Mary Elliott

At Cobalt, we keep our customers’ security top of mind. That’s why we are delighted to announce the launch of our Cobalt Professional Services. This set of six different offerings is designed to boost the maturity of your organization’s current security program, and through strategic services, also enable security teams to offer the utmost value to their company.

__What professional services does Cobalt offer?__

### Pentest Program Management

Cobalt partners with your organization to provide the strategic guidance needed to take your pentesting program to the next level. Our seasoned security consultants are here to help with asset identification, prioritization, pentest setup, integration support, recurring security roundtables, and more. 

Key benefits include improved overall security posture through a matured pentest program and optimization throughout the pentest process with your team, including:

- Technical scoping
- Strategic planning
- Quarterly Maturity Assessments and more

For more information, download our [Pentest Program Manager brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Pentest%20Program_Service%20Brief.pdf). 

### Advisory Services

__Don’t let a security question go unanswered due to a lack of time, talent, or resources.__ 

Your security team is one email away from getting the answers you need from seasoned industry professionals. Whether you need a second set of eyes on a presentation, help determining which security controls to focus on next, or an explanation of a compliance standard, Cobalt’s Security Advisors are standing by to help.

- Quick access to security expertise 
- Response times in under 2 business days
- Access to best practice templates
- Strategic guidance
- Option to schedule calls with a security consultant for complex problems 

For more information, download our [Advisory Services brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Advisory%20Services%20Brief.pdf). 

### Phishing Engagements

__Did you know that successful phishing attacks are one of the most common causes of a cyber breach?__

It’s important to understand how your controls and users stack up to this attack method. Cobalt’s seasoned Security Consultants work directly with you to understand exactly what you need tested and to build a custom program. 

For more information, download our [Phishing Engagements brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Phishing%20Services_Service%20Brief.pdf). 

### IoT & Device Testing

With Cobalt’s IoT and Device Testing, you can ensure that physical access, or proximity, to your company’s IoT devices doesn’t leave you unnecessarily vulnerable. Our engineers go beyond normal network and application pentesting techniques and focus on hardware, firmware, and radio communication vulnerabilities.

For more information, download our [IoT & Device Testing brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/IoT%20and%20Device%20Testing_Service%20Brief.pdf). 

### Red Teaming

Cobalt’s Red Teaming services are an extension of our modern streamlined pentesting platform. Our security experts will define the scope of work and timelines before kicking off the testing process. Testing is transparent and collaborative, with a few of the key benefits including:

- Test the strength of your defenses
- Better understand your unique technical risk
- Validate your security posture to executives

For more information, download our [Red Teaming brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Red%20Teaming_Service%20Brief.pdf).

### Code Review

Code is a critical business asset — not only does it contain all of the critical details of your application’s functionality, it also holds insights into hidden, exploitable vulnerabilities. Our experienced engineers are equipped with the right skills to review code and identify vulnerabilities that can prevent a future breach.

For more information, download our [Code Review brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Code%20Review_Service%20Brief.pdf).

It’s time to take the next step to drive your business forward efficiently and securely. Cobalt’s Professional Services offer your business results-driven benefits, fully guided by skilled security professionals. Interested in learning more? Send us an email at professional_services@cobalt.io.

<a href="mailto:professional_services@cobalt.io" target="_blank">![Content Image - CTA [blog assets]](//images.contentful.com/9snkwzlabuv8/4cGgT1pPTyMYjaZ7DPSPBI/ac16bf91b62fdb15d279812808d5d280/Content_Image_-_CTA_-blog_assets-.png)</a>

Strengthen Your Security Posture with Cobalt’s Professional Services


Running a marathon is a long-term commitment — just like continuously protecting your business from cyberattacks. Both require implementing the proper strategies, training, and upkeep to stray away from potential injuries or vulnerabilities that can hinder your end goal. 

Wednesday, October 6 2021, Cobalt’s SecTalks security conference will set your security team on track with proven strategies to evolve, improve, and advance to the next level. Security for the long run isn’t a sprint, it’s a steady race. It’s important to focus on how to measure the impact of your programs and how other businesses are learning, collaborating, and applying industry best practices. SecTalks will jump into topics covering communication, business acumen, what workflow changes can increase productivity, and more. And, it all doesn’t just happen overnight — slow and steady wins the security race. 

## A Look Into the Agenda for SecTalks 2021
Cyber crises are often unpredictable, but the right tips from industry professionals can prepare your team for reaching the finish line and focus on moving forward safely and securely. 

### The State of Pentesting 2021 
The State of Pentesting is one important tool to set your team up to run in the right direction. Based on 1600+ pentests, Cobalt experts will explore the most widespread vulnerabilities and how to prevent setbacks that can slow your remediation down. 

### How to Negotiate: Security Career Tips
Roadblocks along the way are inevitable, so learning how to handle tough conversations with leadership on budgets, organizational goals, team performance, and hiring can help overcome possible hurdles. Speakers will “coach” on how to effectively represent security in wider business conversations. 

### Make Security Stronger: Creating More Efficient Workflows 
The move to DevSecOps is accelerating, and security workflows strain to be faster, more agile, and collaborative to reach their end goal. This session will give insights into one team’s strategy to meet these demands with the right combination of tools and human ingenuity. 

### CXO AMA
Having access to pro tips is key to improving performance. A panel of C-suite executives will answer questions in this session about the most important security data points to bring to a board meeting, how to handle M&A activity, and more. 

## Introducing This Year’s Speaker Lineup
Here’s a sneak peek at a few of the speakers at the upcoming SecTalks — presenting key insights from decades of experience.

__Jennifer Czaplewski__ - Senior Director, Cyber Security at Target

Jennifer is an innovative cybersecurity leader known for building and delivering critical security functions. She is an industry leader in DevSecOps and frequently shares insights at thought leadership forums like RSA, the Cyber Security Summit, DevOps.com, and All Day DevOps. She is a patent holder and her work has been featured in SC Magazine and Dark Reading.

__Charles Nwatu__ - Engineering Manager, Corporate Security & Security, Technology Assurance & Risk (STAR) at Netflix

Charles works in the Information Security and Monitoring domain, known for creating dynamic teams that develop and engineer robust security capabilities.

__Jay Paz__ - Director of Pentest Operations and Research, Cobalt 

Jay has more than 12 years of experience in information security and 19+ years of information technology experience including system analysis, design, and implementation for enterprise level solutions. He has a robust background in developer supervision and training as well as in major programming languages, operating hardware and software, and major infrastructure application development.

__Tony Spinelli__ - Digital CIO & Cybersecurity Pioneer

Tony has worked for some of the world’s most critical companies, developed next gen digital tech, and pioneered new cloud and cybersecurity strategies. His recent focus has been on driving deeper digital insights with human and AI teaming, machine learning, and analytics, with cybersecurity as an enabling strategy. 

__Caroline Wong__ - Chief Strategy Officer at Cobalt

As CSO, Caroline leads the Security, Community, and People teams at Cobalt. She brings a proven background in communications, cybersecurity, and experience delivering global programs to the role. Caroline also hosts the Humans of InfoSec podcast, teaches cybersecurity courses on LinkedIn Learning, and has authored the popular textbook Security Metrics, A Beginner's Guide.

__Anne Marie Zettlemoyer__ - Business Security Officer | Vice President, Security Engineering at Mastercard

Anne Marie is a cyber-strategist with over 20 years of experience in eight industries. At the intersection of business, security, and analytics, Zettlemoyer has served as a trusted advisor for Fortune 500 companies, government agencies, startups, and think tanks. 

How will your team apply industry best practices and panel insights to get faster, smarter, and stronger and stay ahead of the curve? Be sure to [register](https://cobalt.io/sectalks) for Cobalt’s virtual SecTalks security conference on Wednesday, October 6 2021, to learn more about the latest in cybersecurity from industry experts.

[![Sectalks 2021: faster, smarter, stronger cybersecurity event](//images.contentful.com/9snkwzlabuv8/7fJBXGhn49JwA94ALmUQZ1/43593937db2d0dded498a51de75fa62f/Sectalks_2021_-_faster__smarter__stronger_cybersecurity_event.webp)](https://cobalt.io/sectalks)

Faster, Smarter, Stronger: Get on Track for Cybersecurity Success with SecTalks 2021

Analysts at 451 Research are lauded for their data-driven, global insights. For anyone who isn’t familiar with this leading research and advisory organization: the team of analysts engages with IT industry leaders to share key market findings and trends that can be pivotal for technology and service advisors.

Recently, 451 did a deep dive on Cobalt — our business model, differentiators, and value prop — along with a SWOT analysis. Here’s what analyst Aaron Sherrill had to say: 

Organizations are discovering the ways traditional penetration testing engagements aren’t measuring up to a modernized approach. __Traditional pentesting provides only a point-in-time snapshot of an enterprise’s risks, weaknesses, and vulnerabilities, and often fails to:__

- Deliver the outcomes needed for rapid development cycles
- Provide interaction with testers during or after testing 
- Maximize retesting capabilities to ensure issues have been fully remediated
- Give the insights needed for a data-driven security program

With that in mind, these shortcomings of traditional pentesting are becoming ever more critical. 451 Research’s recent *Voice of the Enterprise: DevOps, Organizational Dynamics* survey collected data that suggests a growing percentage of organizations are accelerating or newly introducing initiatives to add security to DevOps workflows. Because of this acceleration of adding security to DevOps, the time is here for traditional pentesting to evolve.

## Introducing: The Cobalt Platform

Cobalt’s Pentest as a Service (PtaaS) platform aims to modernize the traditional penetration testing model by delivering programmatic, on-demand, manual penetration testing services for web, mobile, and desktop applications, APIs, internal and external networks. In as quick as 24 hours, Cobalt can begin penetration testing and delivering the people and process innovation required to drive better security.

> “Organizations of every size and industry are seeking to improve their cybersecurity posture; however, access to frequent security testing has been beyond the scope of expertise and resources of most organizations. Cobalt’s flexible, tailored and integrated approach to on-demand, programmatic security testing is designed to meet the needs of both rigorous testing approaches and organizations that are just beginning their security testing initiatives.”

Interested in learning more about how Cobalt’s modernized Pentest as a Service (PtaaS) platform can provide value to your business security? Read more in the full [Market Insight Report](https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf). 

<a href= "https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf "> ![451 Research](//images.contentful.com/9snkwzlabuv8/4zGktLiTp70lkOb7tcN60G/44f6a2850536546dbcbd202efa0c9a03/Content_Image_-_CTA_-blog_assets-.png) </a>

*Source: 451 Research, Coverage Initiation: Cobalt aims to  modernize traditional penetration testing with its pentest-as-a-service model, June 2021, All Rights Reserved*

451 Research Takes a Close Look at Cobalt in Latest Report

### Welcome, Ravi! Tell us a bit about yourself and where you're based.
I’m half Indian and half German, born in East Berlin 18 years before the reunification of Germany. I’m into black music — Rap, Hip-Hop, and Jazz, a I’m also a die-hard Trekkie. I originally started out in sciences and studied Biology (Maj. Genetics) at the University of Cologne. It was the early 90s when there weren’t a lot of opportunities in this field. No one wanted to make their best customer a barkeep in their bar, and I was forced to look elsewhere for an income. In 1996, I started out as a freelancer for Java-Programming, Apple Systems Integration, and On-site support for Macs. Around 2007, I focused just on Java-Programming and also became employed. Finally in late 2010, I moved back to Berlin and roughly 2 years ago I joined Cobalt as an Engineering Manager.

### What do you do here at Cobalt?
I’m currently working with the Employee Experience, the Pentester Experience, the Data team, and QA as a Director of Engineering. Trying to help the teams, as well as Cobalt in general, grow without compromising our culture and values. At the same time, I’m also identifying ways with them and our stakeholders that we can get better and continue to up our game.

### How will customers and partners feel the impact of the work you're doing?
Hopefully, they won’t! They should feel the impact of the teams, though.

### What motivated you to enter into the field you’re in? What motivates you now as an experienced professional?
At some point in the past, I became bored with working as a developer and decided to make a switch into the area of people development. I’ve seen too many cases in my career where everyone became frustrated because they weren’t able, or chose to ignore, the intricacies of working with human beings. Coming from a background in thinking complexity and systems-thinking (biology), I know there is a better way to do things. Doing what is good for the teams and the people, while also increasing productivity and quality, and even doing something for our bottom line. Those areas are actually not mutually exclusive.

### What attracted you to the role? What are you most excited about over the next 6-12 months?
Because I became bored and frustrated with how things were handled at my previous employer, I quit and searched for companies with the traits and values I had in mind. After some interviews, I came across Cobalt and a couple of Zoom calls later I joined.

### What's your ideal superpower?
Being an Aspie! ;) I’m a good listener, and I always try to listen to understand the person — the human being.

### Is there anything else you would like to share?
It’s truly awesome to be able to work with such a bunch of highly motivated, smart, driven, and fun people!


Get to Know Ravi Yadav, Cobalt's Director of Engineering 

Adam Markowitz

Back in May 2020, Cobalt achieved their <a href="https://cobalt.io/blog/how-to-become-soc-2-type-1-certified-and-elevate-your-status" target="_blank">SOC 2, Type 1</a> compliance and is excited to say it is now SOC 2 Type 2 compliant as well. <a href="https://drata.com/" target="_blank">Drata</a> helps companies like Cobalt successfully achieve and maintain  SOC 2 and ISO 27001 compliance. This article delves into the differences between SOC 2 Type 1 and Type 2, how to obtain Type 2, and how a compliance automation platform like Drata can help you easily achieve these goals. 

## Why become SOC 2 Type 2 compliant?

With security top-of-mind for most companies, achieving SOC 2 compliance offers tangible proof that the security controls your organization put in place meet industry standards. When customers request to confirm your security posture, providing a clean SOC 2 attestation report ensures you’re processing and storing their data securely.

Companies may have different reasons for pursuing SOC 2. A few common drivers include:

- Contracts: Particularly around cloud services, customers are increasingly requesting vendor SOC 2 reports for review.
- Third-party Vendor Questionnaires or Customer Requests: Prospects and customers need to assess security risk for all new service providers. If a provider does not have a SOC 2 or equivalent attestation, they are required to answer questionnaires related to security controls. Standard security questionnaires like the CAIQ can have just under 300 questions.
- Marketing and Business Strategy: For young or growing companies, a SOC 2 report can be used as a competitive differentiator showing the market that a baseline level of security and process maturity has been achieved.

## Difference between SOC 2 Type 1 and Type 2

- SOC 2 Type I - This report attests to the design of your organization’s security controls at a single point-in-time. 
- SOC 2 Type II - This report attests to the design and operating effectiveness of your organization’s security controls over a period of time, typically 6 months to a year.

## Why it is important to use a platform that automates compliance 

Drata alleviates the burden of manually overseeing and maintaining compliance. Its highly automated platform continuously monitors your organization’s security controls, while automatically collecting control evidence, and streamlining security training, vendor management, and reporting to provide visibility into your entire security posture.

- Continuous Control Monitoring - Real-time monitoring and assurance of your security controls, with alerts to notify you if your security is at risk or a gap is formed
- Automated Evidence Collection - Significantly reduce the time traditionally spent on manual compliance tracking of spreadsheets, screenshots, and more.
- Policy Templates - Stay up-to-date with ongoing industry standards with auditor-approved security policies to kickstart your security program
- Dedicated Support - A team of experts ready to support you every step of the way, whether you’re new to or familiar with compliance

## Why pentesting is a requirement

Process Controls demonstrate the steps a company is taking to control risk, including the documentation and proof the company is following these steps. For example, one way to mitigate risk is to implement and maintain a vulnerability management program. One area of your vulnerability management program is your pentest program. 

Because of the ever-evolving security landscape and exponential rise of threats, it is recommended to establish a cadence of pentesting to ensure your applications are continuously evaluated. Your schedule and process should be documented and followed repeatedly. Also required in a vulnerability management program is the remediation of vulnerabilities. 

While continuous evaluations sound like an intensive and highly manual process, compliance and pentesting tools can connect to alleviate much of the work for your security team. One such example is the combination between Cobalt’s Pentest as a Service platform and Drata’s security and compliance automation platform — together, they can automate large portions of your compliance roadmap.

Hear from the Founder and CEO of Jarvis Analytics how his team was able to achieve this from this on-demand webinar recording: <a href="https://webinar.cobalt.io/building-security-and-compliance-webinar" target="_blank">“Building a Security & Compliance Roadmap: The Why & How for Health Tech Companies” </a>

<a href="https://webinar.cobalt.io/building-security-and-compliance-webinar" target="_blank"> ![drata cobalt building security webinar 1104 736](//images.contentful.com/9snkwzlabuv8/1cKhbjHpIdbEhiBMDFuBpc/2b2fdb8cb329395fd67ce89fe4754415/drata_cobalt_building_security_webinar_1104_736.webp) </a>


How to Achieve SOC 2 Type 2 Compliance

Jesse Rivera

# Pentest Diaries Ep.8: Android Pentesting Highlights 

In this edition of Pentest Diaries, we had the opportunity to sit down with three of our distinguished Core members to talk Android Pentesting. We were joined by <a href="https://twitter.com/harshbothra_?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" target="_blank">Harsh Bothra</a>, <a href="https://twitter.com/pcastagnaro" target="_blank"> Patricio Castagnaro</a>, and <a href="https://twitter.com/b0rn2pwn" target="_blank"> Vinesh Redkar</a>. A lot was covered in our time together, so we'd like to touch on some highlights from those learnings. 

__Listen to the podcast here:__

<iframe src="https://open.spotify.com/embed/episode/5N4TlI3xsv5vnfjvUN6yYh" width="100%" height="232" frameBorder="0" allowtransparency="true" allow="encrypted-media"></iframe>

__Watch the podcast video here:__ 

<iframe width="560" height="315" src="https://www.youtube.com/embed/tedYad-Uj-w" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Also, we provided the list below so you can dive straight into the sections of the podcast most relevant to you! 

__1:00__ Opening Moves
__6:00__ Tools Used
__11:00__ Time Consumption
__18:14__ Blockers in Android Pentesting
__27:00__ Exploit Chains
__36:55__ Windows 11 and Android
__43:12__ Why is Android pentesting important?

Listen to the whole podcast to get the most out of the Core's amazing takes on this subject. 

## First Steps in Engagement  

It is important to get your bearings before any engagement. Mindfully charting a course and using experiences from previous engagements provides a repeatable path for success. 

So, our guests opened up to their “First Steps” during a Pentesting engagement. 

__Harsh Bothra__ started by saying, “__*Before the engagement starts, I quickly make sure that some of the protections for SSL pinning and root protections are in place or not - in case they are bypassable. So we can convey to the client, 'This is not bypassable, this seems like it might take some time to bypass it'.*__” 

Harsh will then set up his workflow based on this assessment. He plots a course through the application from API, to static functionalities, and finishes with dynamic testing. In retrospect, also shows a healthy amount of communication between being a pentester and conferring with a client to ease the burden of testing. 

__Patrio Castagnaro__ followed by stating he, “__*Always uses the application as an end user at the beginning of the project, because I can get a better understanding of the application, about the functions, the uses cases - because the applications doesn’t always have documentation.*__” 

He does this to define his understanding of the application workflows and to identify the protections in place. Some of these protections include anti-emulation, SSL pinning, and ciphered code. 

__Vinesh Redkar__ stated, "__*I always start my assessment after understanding the business requirement, right? First, I need to understand what is the business case which they are trying to achieve by using this application. Then I can build the test cases also associated with those business cases.*__”  

__Vinesh__ goes on to explain how he uses the OWASP mobile application checklist to perform his assessment and breaks it down into “__*Static, Dynamic, and local storage analysis.*__”  

## Android Pentesting Tools

General pentesting comes with an extended gallery of tools. They range from those that are industry standards, to repositories that hold unknown treasures as-well. However, I was interested in asking our pentesters what they use personally for their Android engagements. 

This was a rough list of the tools suggested by __Harsh__, __Patricio__, and __Vinesh__. 

<a href="https://frida.re/docs/android/" target="_blank">Frida</a> - Frida is used for dynamic analysis. It can be utilized as an intercept, and to inject your own javascript. 

 <a href="https://frida.re/docs/android/" target="_blank">APKLeaks</a> - Scans the apk file for URIs, endpoints, and other hidden valuables. 

<a href="https://portswigger.net/burp" target="_blank">Burp Suite Pro</a> - Used in dynamic pentesting as an intercept for the application. 

<a href=" " target="_blank">ABV (Android Verified Boot)</a> and <a href="https://developer.android.com/studio" target="_blank"> Android Studio </a> - Used as developer environments to research Android applications. 

<a href="https://github.com/linkedin/qark" target="_blank">Qark</a> - An automated static analysis tool designed originally for malware analysis scoring. It provides threat intel that functions as a way to find static issues quickly.

 <a href="https://github.com/skylot/jadx" target="_blank">JADX</a> - Used for source code analysis - can be used to see if there are obfuscation tactics used.

<a href="https://github.com/nccgroup/house" target="_blank">House</a> - Designed for helping assess mobile applications by implementing dynamic function hooking and intercepting

## Mind Maps and Checklists 

After discussing tools, the importance of mental mapping and checklists took the stage. 

__Particio__ mentions that using OWASP checklists aids in processes outside of your own because, “__*You can mark what you do, in which category, (for instance) Static analysis. Did you do all the tasks for static analysis?...you can end up finding something, pause, and then forget some tasks that are really important. Even if it’s not a mind map, it’s important after 2-3 days to go back to the checklist to see if you’ve forgotten something.*__”

This speaks to the many variables pentesters are constantly keeping track of. Being organized during a test helps with the gamut of parallel processes a pentester is keeping track of through any engagement. These checklists allow you to walk yourself back, after wandering off on another lead you may find. 

__Vinesh__ added that, “__*Sometimes when you do a pentest, things can become too complicated. You are not sure from which point to choose statics/checklist or mindmaps, but also what’s happened to me a lot of times is that the application is a lot bigger than it’s scope initially…(so) there is the possibility you might miss something.*__”  

It was brought up that __Harsh__ had previously created an incredible <a href="https://www.xmind.net/m/GkgaYH/" target="_blank"> mind map </a> for Android pentesting. I highly recommend this resource to pentesters at any level.

## Blockers

Our conversation shifted into a subject pentesters should always be aware of, blockers. It is a gift to know what potential roadblocks can happen during these tests. When it comes to Android, this is what they had to say.  

__Harsh__ was the first to go stating, “__*I always raise my hands for SSL pinning and root detection, because they (the client) always want it. Especially when the client is like ‘We want you to bypass it, we want to see how much defense-in-depth we have already implemented.’ Another, is when you find traffic that is encrypted.*__” 

__Patricio__ remarked on how the value of what is being tested could shift. How meaningful steps made in a pentest might not hold weight for a client looking for specific results.  He stated, “__*There are different objectives like, ‘Hey, we don’t care about the platform protections (which could be Android, iOS, etc) we want to focus on the business logic. Why? Because we are moving money, or we are banking, or we are a financial application and we really want to put the focus there.’ ...Because you can spend, I don’t know,5-3-10 days and then go to the next step, and that step wasn’t important for the customer.*__”

__Vinesh__ brought up a great point in stating, “__*As per the regulation, or as per their organization, they have different risk metrics, right - to categorize this list. So, based on the client's justification we will report root detection, but they can consider that root detection does not apply to the application. It is based on the business and their organization.*__"

He continued, “__*For the company report we have all listings, right, and also explain the pentester’s point of view to them. Like, ‘I chained this attack - and chaining is very important.’ If we are able to demonstrate attacks which are mentioned in the checklist are connected and that is causing a major impact, then we might be able to convince them, ‘Yes, this pentest is showing value, because we were able to chain this attack’...instead of them just accepting the risk.*__”   

## Exploit Chains

Next, we discussed exploit chains. I highly suggest you listen to this section. The stories and tricks used by these pros should be heard firsthand. You can find the start of this conversation at 27:00.  

## Feelings on Windows 11 Native Android 

Windows 11 is just around the corner. With every new OS starts an open season for unseen vulnerabilities sneaking past code review, and under the scale of a massive launch. It was suggested there will be an Android subsystem that will bridge Android applications to run native to X86 systems. I decided to ask about their perspective on an Android subsystem as pentesters. 

__Harsh__ started by stating, “__*I feel like a lot of botnet networks are going to come soon because of that. Also, local privilege escalations, and sandbox escapes are going to come on to the market. Because Android and Windows, you’re basically combining two different operating systems into something - and making isolation layered for that would be an interesting thing for a lot of researchers.*__”    

__Vinesh__ then brought up an important note about the release stating, "__*I think that Microsoft clearly states that they are not going to allow android apk to be installed on the application at the moment. They are only allowing it from the amazon app store.*__"

He explained that the possibility of attack could theoretically happen - if this was implemented like the Linux subsystem explaining, “__*If you see Ubunutu, how the system works on Windows 10, it basically has access to your local directory as well, right - same for Android also. Even if they do the sandboxing, something will be accessible by that Android environment. Which is hosted on the Windows platform. There could be a credential type attack possible - like running a mimkatz on that system and dumping windows lsaas file and export it to yourself somewhere else.*__"

We closed on the guest's opinions on the need for Android pentesting. Again, I believe this one is best heard firsthand too.  

Thanks again to <a href="https://www.linkedin.com/in/harshbothra" target="_blank">Harsh Bothra</a>, <a href="https://www.linkedin.com/in/pcastagnaro" target="_blank">Patricio Castagnaro</a>, and <a href="https://www.linkedin.com/in/vinesh-redkar-aab01549" target="_blank">Vinesh Redkar</a> for making this an engaging and thoughtful discussion around this subject. Connect with them on LinkedIn and follow on Twitter for more of their takes on offsec! 


Pentest Diaries Ep.8: Android Pentesting

Lukasz Wierzbicki

I have come across many interesting vulnerabilities throughout my offensive security career. In this post, I would like to share valuable learnings around how an individual can turn a CSRF and file upload  into a Remote Code Execution. My goal is to share insights with the community around how to look for this vulnerability type. 

__TL;DR:__ Administrative actions performed by the user are vulnerable to CSRF attack. Privileged users can upload any file. There were at least two ways to define where that file could be uploaded. That leads to double RCE using the same attack vector.

Now let’s dive into my thought process to executing this attack: 

During the initial testing stage, I focused on getting familiar with the application, identifying an underlying technology and understanding the application’s functionality. Any [OSCP](https://www.offensive-security.com/pwk-oscp/) cert holder knows it by memory – enumeration. A word with a wide variety of meaning in the pentesting world.

When it comes to the technical aspects of web application, reconnaissance is a crucial step –  a good starting point is the [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/). Understanding an application from a business perspective can be achieved by reading application help files, analyzing customer documentation, and walking through an application following business processes. It’s useful to look at the business processes implemented by the application and identify possible gaps in the application logic.

When I went through the application, I was able to easily find a XSS vulnerability (thanks to [Reflection](https://portswigger.net/bappstore/8e8f6bb313db46ba9e0a7539d3726651) – Burp Suite extension). When I verified underlying HTTP requests sent to the server in Burp, I noticed that not every POST request had a CSRF token added. Additionally, business processes were based on processing files: images, documents, and any other evidence files. Processing of these files, as expected, was combined with file upload. 

Let’s summarize, I gathered the following information:
- It was a Java application served by Apache Tomcat.
- Application had many file upload functionalities.
- Not every endpoint of the application had CSRF protection.
- Multiple path disclosures provided location to where files are stored and application webroot is located.

I didn’t end the enumeration at that point. I already had some information about the application, but I was still missing information on how the application maps to the underlying filesystem on the server. Everything which is stored in the application webroot directory is available through the browser and can be discovered by visiting each application's functionality, reading Javascript files, performing bruteforce discovery or using a web archive. But where is the application webroot? With help here came verbose responses from the server. Successful and unsuccessful requests disclosed the location where the file was uploaded or at what Java file error occurred. Analysis of this information gave me information about application webroot and where the application stored files. The application stored image files in '/app/xxx/files/upload`, document files in `/app/xxx/webapp/temp` and application webroot was `/app/xxx/webapp`. I wondered if these path disclosures can be combined with file upload? So I started checking the file uploads and testing two things:

- Can I upload any file? __Observation: content of a file and its extension is not modified__
- Where is a file uploaded? __Observation: as expected file is uploaded to `/app/xxx/files/upload` on filesystem__

Additionally, I checked if it is possible to modify the path where files are uploaded and this was possible from the administrative panel. I confirmed that an administrator/privileged user can change the path where files are uploaded. The next step was to take a closer look at the request which is sent to the application which makes that change of the path. Previously I spotted lack of CSRF protection in the requests and the same pattern I noticed in that request. Quick test using Burp Repeater allowed me to confirm that it is vulnerable to CSRF attack. 

Results were:
- Image files could have any content and extension (unrestricted file upload)
- Document files were uploaded to `/app/xxx/webapp/temp`, because they were instantly accessible from the web through a link like this: https://[application_url]/temp
- Administrator can change location where document files are uploaded

So, I combined that into the following intelligence:
- administrator could change location where files are uploaded, 
- administrator could upload any file as a image file and
- filesystem location `/app/xxx/webapp/temp` is accessible from the web under the URL: https://[application_url]/temp/

I changed the location where the image files were uploaded to `/app/xxx/webapp/temp` and then uploaded a simple jsp webshell as an image file. The uploaded file was available at https://[application_url]/temp/cmd.jsp. That gave me the code execution on the system.

![From CSRF and File Upload to RCE - JAVA](//images.contentful.com/9snkwzlabuv8/3gMOYAydfER7VGjVShL9bH/2eb048b463e7df69361de0f8f273396b/RCE__1_.png)

Picture 1: Webshell executing `id` command and confirming code execution on underlying server.

From that point I just needed to put it all together. I found a way to get a command execution (RCE), but it could only be done by a privileged user(administrator). I noticed before that the administrative requests were not protected by anti CSRF protection. First, I minimized my request by removing unrequired HTTP headers, fields and parameters. Then, I crafted a CSRF proof of concept page, and administrative actions were successfully performed. 

At that point, it was not very difficult to draw an attack vector. I had XSS, CSRF on activities related to upload, and RCE via upload. An attacker could use reflected XSS or stored XSS and inject a code, which would trigger a CSRF attack and then get the RCE via upload. Also, an attacker could just send the link to a page, which would trigger CSRF and give RCE. 

Let’s present potential attack scenario:

1. An attacker could create a reflected XSS payload. This XSS payload could be base64 encoded.
2. An attacker could send a link to a victim who has privileged access to the application (and would be logged in).
3. XSS payload could be triggered by the victim. Javascript code from the XSS vulnerability could run in the context of a victim. CSRF attack could be performed from that Javascript code. Action performed by exploiting CSRF could make changes to the application (changing upload path and uploading a webshell).
4. An attacker could then connect to the uploaded webshell. With uploaded webshell an attacker would be able to run any command with privileges of the user who ran the application. That would lead to compromise of the underlying system.

Blueprint of XXS payload (Javascript code) which can be used for that scenario:

```############
function setPath()
{
    var request = new XMLHttpRequest();
    request.open("POST", ENDPOINT1, true);
    request.setRequestHeader("Content-Type", "application\/x-www-form-urlencoded");
    request.withCredentials = true;
    var body = PAYLOAD;
    request.send(body));
}
function sendFile()
{
    var formData = new FormData();
    var content = WEBSHELL_CONTENT;
    var blob = new Blob([content], { type: "text/html"});
    formData.append("file", blob, 'test.jsp’);
    var request2 = new XMLHttpRequest();
    request2.open("POST", ENDPOINT2);
    request2.send(formData);
}
setPath();
sendFile();
############
```

With code execution I read an application code (access to the source code) and checked what is going on under the hood on the server. This change blackbox approach to whitebox. That made further examination easier. 

I went back to enumeration. I looked for new ways to achieve additional command execution. With endpoints and functionality already identified, I focused on the potentially dangerous functions. That didn’t give any success. Then I found out that there is an additional channel to communicate with the application through the REST API. I checked the application documentation and discovered that there is a REST API endpoint `https://[application_url]/rest/uploadfile`. This endpoint handles general file uploads and takes filename and filepath as parameters. I sent a basic request to the REST API, intercepted it and sent it to the Burp repeater. Then I started modifying it and applied required parameters from documentation. With a crafted request I was able to upload a file. But it didn’t give me the second code execution straightforwardly.

I was intrigued by the endpoint `https://[application_url]/rest/uploadfile`. With code execution I had access to the filesystem and I was able to read the source code of this endpoint written in Java. I read its code and found out that filepath was stripped from any path traversal techniques. And even if you can specify the filepath, the application needs to have write permissions in that filepath. I used previously obtained knowledge that a good upload location is  `/app/xxx/webapp/temp`. Location `/app/xxx/webapp/temp` was used to store document files and was accessible from the web under the URL https://[application_url]/temp/. I modified my crafted request to the endpoint `https://[application_url]/rest/uploadfile` and put parameters filepath as  `/app/xxx/webapp/temp` and file as content of simple jsp webshell. File was uploaded and I was able to access it at https://[application_url]/temp/cmd.jsp. That gave me the second code execution on the system.

Let sum up:
- Endpoint `https://[application_url]/rest/uploadfile` allowed any file to be uploaded but had limitations around where it could be uploaded. 
- Location `/app/xxx/webapp/temp` can be used to write any files and was accessible from the web under the address https://[application_url]/temp/

## Key Takeaways
From an offensive security perspective:
- Analyze initial enumeration result. Sometimes you’ll notice a pattern that allows you to chain small bugs to get higher severity. 
- Drawing the potential attack scenario could help you present the impact and severity to the customer. 
- Any file upload functionalities should be tested intensively. 
- Think out of the box!

From a defensive security perspective:
- Review impact and analyze reported findings. Security operations know more about an application and its environment than pentesters - it is possible to find additional vulnerabilities and impacts that pentesters were not even aware of.
- Client side vulnerabilities (CSRF and XSS) could allow the attacker to perform action as an administrator. 
- Ensure that the user provided input is sanitized and encoded.
- Limit file formats that users can upload.
- Check uploaded files with AntiVirus.
- Follow web application best practices.
- Regularly perform pentesting to look for weaknesses. 


From CSRF and File Upload to RCE - JAVA

Nikola Velkovski

*This post was originally published on <a href="https://cloudlad.io/" target="_blank">cloudlad.io</a>*

The most frequently used Terraform commands, plan, apply, and destroy, are the first things I learned when I started using Terraform. Primarily because those commands are a crucial part of Terraform’s cycle. Over time, as Terraform and its community grew, the features of Terraform grew in parallel. Now there are a lot more commands, options, arguments, and functions. Some are not used as often, and some do not even show when invoking the help menu.

In this blog post, I want to talk about the not-so-very common commands, arguments, and use cases.

## Terraform Console

This command is my current personal fav, the console command. As per documentation it is most commonly used for experimenting with expressions and functions. As an added extra, if the command is invoked in a folder with an active Terraform state, it will read it from the configured backend. Inspecting and experimenting with the state with Terraform’s console can be fun!

Getting to it is as simple as typing in the command line:

```
$ terraform console
```

Now we can start “playing” with our state, provided there is something in it that we can fiddle with.

For the sake of this blog post let’s create a `main.tf` file with the following contents. The file is also available in my <a href="https://github.com/parabolic/examples/tree/master/terraform/the_less_common_commands_and_options" target="_blank">examples repo</a>.

```
locals {
  map = {
    a = 1
    b = 2
    c = 3
  }
}

resource "local_file" "private_key" {
  content  = jsonencode(local.map)
  filename = "./map.json"
}
```

Needless to say, executing `terraform init` is necessary to pull the plugins and initialize the configured backend if there is any.

After, running `terraform apply` against this template, a JSON encoded file with the content of the local variable `map` will be created in the same folder. That is easy enough.

But what if I needed a YAML encoded file? I am also not sure how it will look. I prefer JSON, but I also like to have some comments.

I can check it on the fly by firing up Terraform console in the same folder and just YAML encoding the local `map` variable:

```
$ terraform console
> yamlencode(local.map)
<<EOT
"a": 1
"b": 2
"c": 3

EOT
```

Voila! We see how our file will look like if we’ve used the `yamlencode` function.

Why stop there, maybe I just need the value of the `b` key?

```
> yamlencode(local.map.b)
<<EOT
2
...

EOT
```

Swapping the keys and the values is also something that I might want?

```
> yamlencode({for k,v in local.map : v => k })
<<EOT
"1": "a"
"2": "b"
"3": "c"

EOT
```

Or just “trying” out the `try` function to see how it works exactly.

```
> try(yamlencode(local.map.d), 4)
4
```

Case in point. The flexibility that the `terraform console` provides when testing, troubleshooting, or simply playing around is immense.

## Shell Autocomplete

This is one of the commands that do not appear when I invoke Terraform via the CLI. Having worked with Terraform for quite a while myself, I stumbled upon this command fairly recently. It lets you use shell tab-completion. As of writing this blog post, it works with `bash` or `zsh` shells only.

Running this will enable autocomplete for Terraform CLI. Re-reading the shell configuration or re-reloading a shell will activate it.

```
$ terraform -install-autocomplete
```

## Lock Timeout

This is another very useful option, especially when running in an automated environment, such as a CI system. Imagine the scenario: we start two or more plans or apply jobs at a similar time. Naturally, Terraform will fail if it cannot get a lock for the state. With the option `-lock-timeout` instead of immediately failing, Terraform will retry getting the state lock for the duration specified in seconds. If Terraform cannot acquire a lock after the timeout has passed, it will fail with an error.

```
$ terraform apply/plan -lock-timeout=180s
```

## Manual State Manipulation

Usually, I edit the state via Terraform CLI. Sometimes, though, I need to manually edit it. I do it via a pull, edit, and push cycle. These commands will work regardless of the type of backend configured. The most important things to remember when manually editing a state are:

- Validate the JSON before pushing.
- Increment the `serial` key by one.

### “Pull-Edit-Push”

The following command will pull and write the current active state to the `terraform_state.json` file.

```
$ terraform state pull > terraform_state.json
```

Which has the following contents.

```
{
  "version": 4,
  "terraform_version": "1.0.4",
  "serial": 1,
  "lineage": "b538a863-c14e-c216-9309-e5e35f91468c",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "local_file",
      "name": "private_key",
      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "content": "{\"a\":1,\"b\":2,\"c\":3}",
            "content_base64": null,
            "directory_permission": "0777",
            "file_permission": "0777",
            "filename": "./map.json",
            "id": "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597",
            "sensitive_content": null,
            "source": null
          },
          "sensitive_attributes": [],
          "private": "bnVsbA=="
        }
      ]
    }
  ]
}
```

I will remove the last element in the content parameter, and now the local state file looks like this:

```
{
  "version": 4,
  "terraform_version": "1.0.4",
  "serial": 2,
  "lineage": "b538a863-c14e-c216-9309-e5e35f91468c",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "local_file",
      "name": "private_key",
      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "content": "{\"a\":1,\"b\":2}",
            "content_base64": null,
            "directory_permission": "0777",
            "file_permission": "0777",
            "filename": "./map.json",
            "id": "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597",
            "sensitive_content": null,
            "source": null
          },
          "sensitive_attributes": [],
          "private": "bnVsbA=="
        }
      ]
    }
  ]
}
```

After saving the file, “Pushing” the state back to its configured backend is as easy as:

```
$ terraform state push ./terraform_state.json
```

The “push” will fail if there’s something wrong with the state file. Otherwise, it shouldn’t provide any output.

Further verifying that the state edit is successful can be done by running either `terraform plan` or `terraform apply`.

The changes that Terraform will report attest to the successful manual state edit.

```
$ terraform apply
local_file.private_key: Refreshing state... [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # local_file.private_key must be replaced
-/+ resource "local_file" "private_key" {
      ~ content              = jsonencode(
          ~ {
              + c = 3
                # (2 unchanged elements hidden)
            } # forces replacement
        )
      ~ id                   = "e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

local_file.private_key: Destroying... [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]
local_file.private_key: Destruction complete after 0s
local_file.private_key: Creating...
local_file.private_key: Creation complete after 0s [id=e7ec4a8f2309bdd4c4c57cb2adfb79c91a293597]

Apply complete! Resources: 1 added, 0 changed, 1 destroyed.
```

As expected, Terraform reverts back to the state as instructed by the configuration in the `main.tf.` template.

## JSON Instead Of HCL

The use case for this capability is quite interesting. I can programmatically generate Terraform templates using the JSON syntax. The only requirement is for the filename to have the extension `tf.json`. Otherwise, Terraform will not pick the configuration up.

I can convert the example above to JSON like so:

```
{
  "locals": {
    "map": {
    "a": 1,
    "b": 2,
    "c": 3
    }
  },
  "resource": {
    "local_file": {
      "private_key": {
        "content": "jsonencode(local.map)",
        "filename": "./map.json"
      }
    }
  }
}
```

I would reckon it’s unusual to generate a JSON encoded file using the JSON syntax.

It is a very appealing feature I imagine is being actively used out there.

## Terraform Graph

Not the most widely used Terraform command, but most definitely uncommon. It generates a DOT (graph description language) file that I can use to render an image in a well-known format, such as PNG. Running this command in the example state yields a chart description configuration.

```
$ terraform graph
```

```
digraph {
	compound = "true"
	newrank = "true"
	subgraph "root" {
		"[root] local_file.private_key (expand)" [label = "local_file.private_key", shape = "box"]
		"[root] provider[\"registry.terraform.io/hashicorp/local\"]" [label = "provider[\"registry.terraform.io/hashicorp/local\"]", shape = "diamond"]
		"[root] local_file.private_key (expand)" -> "[root] local.map (expand)"
		"[root] local_file.private_key (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/local\"]"
		"[root] meta.count-boundary (EachMode fixup)" -> "[root] local_file.private_key (expand)"
		"[root] provider[\"registry.terraform.io/hashicorp/local\"] (close)" -> "[root] local_file.private_key (expand)"
		"[root] root" -> "[root] meta.count-boundary (EachMode fixup)"
		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/local\"] (close)"
	}
}
```

If I “pipe” this through a filter for drawing directed graphs:

```
terraform graph | dot -Tpng > graph.png
```

I get a nice image of a graph as seen in Figure 1. (I’ve also inverted the colors with `imagemagick`)

![2021 09 dot](//images.contentful.com/9snkwzlabuv8/21UZMBuLsXHpa5ASO7wXBT/81ace8489711fce7f69155ec0f75ab05/2021_09_dot.png)

Getting to know a specific technology or a tool is not as easy as it seems. Hopefully, this blog post will make some of the unusual Terraform options clearer and more usable.

If you enjoyed this blog post, please share and spread it. For any suggestions or questions, contact me at <a href="mailto:nikola@cloudlad.io" target="_blank">nikola@cloudlad.io</a>.

Terraform, The Less-Common Commands And Options

Mergers and acquisitions (M&A) are a main driver of growth for many organizations, with the main objective of cybersecurity M&A due diligence being to identify and eliminate any risks for all sides involved in the transaction. The steps involved in the M&A process often look as follows:

![mergers-acquisitions-ma-process](//images.contentful.com/9snkwzlabuv8/7oLzt28E45hJ9AFmz7Otv2/86709a7c166e68e5cc5c5829190349e6/mergers-acquisitions-ma-process.png)

Image from [Corporate Finance Institute](https://corporatefinanceinstitute.com/resources/knowledge/deals/mergers-acquisitions-ma-process/)

The M&A process isn’t completed overnight, there is a lot of information to be gathered, reviewed, and merged as separate entities combine into a joint venture. With that in mind, conducting penetration testing for cybersecurity resilience can play a crucial role in mitigating risks throughout this process.

### What is Pentesting?

Pentesting or penetration testing involves cybersecurity professionals attempting to breach specific computer systems, networks, or applications to identify areas of weakness. Pentesters are equipped to gather all of the necessary background information on a company and current ownership through M&A. 

When considering implementing penetration testing engagements for M&A, first consider the value of protecting major business assets and how those play a role in driving the merger or acquisition. Utilizing pentesting with a [Pentest as a Service (PtaaS) platform](https://resource.cobalt.io/what-is-pen-testing-as-a-service), companies planning to merge or acquire can think ahead by identifying and fixing infrastructure vulnerabilities. Furthermore, a PtaaS platform enables companies to test more assets, faster. This can be critical for M&A testing since companies in the due diligence phase will often face external factors that rush the process — external factors such as competing buyers, LOI deadlines, or other time-sensitive norms within the M&A sector.

![Vulnerability management process](//images.contentful.com/9snkwzlabuv8/4YlxZyvTSCvR96Qbq9D0dC/193be08379a73f8a952ee235a7f6d34f/Vulnerability_management_process.png)

Image from [What Is Vulnerability Management? Get the Answers You Need](https://www.g2.com/articles/vulnerability-management)

It’s recommended for companies to undergo security testing to prevent data breaches, especially prior to significant changes such as product launches associated with mergers and acquisitions. 

Explaining the importance of M&A for cybersecurity leaders, “[How to navigate events that can either make or a break a CISO's career: mergers and acquisitions and audits and penetration testing](https://www.cybereason.com/blog/ciso-career-merger-acquisition-pen-test-audit)” states: “To use a merger or acquisition as an opportunity to help them professionally, security leaders need to consider security risks that could impact the merger and communicate their plans to address those issues to the board of directors and executives at the companies that are joining.” 

