command. As per documentation it is most commonly used for experimenting with expressions and functions. As an added extra, if the command is invoked in a folder with an active Terraform state, it will read it from the configured backend. Inspecting and experimenting with the state with Terraform’s console can be fun!

Getting to it is as simple as typing in the command line:

```
$ terraform console
```

Now we can start “playing” with our state, provided there is something in it that we can fiddle with.

For the sake of this blog post let’s create a `main.tf` file with the following contents. The file is also available in my <a href="https://github.com/parabolic/examples/tree/master/terraform/the_less_common_commands_and_options" target="_blank">examples repo</a>.

```
locals {
  map = {
    a = 1
    b = 2
    c = 3
  }
}

resource "local_file" "private_key" {
  content  = jsonencode(local.map)
  filename = "./map.json"
}
```

Needless to say, executing `terraform init` is necessary to pull the plugins and initialize the configured backend if there is any.

After, running `terraform apply` against this template, a JSON encoded file with the content of the local variable `map` will be created in the same folder. That is easy enough.

But what if I needed a YAML encoded file? I am also not sure how it will look. I prefer JSON, but I also like to have some comments.

I can check it on the fly by firing up Terraform console in the same folder and just YAML encoding the local `map` variable:

```
$ terraform console
> yamlencode(local.map)
<<EOT
"a": 1
"b": 2
"c": 3

EOT
```

Voila! We see how our file will look like if we’ve used the `yamlencode` function.

Why stop there, maybe I just need the value of the `b` key?

```
> yamlencode(local.map.b)
<<EOT
2
...

EOT
```

Swapping the keys and the values is also something that I might want?

```
> yamlencode({for k,v in local.map : v => k })
<<EOT
"1": "a"
"2": "b"
"3": "c"

EOT
```

Or just “trying” out the `try` function to see how it works exactly.

```
> try(yamlencode(local.map.d), 4)
4
```

Case in point. The flexibility that the `terraform console` provides when testing, troubleshooting, or simply playing around is immense.

## Shell Autocomplete

This is one of the commands that do not appear when I invoke Terraform via the CLI. Having worked with Terraform for quite a while myself, I stumbled upon this command fairly recently. It lets you use shell tab-completion. As of writing this blog post, it works with `bash` or `zsh` shells only.

Running this will enable autocomplete for Terraform CLI. Re-reading the shell configuration or re-reloading a shell will activate it.

```
$ terraform -install-autocomplete
```

## Lock Timeout

This is another very useful option, especially when running in an automated environment, such as a CI system. Imagine the scenario: we start two or more plans or apply jobs at a similar time. Naturally, Terraform will fail if it cannot get a lock for the state. With the option `-lock-timeout` instead of immediately failing, Terraform will retry getting the state lock for the duration specified in seconds. If Terraform cannot acquire a lock after the timeout has passed, it will fail with an error.

```
$ terraform apply/plan -lock-timeout=180s
```

## Manual State Manipulation

Usually, I edit the state via Terraform CLI. Sometimes, though, I need to manually edit it. I do it via a pull, edit, and push cycle. These commands will work regardless of the type of backend configured. The most important things to remember when manually editing a state are:

- Validate the JSON before pushing.
- Increment the `serial` key by one.

### “Pull-Edit-Push”

The following command will pull and write the current active state to the `terraform_state.json` file.

```
$ terraform state pull > terraform_state.json
```

Which has the following contents.

```
{
  "version": 4,
  "terraform_version": "1.0.4",
  "serial": 1,
  "lineage": "b538a863-c14e-c216-9309-e5e35f91468c",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "local_file",
      "name": "private_key",
      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "content": "{\"a\":1,\"b\":2,\"c\":3}",
            "content_base64": null,
            "directory_permission": "0777",
            "file_permission": "0777",
            "filename": "./map.json",
            "id": "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597",
            "sensitive_content": null,
            "source": null
          },
          "sensitive_attributes": [],
          "private": "bnVsbA=="
        }
      ]
    }
  ]
}
```

I will remove the last element in the content parameter, and now the local state file looks like this:

```
{
  "version": 4,
  "terraform_version": "1.0.4",
  "serial": 2,
  "lineage": "b538a863-c14e-c216-9309-e5e35f91468c",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "local_file",
      "name": "private_key",
      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "content": "{\"a\":1,\"b\":2}",
            "content_base64": null,
            "directory_permission": "0777",
            "file_permission": "0777",
            "filename": "./map.json",
            "id": "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597",
            "sensitive_content": null,
            "source": null
          },
          "sensitive_attributes": [],
          "private": "bnVsbA=="
        }
      ]
    }
  ]
}
```

After saving the file, “Pushing” the state back to its configured backend is as easy as:

```
$ terraform state push ./terraform_state.json
```

The “push” will fail if there’s something wrong with the state file. Otherwise, it shouldn’t provide any output.

