Christophe Stenuit

With cyber security threats on the rise, there's no room to be complacent. Everyone in your organisation needs authentication tailored to their specific access needs and the risk profile of their role. Even if you have already implemented 2FA or MFA, there may still be gaps in authentication for different use cases and applications, compromising security across your organisation. Find out more about MFA best practices and improving the user authentication journey in our e-Guide where we cover, 🔐 What MFA is and its importance to security-sensitive industries 🔐 Reasons for improving security with a fully comprehensive MFA solution 🔐 Why 2FA and some MFA solutions might not be enough for full security cover 🔐 User authentication journeys for different use cases and security levels 🔐 Picking the right authentication methods 🔐 Tips to make the most of MFA across your entire workforce Read the complete guide here > https://loom.ly/q4jfdL4 #MultiFactorAuthentication #MFA #EGuide #DataSecurity

8

At Mypinpad, we are seeing a growing demand for Step-up Authentication (SA) deployments, which dynamically adjust #authentication protocols based on the assessed risk level of individual transactions. To balance security and friction, SA ensures initial access with primary credentials but prompts for more credentials when personal transaction ‘behaviour’ norms are breached.    Our CEO Barry Levett explains the fundamentals of Strong Customer Authentication and how payments authentication is evolving to mitigate increasing fraud while minimizing user friction in this article 👉: https://lnkd.in/gjWMkNsa?    #Mypinpad #payments #technology

18

🚀 𝗖𝗲𝗴𝗲𝗸𝗮 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗱 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 (𝗠𝗣𝗔𝗠) 𝗳𝗼𝗿 𝗲𝗻𝗵𝗮𝗻𝗰𝗲𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆! In response to the rising wave of identity-based cyber threats, Cegeka has launched Managed Privileged Access Management to help organizations protect their critical privileged accounts. With 90% of organizations reporting identity-related security incidents, securing these accounts is crucial. "Cybercriminals are getting increasingly creative. Privileged accounts are a top target - if hackers access these, they get direct entry to sensitive systems and data," says Fabrice Wynants VP of Cyber Security & Networking at Cegeka. Backed by our IAM expertise and powered by Delinea technology, MPAM helps organizations achieve security compliance and resilience in today’s complex threat landscape. 👉 Learn more in our latest article: https://lnkd.in/eRzMqMZC #CyberSecurity #CyberResilience #IAM #MPAM

60

ESAs Publish Second Set of Rules for DORA Compliance Clarifying Third-party Risk and Reporting Requirements BCI has published an excellent distillation of the most recent DORA clarifications in ESAs publishes second sets of rules for the application of the Digital Operational Resilience Act (DORA) These rules further clarify requirements for ICT risk management, incident reporting, and digital operational resilience testing – with particular emphasis on third party software and supplier risks. As the January 2025 compliance deadline approaches, it is essential for financial firms to integrate these guidelines into their operational frameworks to ensure resilience and regulatory alignment. For more detailed info, see the article below and to learn how to best manage third party bug risk, visit www.findbugzero.com. #DORA #OperationalResilience #RiskManagement #Compliance #ICT #BugZero

3

Cyber Security Alert ⚠️ The NCSC would like to draw your attention to CVE-2024-24919 affecting Check Point Security Gateway. The NCSC is aware of public reporting of active exploitation, which refers to activity since at least 30 April 2024.   This is a critical zero-day information disclosure vulnerability.    👉 CVE-2024-24919 allows an attacker to access sensitive information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.   The NCSC encourages organisations in New Zealand that use the affected product to review the vendor advisory which provides information on how to apply the hotfix as well the device versions impacted. The advisory contains a number of extra measures, including resetting LDAP credentials if the Security Gateway is configured to use this. We recommend reviewing all of the extra measures detailed in the vendor advisory.   View the vendor advisory here 🔗 https://lnkd.in/grsH7ku8

40

The EU Data Act (the 'Act') entered into force on 11 January 2024. The Act includes new rules governing data access and sharing for connected devices and related services. It also contains rules which affect the provision of cloud services, including rules governing contracts for these services. A team from Stephenson Harwood has produced a new series of four articles providing an overview of different parts of the Act. Part one is available now through the link below, with the rest of the series to be released over the coming weeks. #Technology #DataAct #DataPrivacy #DataProtection

