Orange recently suffered a data breach and around 3% of their user records in France were allegedly hacked.  This amounts to around 800,000 users. The anatomy of the attack appears to be SQL injection, where a French version of their web application took users to a flawed My Accounts page that was vulnerable to some

As seasoned penetration testers, it has to be said that the most common issue we come up with when testing public facing web applications, is cross site scripting (XSS).  Trying to explain this issue, and it’s implications, to businesses is challenging at times, after all there are a thousand and one other issues that businesses

Penetration testing should always reflect a measured approach to tackle the problem at hand, which is to ensure your systems are resilient from criminal attack.  A penetration test should do this by simulating said criminal attacks, and attempt to gain access to your systems, people and premises. The marketplace is still clouded with firms that

Selecting a penetration testing provider can be a daunting task. The industry is somewhat unregulated and other than the likes of CHECK / CREST / Tiger Scheme there are relatively few means to check your penetration testing provider is actually capable of testing your systems, infrastructure, buildings and people to sufficient depth. On one hand