Further verifying that the state edit is successful can be done by running either `terraform plan` or `terraform apply`.

The changes that Terraform will report attest to the successful manual state edit.

```
$ terraform apply
local_file.private_key: Refreshing state... [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # local_file.private_key must be replaced
-/+ resource "local_file" "private_key" {
      ~ content              = jsonencode(
          ~ {
              + c = 3
                # (2 unchanged elements hidden)
            } # forces replacement
        )
      ~ id                   = "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

local_file.private_key: Destroying... [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]
local_file.private_key: Destruction complete after 0s
local_file.private_key: Creating...
local_file.private_key: Creation complete after 0s [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]

Apply complete! Resources: 1 added, 0 changed, 1 destroyed.
```

As expected, Terraform reverts back to the state as instructed by the configuration in the `main.tf.` template.

## JSON Instead Of HCL

The use case for this capability is quite interesting. I can programmatically generate Terraform templates using the JSON syntax. The only requirement is for the filename to have the extension `tf.json`. Otherwise, Terraform will not pick the configuration up.

I can convert the example above to JSON like so:

```
{
  "locals": {
    "map": {
    "a": 1,
    "b": 2,
    "c": 3
    }
  },
  "resource": {
    "local_file": {
      "private_key": {
        "content": "jsonencode(local.map)",
        "filename": "./map.json"
      }
    }
  }
}
```

I would reckon it’s unusual to generate a JSON encoded file using the JSON syntax.

It is a very appealing feature I imagine is being actively used out there.

## Terraform Graph

Not the most widely used Terraform command, but most definitely uncommon. It generates a DOT (graph description language) file that I can use to render an image in a well-known format, such as PNG. Running this command in the example state yields a chart description configuration.

```
$ terraform graph
```

```
digraph {
	compound = "true"
	newrank = "true"
	subgraph "root" {
		"[root] local_file.private_key (expand)" [label = "local_file.private_key", shape = "box"]
		"[root] provider[\"registry.terraform.io/hashicorp/local\"]" [label = "provider[\"registry.terraform.io/hashicorp/local\"]", shape = "diamond"]
		"[root] local_file.private_key (expand)" -> "[root] local.map (expand)"
		"[root] local_file.private_key (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/local\"]"
		"[root] meta.count-boundary (EachMode fixup)" -> "[root] local_file.private_key (expand)"
		"[root] provider[\"registry.terraform.io/hashicorp/local\"] (close)" -> "[root] local_file.private_key (expand)"
		"[root] root" -> "[root] meta.count-boundary (EachMode fixup)"
		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/local\"] (close)"
	}
}
```

If I “pipe” this through a filter for drawing directed graphs:

```
terraform graph | dot -Tpng > graph.png
```

I get a nice image of a graph as seen in Figure 1. (I’ve also inverted the colors with `imagemagick`)

![2021 09 dot](//images.contentful.com/9snkwzlabuv8/21UZMBuLsXHpa5ASO7wXBT/81ace8489711fce7f69155ec0f75ab05/2021_09_dot.png)

Getting to know a specific technology or a tool is not as easy as it seems. Hopefully, this blog post will make some of the unusual Terraform options clearer and more usable.

If you enjoyed this blog post, please share and spread it. For any suggestions or questions, contact me at <a href="mailto:nikola@cloudlad.io" target="_blank">nikola@cloudlad.io</a>.

Terraform, The Less-Common Commands And Options

Mergers and acquisitions (M&A) are a main driver of growth for many organizations, with the main objective of cybersecurity M&A due diligence being to identify and eliminate any risks for all sides involved in the transaction. The steps involved in the M&A process often look as follows:

![mergers-acquisitions-ma-process](//images.contentful.com/9snkwzlabuv8/7oLzt28E45hJ9AFmz7Otv2/86709a7c166e68e5cc5c5829190349e6/mergers-acquisitions-ma-process.png)

Image from [Corporate Finance Institute](https://corporatefinanceinstitute.com/resources/knowledge/deals/mergers-acquisitions-ma-process/)

The M&A process isn’t completed overnight, there is a lot of information to be gathered, reviewed, and merged as separate entities combine into a joint venture. With that in mind, conducting penetration testing for cybersecurity resilience can play a crucial role in mitigating risks throughout this process.