9

💡A Quick Guide to Privacy by Design in the SDLC At the Application Security Experience Sharing Day in Leuven last June, Bart van Buitenen (Dasprive) illustrated how the concept of Privacy By Design, integrating data protection from the very beginning of the development cycle, can be applied at every stage of the Software Development Life Cycle (SDLC). This proactive approach involves modelling privacy threats during the design stage, aligning security and privacy requirements during development, and verifying privacy features during testing. He also shared best practices for successful implementation of Privacy by Design. ➡️Read more here: https://ow.ly/rWo450Sspct #applicationsecurity #privacybydesign #SDLC #privacy

38

1 Comment

Charlas MainTrack #EKO2024 🚀 📌 Dirk-jan Mollema, Security Researcher at Outsider Security 💡 “Windows Hello abuse - the sequel”: Windows Hello and its enterprise variant Windows Hello for Business are modern passwordless authentication methods, that are promoted by Microsoft as secure, hardware bound and resistant to phishing attacks. Last year, we already saw that many of the security features did not exactly hold up, and that it was possible to provision WHFB methods without MFA, use them for lateral movement on other accounts and for movement from Entra ID to on-prem AD via cloud Kerberos trust. In this talk, we will cover even more WHFB abuse, showing how WHFB keys can be provisioned during phishing scenario's, including device code phishing and credential phishing. We will also talk about how Windows Hello keys are protected and used on Windows devices, showing how we can use the keys for lateral movement and persistence once we have access to a users session. ✅ Esta charla será dictada en inglés. 📍 EKOPARTY 2024 - 13, 14 y 15 de noviembre en el CEC - Buenos Aires  🎟️ ¡Registrate! >> entradas.ekoparty.org 📅 Podés ver la agenda completa en ekoparty.org/agenda 

8

🔒 Navigating the NIS2 Directive: Are You Prepared? 🔒 The NIS2 Directive is setting new standards for cybersecurity across the EU, and it’s crucial for your organisation to stay ahead. Understanding and implementing these regulations can be challenging, but CDeX is here to help. 🏆 Key Steps to Prepare for NIS2: Assess Your Current Readiness: Start with our free, 5-question quiz to gauge your cybersecurity stance. Identify Gaps: Determine where your organisation stands and where improvements are needed. Invest in Training: Equip your cybersecurity team with the necessary skills and knowledge to meet NIS2 standards. At CDeX, we specialise in transforming your cybersecurity capabilities with targeted training programs. Our training is carefully designed to align with NIS2 requirements that validates your team's readiness. Start our free, quick, 5-question NIS2 Compliance quiz. 🔗https://lnkd.in/dspYt-Ua Let’s secure your future together! #NIS2 #Cybersecurity #Compliance #CDeXTraining #CyberDefence #Certification #NIS2Directive

12

Weekly Vulnerability Roundup (Week Commencing: 7th October 2024) We’re back again with the Weekly Vulnerability Roundup. This report covers any vulnerabilities which have had an EPSS score change of at least 10% and any new additions to the CISA Known Exploited Vulnerabilities catalogue. A new addition to this week’s report is that we’ve added the original EPSS score to add more context to the deltas. Want to receive this report and future reports right to your inbox every Friday? Enter your email address here to sign up: https://lnkd.in/gyU9QYgx See the summary of affected technologies below and read the FULL report on our blog here: https://lnkd.in/gfa5qm3y Total CVEs:  31 References: EPSS by FIRST: https://www.first.org/ CISA KEV: https://lnkd.in/gRGpREQS Penetration Testing and SOC: https://lnkd.in/gMQXZrTs

12

📢ADWISERY experts provide Data Protection Officer Services📢 The Data Protection Officer (DPO) is a position in the General Data Protection Regulation (GDPR) who must ensure that the organization properly implements the requirements of the GDPR. An Official (DPO) must be appointed when: 📍 Data are processed by public authorities or institutions, except for courts, when they perform judicial functions; 📍The main activity of the data controller or processor is data processing operations, the nature, scope and/or purposes of which data subjects are regularly and systematically monitored on a large scale; 📍The main activity of the data controller or processor is the processing of special categories of data on a large scale or the processing of personal data on criminal convictions and criminal acts on a large scale. #GDPR #DPO #personaldata #personaldataprotection #CyberSecurityOfficer https://lnkd.in/eHkKP--g

11

2 Comments

FACT - