Penetration Test
Piergiorgio Venuti
Penetration Testing and MFA: A Dual Strategy to Maximize Security
In a digital world where cyber threats are increasingly sophisticated, multi-factor authentication (MFA) represents a crucial defense against unauthorized access. However, the growing prevalence of phishing attacks aimed at bypassing MFA raises significant questions about post-authentication security and the overall effectiveness of security strategies. In this context, we examine how penetration testing can be used to assess and strengthen the…
Piergiorgio Venuti
Penetration Testing: Where to Strike to Protect Your IT Network
Introduction In an increasingly interconnected and digital world, cybersecurity has become a top priority for companies of all sizes. One of the most effective techniques to identify vulnerabilities and improve security is penetration testing, also known as pen testing or ethical hacking. But in a complex network with different environments, which ones are the most suitable for pen testing efforts?…
Piergiorgio Venuti
Red Team, Blue Team and Purple Team: what are the differences?
When we talk about cybersecurity and find ourselves on the side of the attacked, we often limit ourselves to thinking in terms of defense, protection and containment of threats. However, the approach that works best is one in which you put yourself in the attacker’s shoes and treat your infrastructure as the target of their actions. Only in this way…
Piergiorgio Venuti
CIS Controls and Vulnerability Assessment: practical guide to adopting best practices
Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture. What is CIS (Center for Internet Security)?…
Piergiorgio Venuti
Protect your company with a continuous vulnerability assessment service: the perfect solution to integrate VA and PT
Cybersecurity has become a fundamental pillar of modern businesses, and with the increase of threats and risks, it is imperative to adopt ever more advanced protection measures. In this context, the Vulnerability Assessment (VA) and the Penetration Test (PT) play a crucial role. However, it is also necessary to consider the importance of an ongoing vulnerability assessment service to guarantee…
Piergiorgio Venuti
Why it is essential to carry out the Internal Penetration Test as well as the external one: a complete guide to IT security
In an increasingly connected and digitized world, cyber security has become a major concern for businesses. An effective protection system must provide for the implementation of both external and internal measures to ensure maximum security of data and company resources. In this article, we will explore the importance of performing Internal as well as external Penetration Testing and how Cyberfero‘s…
Piergiorgio Venuti
The certifications of the SOD Red Team
In order to keep the eye on your IT infrastructure, hire a Red Team with certifications it is the ideal choice . The analyzes carried out by a certified Red Team are aimed at the protection and prevention of attacks and data losses. Obviously, an in house Red Team would require hefty hiring costs and a constant financial effort to…
Piergiorgio Venuti
Ethical hacking: defending knowing how to attack
Ethical hacking means the application for good of hacking techniques. The term “hacker” was coined in the 1960s at the Massachusetts Institute of Technology (MIT) to describe experts who used their skills to re-develop mainframe systems, increasing their efficiency and allowing them to perform more tasks. Nowadays, the term normally describes experienced programmers who gain unauthorized access to computer systems…
Piergiorgio Venuti
Does ISO 27001 standard require a Pentest?
A legitimate question that often arises is whether the Penetration Test is necessary for compliance with the ISO 27001 standard. To fully understand the answer, it is necessary to clarify what is meant by these terms and to understand the relationship between all the components of the certification. ISO 27001 standard A technical standard, also incorrectly called a standard, is…
Piergiorgio Venuti
Computer network security: PT vs. VA
The security of computer networks is of vital importance for a company. With technologies increasingly relying on remote services, it is good to ensure that security is guaranteed. To do this, two tools are used: Vulnerability Assessment and Penetration Test. But what is the difference between them? The answer to this question is not as obvious as one might think….
Piergiorgio Venuti
Security: pentest and verification of vulnerabilities
The computer security of a system is very important to avoid unpleasant inconveniences due to malicious attacks. In principle, it is not enough to set up a complete security system, you must also check that the above systems are working. To do this we turn to professionals who can carry out pentest (penetration tests) and carry out a vulnerability check….
Share
RSS
More Articles…
- From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company
- NIS: what it is and how it protects cybersecurity
- Advanced persistent threats (APTs): what they are and how to defend yourself
- Penetration Testing and MFA: A Dual Strategy to Maximize Security
- Penetration Testing: Where to Strike to Protect Your IT Network
- Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer.
- Why IT audit and log management are important for Cybersecurity
- Red Team, Blue Team and Purple Team: what are the differences?