### What is Pentesting?

Pentesting or penetration testing involves cybersecurity professionals attempting to breach specific computer systems, networks, or applications to identify areas of weakness. Pentesters are equipped to gather all of the necessary background information on a company and current ownership through M&A. 

When considering implementing penetration testing engagements for M&A, first consider the value of protecting major business assets and how those play a role in driving the merger or acquisition. Utilizing pentesting with a [Pentest as a Service (PtaaS) platform](https://resource.cobalt.io/what-is-pen-testing-as-a-service), companies planning to merge or acquire can think ahead by identifying and fixing infrastructure vulnerabilities. Furthermore, a PtaaS platform enables companies to test more assets, faster. This can be critical for M&A testing since companies in the due diligence phase will often face external factors that rush the process — external factors such as competing buyers, LOI deadlines, or other time-sensitive norms within the M&A sector.

![Vulnerability management process](//images.contentful.com/9snkwzlabuv8/4YlxZyvTSCvR96Qbq9D0dC/193be08379a73f8a952ee235a7f6d34f/Vulnerability_management_process.png)

Image from [What Is Vulnerability Management? Get the Answers You Need](https://www.g2.com/articles/vulnerability-management)

It’s recommended for companies to undergo security testing to prevent data breaches, especially prior to significant changes such as product launches associated with mergers and acquisitions. 

Explaining the importance of M&A for cybersecurity leaders, “[How to navigate events that can either make or a break a CISO's career: mergers and acquisitions and audits and penetration testing](https://www.cybereason.com/blog/ciso-career-merger-acquisition-pen-test-audit)” states: “To use a merger or acquisition as an opportunity to help them professionally, security leaders need to consider security risks that could impact the merger and communicate their plans to address those issues to the board of directors and executives at the companies that are joining.” 

### The Return of M&A
With mergers and acquisitions expected to rise in the coming year, the process remains a powerful tool used by executive teams to grow and scale their business. However, opportunities for business growth also come with potential security threats when data is involved. 

“In the post-COVID-19 economy, cyber risk and cybersecurity will play a central role in unlocking mergers and acquisitions (M&A) deal valuations. While economic uncertainty has contributed to a decline in M&A activity in the first half of 2020, many analysts expect an increase in deals during 2020-21.”

Along with this, more than one in three executives say they have experienced data breaches due to M&A activity during integration, according to [Reducing the Risk of Mergers and Acquisitions](https://securityintelligence.com/posts/mergers-and-acquisitions-without-cybersecurity-risk/).

### Cybersecurity M&A Due Diligence
“Well-executed cyber due diligence is a key factor in the successful closing of a merger or acquisition deal. With cyber threats growing in complexity, performing your cyber due diligence is essential as it protects you from a variety of financial and reputational risks. With a detailed account of a prospect’s cybersecurity and data privacy practices, organizations are better able to evaluate any risk they may incur once a deal has been finalized.” - [Why Cybersecurity Due Diligence is Essential in M&A](https://securityscorecard.com/blog/why-cybersecurity-due-diligence-is-essential-in-mergers-and-acquisitions).

[Cybersecurity due diligence in M&A transactions](https://www.nixonpeabody.com/en/ideas/blog/private-equity/2017/10/16/cybersecurity-due-diligence-in-ma-transactions) highlights these three areas to consider in cybersecurity M&A due diligence:

1. Review of the target company’s current cybersecurity policies
2. Review of the target company’s network security conducted by an outside firm
3. Deal terms in the acquisition document

Part of successful cybersecurity M&A due diligence is assessing and evaluating current organizational security posture and taking the next steps to ensure security longevity. Security planning and cyber due diligence lead to strong IT infrastructure, so your organization can see the impact on your business acquisition strategy.

### Protecting your organization throughout the M&A process
Many organizations fall short of pinpointing vulnerabilities and mitigating risks, especially when it’s overlooked in the M&A process. Considerations such as implementing penetration testing early on in the M&A deal lifecycle can make a difference before any long-term security loss or damage.