### The Return of M&A
With mergers and acquisitions expected to rise in the coming year, the process remains a powerful tool used by executive teams to grow and scale their business. However, opportunities for business growth also come with potential security threats when data is involved. 

“In the post-COVID-19 economy, cyber risk and cybersecurity will play a central role in unlocking mergers and acquisitions (M&A) deal valuations. While economic uncertainty has contributed to a decline in M&A activity in the first half of 2020, many analysts expect an increase in deals during 2020-21.”

Along with this, more than one in three executives say they have experienced data breaches due to M&A activity during integration, according to [Reducing the Risk of Mergers and Acquisitions](https://securityintelligence.com/posts/mergers-and-acquisitions-without-cybersecurity-risk/).

### Cybersecurity M&A Due Diligence
“Well-executed cyber due diligence is a key factor in the successful closing of a merger or acquisition deal. With cyber threats growing in complexity, performing your cyber due diligence is essential as it protects you from a variety of financial and reputational risks. With a detailed account of a prospect’s cybersecurity and data privacy practices, organizations are better able to evaluate any risk they may incur once a deal has been finalized.” - [Why Cybersecurity Due Diligence is Essential in M&A](https://securityscorecard.com/blog/why-cybersecurity-due-diligence-is-essential-in-mergers-and-acquisitions).

[Cybersecurity due diligence in M&A transactions](https://www.nixonpeabody.com/en/ideas/blog/private-equity/2017/10/16/cybersecurity-due-diligence-in-ma-transactions) highlights these three areas to consider in cybersecurity M&A due diligence:

1. Review of the target company’s current cybersecurity policies
2. Review of the target company’s network security conducted by an outside firm
3. Deal terms in the acquisition document

Part of successful cybersecurity M&A due diligence is assessing and evaluating current organizational security posture and taking the next steps to ensure security longevity. Security planning and cyber due diligence lead to strong IT infrastructure, so your organization can see the impact on your business acquisition strategy.

### Protecting your organization throughout the M&A process
Many organizations fall short of pinpointing vulnerabilities and mitigating risks, especially when it’s overlooked in the M&A process. Considerations such as implementing penetration testing early on in the M&A deal lifecycle can make a difference before any long-term security loss or damage.

Businesses of all sizes and across all industries are subjected to cyberattacks — an internal vulnerability assessment ensures potential threats and areas of weakness are identified and prioritized to prepare for the next steps. Poor M&A cybersecurity comes at a cost: when merging with or acquiring another organization, total visibility of the companies merging is a challenge and the door can be left open for potential threats, associated fiscal repercussions, and more.

### Benefits of PtaaS to M&A

![pen-test-lifecycle](//images.contentful.com/9snkwzlabuv8/6C3jpBOBpkbIb8T06zyMES/84717bd225ee7d0c4b2c89a5cc10a235/pen-test-lifecycle_2x-221f79b5f0705a71d5d008f7f2f49174b19b0c463c8015496c5180614af5248c.png)

The Pentest as a Service model combines data, technology, and talent to resolve security challenges for modern web applications, mobile applications, and APIs.

Pentesting gives quick access to security details and insights that are crucial for security teams and long-term business plans. It lets organizations know if and how hackers are able to breach systems and compromise sensitive information. The additional level of protection pentesting provides helps teams get in front of security gaps, along with other key benefits including:

- Efficiency at speed, aligning with M&A objectives 
- Finding weaknesses in security posture
- Monitoring security performance through built-in analytics 
- Ensuring long-term business continuity
- Avoiding costly data breaches 

Whether your security team is looking to prepare for cybersecurity M&A due diligence or is interested in learning more about pentesting, read more about how[ pentesting can become a more effective layer of defense](https://go.cobalt.io/the-state-of-pentesting-2021/) for your business and discover pentesting made easy.


Pentesting for the Merger & Acquisition Sector: Cybersecurity Due Diligence

With 20+ years in the security and technology industry and a history of managing and mitigating risk across changing technologies, software, and diverse platforms, Cobalt is thrilled to have recently welcomed Andrew Obadiaru, Chief Information Security Officer. 

Andrew is responsible for maintaining the confidentiality, integrity, and availability of Cobalt's systems, services and data. With Cobalt as a security and remote-first company, he was eager for the opportunity to step in and create an impact. Continuously evaluating and adopting new technologies and frameworks is an integral part of his journey in the cybersecurity space. Understanding the relevance of these aspects within Cobalt is a motivating factor, with the goal in mind to influence security and design a growth trajectory. 

## Understanding The Role of CISO
Protecting the critical business assets of an organization is a key priority for any security leader. Prior to joining Cobalt, Andrew was the Head of Information Security for BBVA USA Corporate Investment banking, where he oversaw the creation and execution of Cyber Security Strategy for BBVA USA. Having 20 years of security experience in different industries, he has gained different perspectives and approaches to security. 

Building and leveraging an organization’s threat detection capabilities, aligned with an agile threat and incident response rooted in technologies and processes, with well defined recovery capabilities is at the core of cyber resilience. 

Andrew has a keen sense of how cybersecurity is changing and how he expects it will continue to change over the next 5-10 years. Challenges in cyber resilience will continue, and cyber resilience as a security concept is still a relatively new one for many organizations. For businesses and organizations to clear these hurdles, it’s important they shift their perspective on security from the traditional approaches to a more nimble way of doing security. It starts with how you detect, evaluate and respond to cyber security threats. 

> Leadership can not be overstated, it’s key.

As CISO, it’s an opportunity to take a seat at the table and guide decisions across the organization as a whole. With many businesses shifting to the online workspace, remote-first or hybrid brings tremendous benefits — not just to the business, but the employees as well. This phenomenon that was largely driven by the pandemic also introduces significant cyber risk to the organization and challenges to security professionals. Leadership certainly has a significant role to play. 

The organizations with leadership that are receptive to security generally do well, whereas the ones where security is seen as another cost center usually have an uphill battle with security initiatives. Security at these organizations sometimes becomes an afterthought and, at times, a costly one. As a CISO, you must be able to work with other leaders in your organization to create a true security strategy that is aligned with the organizational goals and objectives. 

It’s important to ask your organization questions such as: 

- How well defined are our current security plans and responses? 
- How well do our teams value security? 
- How quickly can we address breaches and recover?

When asked how the CISO role has changed and how he expects it to evolve, Andrew shared that the CISO role has evolved and will continue to evolve. For a CISO to be successful he/she must have a good understanding of the business as well as a solid technical background. Your ability to understand the business objectives and drivers of those objectives will go a long way in how you align and execute against your security strategy, which ultimately is a determinant of your success or failure.