Categories …
- Backup as a Service (18)
- Acronis Cloud Backup (11)
- Veeam Cloud Connect (4)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- Cyberfero (15)
- ICT Monitoring (5)
- Log Management (2)
- News (25)
- ownCloud (4)
- Privacy (7)
- Security (203)
- Cyber Threat Intelligence (CTI) (8)
- Deception (4)
- Ethical Phishing (11)
- Netwrix Auditor (2)
- Penetration Test (11)
- Posture Guard (3)
- SOCaaS (65)
- Vulnerabilities (84)
- Web Hosting (15)
Tags
Unknown Feed
Full Disclosure
- [NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure July 16, 2026Posted by NotCVE Advisories on Jul 15---------------------------------------------------------------------------- NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440 ---------------------------------------------------------------------------- [-] Summary: On 2026-01-19 the issue described below was published as NotCVE-2026-0001 after no CVE identifier was assigned for it. On 2026-07-01 — 163 days later — Cloudflare assigned CVE-2026-14440 to the same issue, now...
- Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312) July 16, 2026Posted by AliReza on Jul 15# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config # Date: 2026-07-16 # Exploit Author: Alireza Chegini # Vendor Homepage: https://ezsystemrepairs.com # Software Link: https://ezsystemrepairs.com (Free version available) # Version: 1.0.0 (v2.0 exists but not tested - paid license required) # Tested on: Windows 10 / Windows […]
- CVE-2026-56877 - Skillable SCORM userId authorisation bypass July 16, 2026Posted by Greg via Fulldisclosure on Jul 15Skillable's SCORM lab launch endpoint validates a launch token but enforces per-user allocation limits using a browser-supplied userId that is not bound to the validated token. An authenticated learner can modify this identifier to bypass configured limits, launch concurrent lab instances, and consume another learner's allocation. Skillable states […]
- [REVIVE-SA-2026-003] Revive Adserver Vulnerabilities July 9, 2026Posted by Matteo Beccati on Jul 08======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-003 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-003 ------------------------------------------------------------------------ Date: 2026-06-25 Risk Level: Medium to High Applications affected: Revive Adserver Versions...
- OPNsense XPATH Injection (CVE-2026-53582) July 7, 2026Posted by evan on Jul 06SUMMARY: a stored XPATH injection allows any user with just ca manager/certificate manager perms to leak any secret key/any value in config.xml, thus achieving privilege escalation and potentially remote code execution. this can also likely be chained via csrf and some clever hiding. see https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r == VULN == the primary […]
- SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+ July 7, 2026Posted by Jan Hüber via Fulldisclosure on Jul 06Authentication Bypass for SafeLine SL6 and SL6+ =============================================== The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface. […]
- Whistleblowersoftware.com: confidentiality and anonymity leakage to third parties July 2, 2026Posted by Red Nanaki via Fulldisclosure on Jul 02Whistleblowersoftware.com: confidentiality and anonymity leakage to third parties ## Summary The anonymous reporting flow on `whistleblowersoftware.com` encrypts report text end-to-end in the browser but does not extend the same guarantee to attachments and exposes the reporter's network identity and timing to a US-based third party. Together these […]
- OpenBlow Multiple Deanonymization Vulnerabilities July 2, 2026Posted by Red Nanaki via Fulldisclosure on Jul 02OpenBlow Multiple Deanonymization Vulnerabilities Summary A production deployment was observed (HTTP archive of a full, real whistleblower submission) to route its anonymous reporting flow through Google. The intake CAPTCHA is Google reCAPTCHA, enforced as a mandatory, server-validated gate on report submission, and the UI additionally pulls a […]
- Whistlelink: Site-access password exposed in web server access logs via GET query string July 2, 2026Posted by Red Nanaki via Fulldisclosure on Jul 02Whistlelink: Site-access password exposed in web server access logs via GET query string Severity: CRITICAL SUMMARY The Whistlelink reporting portal protects optionally-enabled, password-gated whistleblowing sites with a site-access password. When a visitor unlocks such a site, the client validates the password by issuing an HTTP GET request […]
- APPLE-SA-06-29-2026-3 Safari 26.5.2 July 2, 2026Posted by Apple Product Security via Fulldisclosure on Jul 02APPLE-SA-06-29-2026-3 Safari 26.5.2 Safari 26.5.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127685. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Web Extensions Available for: macOS Sonoma and macOS Sequoia Impact: A […]
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
Products and Solutions
Partners
Cloud Models
News
- From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company May 6, 2024
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
Google Reviews
Davvero consigliata !!!!!
In particolare vorrei sottolineare la figura che piu’ racchiude e sintetizza le qualità della Secure Online Desktop , il suo AD Ing. Piergiorgio Venuti, professionista impagabile , sia dal punto di vista tecnico/organizzativo che soprattutto (e non dimeno) come persona , capace di gestire , risolvere e approcciare qualsivoglia attività/problematica, davvero un grande !!!!
Tempi veloci e staff preparato!
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2024 Cyberfero s.r.l. All Rights Reserved. Sede Legale: via Statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Cod. fiscale e P.IVA 03058120357 – R.E.A. 356650 Informativa Privacy - Certificazioni ISO