Businesses of all sizes and across all industries are subjected to cyberattacks — an internal vulnerability assessment ensures potential threats and areas of weakness are identified and prioritized to prepare for the next steps. Poor M&A cybersecurity comes at a cost: when merging with or acquiring another organization, total visibility of the companies merging is a challenge and the door can be left open for potential threats, associated fiscal repercussions, and more.

### Benefits of PtaaS to M&A

![pen-test-lifecycle](//images.contentful.com/9snkwzlabuv8/6C3jpBOBpkbIb8T06zyMES/84717bd225ee7d0c4b2c89a5cc10a235/pen-test-lifecycle_2x-221f79b5f0705a71d5d008f7f2f49174b19b0c463c8015496c5180614af5248c.png)

The Pentest as a Service model combines data, technology, and talent to resolve security challenges for modern web applications, mobile applications, and APIs.

Pentesting gives quick access to security details and insights that are crucial for security teams and long-term business plans. It lets organizations know if and how hackers are able to breach systems and compromise sensitive information. The additional level of protection pentesting provides helps teams get in front of security gaps, along with other key benefits including:

- Efficiency at speed, aligning with M&A objectives 
- Finding weaknesses in security posture
- Monitoring security performance through built-in analytics 
- Ensuring long-term business continuity
- Avoiding costly data breaches 

Whether your security team is looking to prepare for cybersecurity M&A due diligence or is interested in learning more about pentesting, read more about how[ pentesting can become a more effective layer of defense](https://go.cobalt.io/the-state-of-pentesting-2021/) for your business and discover pentesting made easy.


Pentesting for the Merger & Acquisition Sector: Cybersecurity Due Diligence

With 20+ years in the security and technology industry and a history of managing and mitigating risk across changing technologies, software, and diverse platforms, Cobalt is thrilled to have recently welcomed Andrew Obadiaru, Chief Information Security Officer. 

Andrew is responsible for maintaining the confidentiality, integrity, and availability of Cobalt's systems, services and data. With Cobalt as a security and remote-first company, he was eager for the opportunity to step in and create an impact. Continuously evaluating and adopting new technologies and frameworks is an integral part of his journey in the cybersecurity space. Understanding the relevance of these aspects within Cobalt is a motivating factor, with the goal in mind to influence security and design a growth trajectory. 

## Understanding The Role of CISO
Protecting the critical business assets of an organization is a key priority for any security leader. Prior to joining Cobalt, Andrew was the Head of Information Security for BBVA USA Corporate Investment banking, where he oversaw the creation and execution of Cyber Security Strategy for BBVA USA. Having 20 years of security experience in different industries, he has gained different perspectives and approaches to security. 

Building and leveraging an organization’s threat detection capabilities, aligned with an agile threat and incident response rooted in technologies and processes, with well defined recovery capabilities is at the core of cyber resilience. 

Andrew has a keen sense of how cybersecurity is changing and how he expects it will continue to change over the next 5-10 years. Challenges in cyber resilience will continue, and cyber resilience as a security concept is still a relatively new one for many organizations. For businesses and organizations to clear these hurdles, it’s important they shift their perspective on security from the traditional approaches to a more nimble way of doing security. It starts with how you detect, evaluate and respond to cyber security threats. 

> Leadership can not be overstated, it’s key.

As CISO, it’s an opportunity to take a seat at the table and guide decisions across the organization as a whole. With many businesses shifting to the online workspace, remote-first or hybrid brings tremendous benefits — not just to the business, but the employees as well. This phenomenon that was largely driven by the pandemic also introduces significant cyber risk to the organization and challenges to security professionals. Leadership certainly has a significant role to play. 

The organizations with leadership that are receptive to security generally do well, whereas the ones where security is seen as another cost center usually have an uphill battle with security initiatives. Security at these organizations sometimes becomes an afterthought and, at times, a costly one. As a CISO, you must be able to work with other leaders in your organization to create a true security strategy that is aligned with the organizational goals and objectives. 

It’s important to ask your organization questions such as: 

- How well defined are our current security plans and responses? 
- How well do our teams value security? 
- How quickly can we address breaches and recover?

When asked how the CISO role has changed and how he expects it to evolve, Andrew shared that the CISO role has evolved and will continue to evolve. For a CISO to be successful he/she must have a good understanding of the business as well as a solid technical background. Your ability to understand the business objectives and drivers of those objectives will go a long way in how you align and execute against your security strategy, which ultimately is a determinant of your success or failure.

Introducing Cobalt’s Chief Information Security Officer: Andrew Obadiaru 

Sharon Heimowitz

We are excited to announce that today Quartz unveiled its inaugural list of the best companies for remote workers, and Cobalt ranked number 6 out of 24 on the medium-sized companies list! 

What makes a company a best place to work? It all depends on personal preferences, but at a high level, most people would agree it’s a place that treats you well, pays you fairly, and helps you to reach your professional potential in a comfortable atmosphere.

These same desires apply to a remote job—but there are also other major considerations that ultimately determine your happiness. Do you have the right equipment, relationships, and communication you need to work effectively? Do you feel included in your company culture? Are you trusted by managers who can’t always see you? Will you have just as many pathways for growth or advancement as your office-going peers? What happens if you’re just starting out in your career? 

With that in mind, Quartz invited companies to apply for recognition in the first global ranking of the best companies for remote workers. They worked with independent research firm Best Companies Group to conduct a two-part survey of each applicant, one involving the employer and the other its employees.

The surveys assessed company practices and measured employee satisfaction in areas including leadership, pay and benefits, training and development, corporate culture, communication, and overall engagement. The survey scores determined the rankings, which comprises three lists separated by employer size: small, medium, and large. 

As Heather Landy, Quartz executive editor, puts it: “the future of remote work hinges on how adaptive and innovative companies are willing to be. That’s why Quartz’s first-ever global list of the best companies for remote workers is so important. It showcases who is leading the way—across every time zone. These are companies that are making it easy for employees to work from anywhere, encouraging them to get away from work when they need to, and offering great perks and practices for remote workers so they can do it all.” 

At Cobalt, we couldn’t agree more! Check out the [full list here](https://qz.com/work/2053446/the-best-companies-for-working-from-home/).

### Methodology & Eligibility
To be eligible, organizations were required to have at least 25 full-time permanent employees who qualify as remote workers, along with being at employers with 100+ permanent full-time employees and at least 25% of the workforce remote. Temporary or seasonal employees, per diem, independent contractors (1099), interns, and consultants were not counted as full- or part-time permanent employees, and they were not included in the evaluation process.

A remote worker was defined as someone who performs at least 75% of their job in a location that is neither affiliated with nor fully furnished by their employer.

Eligible companies agreed to submit an employer questionnaire about their policies and practices, worth about 25% of each company’s overall score. They also agreed to let our independent research partner, the Best Companies Group, survey their remote staff, with employee sentiment counting for about 75% of the total score.

### About Quartz Media
Quartz is a digitally native news organization with a mission to make business better. 50 journalists around the world specialize in analysis of the global economy for an audience of purpose-driven professionals. They help readers discover new industries,  markets, and ways of doing business that are more sustainable, innovative, and inclusive. Quartz is the top business publication for global executives ages 25-45, and has been a pioneer in premium, mobile-first, native advertising experiences since its founding in 2012.


Cobalt Named to Quartz Inaugural List of Best Companies for Remote Workers 

Jacob Fox

Pentesting and ethical hacking consist of two similar, but very different cybersecurity practices.

To the average person, these two concepts appear identical. Yet, the reality is more complex. Pentesting is more specific and a subcategory of ethical hacking. 

Ethical hacking offers companies a broader approach to identify vulnerabilities in their systems. Whereas, pentesting offers a more in-depth service specific to the assets tested, be it a web app, API or network 

With this in mind, let’s dive into the definition of both pentesting and ethical hacking to better understand what each is. Then, present a better understanding of the differences between the two.

## What is Pentesting?
Pentesting or penetration testing is the process of a trained cybersecurity professional attempting to breach specific computer systems, networks, or applications. 

Through this process, pentesters aim to provide businesses with a proactive approach to their cybersecurity program. To do so, testers identify exactly how they breach a system and report this back to businesses — hopefully, to be remediated. 

### Pentesting Defined
Pentesting as defined by <a href="https://csrc.nist.gov/glossary/term/penetration_testing" target="_blank">CSRC</a> is “A method of testing where testers target individual binary components or the application as a whole to determine whether intra or inter component vulnerabilities can be exploited to compromise the application, its data, or its environmental resources.”

## What Is Ethical Hacking?
While similar to pentesting, ethical hacking does not clearly define the assets to be tested. This key difference changes the coverage of the test and therefore, the confidence of the security vulnerabilities discovered. 

Sometimes referred to as a white hat hacker, ethical hacking consists of professional information security practitioners attempting to break into a network or computer system. If a breach occurs, an ethical hacker will report it to the vulnerable company. 

Another important note, ethical hackers have permission to breach a system before doing so, just as a pentester would. This draws a clear line between gray hat hackers and malicious exploits.

To better understand ethical hacking, consider a homeowner doing a 5-point inspection on a new home. This would cover the core aspects to ensure the property’s core systems are in good working order but wouldn’t be as inclusive as a dedicated and in-depth home inspection looking closely at each aspect of the home. 

Ethical hacking helps provide broad coverage but doesn’t have the depth pentesting does, due to the lack of scope.

### Ethical Hacking Defined
The experts at [Search Security](https://searchsecurity.techtarget.com/definition/ethical-hacker) define ethical hacking as, “an information security (infosec) expert who penetrates a computer system, network, application or other computing resource on behalf of its owners -- and with their authorization.” 

With this in mind, it’s easy to see how this broader term of ethical hacking could easily be confused with pentesting since both terms refer to penetrating a computer system or network.

While many [certificates exist for ethical hacking](https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/), pentesting requires a variety of skills specific to the assets scheduled for testing. With this in mind, let’s take a closer look at pentesting ethics and how these two terms offer slightly different ethical perspectives.

## How Does Ethical Hacking Differ from Pentesting?
![Pentesting versus Ethical Hacking venn diagram](//images.contentful.com/9snkwzlabuv8/611ptFUOy2zE7znn8undYi/3cd56b8d3ecc44f2ba596422b4d82c6b/pentesting_versus_ethical_hacking_venn_diagram.webp)

Ethical hacking differs from pentesting in a variety of ways:

1. Pentesting clearly defines the scope of the test to a specific network or computer system. 
2. Ethical hacking utilizes any attack vector to breach a system whereas a pentest will often define the attack vectors more specifically before testing. For example, a pentest will often not include a phishing email attack, whereas an ethical hack may.
3. Pentesting is required for some compliance frameworks whereas ethical hacking is not.
4. Finally, while both services will often include a timeline for the attacks, ethical hacking will often function more similarly to a bug bounty program with no hard end date.

With these in mind, pentesting and ethical hacking offer companies a different approach to a proactive cybersecurity program. That said, they do not offer the same end-goals if those are more well defined, such as with compliance or to secure a specific system.

In closing, learn more about Cobalt’s highly-vetted pentester community and how they can help secure your computer systems by identifying vulnerabilities. The Cobalt Platform offers a diverse range of experienced pentesters and across various technology infrastructures. 

The Cobalt Pentest as a Service (PtaaS) platform offers companies a faster and easier-to-use approach to pentesting. With a PtaaS platform, we combine the advanced skill set of human testers with modern software solutions to create a modern pentesting experience.

Get in touch with our [team of experts for an efficient, scalable pentest program](https://cobalt.io/get-started)!

[![Live Pentesting Demo Cobalt](//images.ctfassets.net/9snkwzlabuv8/1k89hdAR7ue7CvwFw117tw/4ae64ae16d4bb31be1525f9474702ffd/Live_Pentesting_Demo_Cobalt__2_.webp)](https://cobalt.io/get-started)

How Pentesting Differs from Ethical Hacking

*Reports from Gartner and 451 highlight innovation in modern pentesting.*

As cybercrime continues to make headlines, modern businesses are still on the lookout for ways to maintain speed without sacrificing security. With Pentesting as a Service (PtaaS), businesses are discovering how to modernize traditional pentesting — and the analyst community has taken note, based on recent research from Gartner and 451.

Cobalt’s Pentest as a Service model delivers programmatic, on-demand, manual penetration testing services for web, mobile, and desktop applications, APIs, internal and external networks. In as little as 24 hours, Cobalt can kick off a pentest. This PtaaS solution drives:  

### Speed. 
Testing is on-demand, beginning vulnerability findings in as short as 24 hours.

### Collaboration.
Teams collaborate in real-time to deliver key descriptive findings.

### Results. 
Customizable reports and analytics provide details on aggregated risk, vulnerability severity, and distribution across assets.

Our PtaaS platform, coupled with our exclusive community of pentesters, is a powerhouse combo that has helped define the PtaaS movement. 

> Cybersecurity analysts are heralding PtaaS as a key market driver. 

In its *Hype Cycle for Security Operations 2021*, Gartner hones in on how PtaaS has the potential to drive stronger ROI and mentions Cobalt among its list of representative vendors in the space. 

The recent [Market Insight Report from 451 Research](https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf) is another sterling example of how analysts are catching on to PtaaS. Data from 451 Research’s recent Voice of the Enterprise: DevOps, Organizational Dynamics survey shows organizations are finding that traditional pentesting often doesn’t deliver the outcomes needed for rapid development cycles. With traditional pentesting not stacking up to a modernized PtaaS approach, Cobalt’s platform enables security teams to review vulnerabilities in an efficient, transparent, and detailed manner. 

## The future of PtaaS
__So, what does this mean for your organization?__ PtaaS is gaining momentum and recognition as a crucial practice for long-term success. 

<a href="https://go.cobalt.io/the-state-of-pentesting-2021/"> ![CTA](//images.ctfassets.net/9snkwzlabuv8/3grkOGjhk8HIgJhlMVelAc/3ca53c8ece7341dc3fafcc3114743cf9/Content_Image__38_.png)</a>


The Buzz about PtaaS: Analysts Weigh In

## Welcome, Veera! Tell us a bit about yourself and where you're based.
I’m Veera, an Account Executive at Cobalt. I’m currently based in Berlin, but originally from Finland. I joined Cobalt in September 2018 — so, I’ve been around for some time already.

Before moving to Germany three years ago, I completed my Master’s studies in Global Sales and Marketing in Austria and the US. After completing my studies I was looking for an entry-level position in sales/marketing and that’s how I came across the MDR role at Cobalt, which was the position I started with. 

## What do you do here at Cobalt?
I’m part of the wonderful EMEA sales team, working as an Account Executive in the SMB segment. I get to meet new clients almost every day and help with their pentesting needs. I make sure each client leaves the meeting with a good understanding of what Cobalt is all about and how we can help to improve their current pentest process. In short, I own the full sales cycle, from prospecting to closing deals. 

On top of that, I have the pleasure to work with several different departments at Cobalt, whether it’s my BDR, our Sales Engineers, or our Legal Department, all contribute to helping our clients. 

## How will customers and partners feel the impact of the work you're doing?
Overall, they will have a smooth(er) and fast(er) pentest process! They’ll get to work with our talented and highly vetted Cobalt Core pentesters who will detect the vulnerabilities that exist in their applications, API, and Networks. With our centralized platform, they’ll be able to manage their entire pentest process from the very beginning to sharing results. My goal is to make the pentest experience easier and time-saving, and so far the feedback has been positive. 

## What motivated you to enter into the field you’re in? What motivates you now as an experienced professional?
My dad has influenced me, he works in sales as a Key Account Director. When I was younger I admired all the places he got to visit for business trips and conferences and even take our family to the US for 4 years. 

I’m a very goal-oriented individual, goals keep me motivated. After a successful first year in sales, I only wanted to improve for the next one. The drive for sales is built in me but it’s also my colleagues and managers who support and motivate me to always keep improving. 

I would lie if I didn’t say bringing the deal home motivates me. Every deal is different and has its own story, some come easily, some require a year of work in advance. As I hand off my client to their dedicated Customer Success Manager, the most important thing for me is they have a good understanding of our PtaaS solution and the value it will bring to them. Seeing and speaking with happy clients motivates me the most!

## What attracted you to the role? What are you most excited about over the next 6-12 months?
As I mentioned earlier, I started off as an MDR, equivalent to our BDR role today. My goal was to become an Account Executive one day and see how I would do in a sales role. Before that, I was a bit unsure if I wanted to focus more on marketing or sales. Having been an MDR for about a year I really wanted to work more closely with clients. I felt I was good at relationship building early on and it was annoying that I had to hand off the clients to Account Executives to continue the work. I wanted to be that Account Executive and help clients through the sales cycle. 

Over the next 6-12 months I’m excited to help onboard new colleagues to the EMEA sales team. There’s a lot of opportunity in the EMEA region and I’m happy to support in any way I can. 

Cobalt has been unbelievably supportive when it comes to building a career and family at the same time. I’m super excited to start my second maternity leave with Cobalt around mid-November. 

## What's your ideal superpower?
If I could have one superpower it would be being able to teleport myself and my family to places. Living away from family and missing out on important occasions is something I would change if I could. 

## Is there anything else you would like to share?
Thank you to all who I’ve had the pleasure to work with thus far, whether you're a Cobalter or a client! 
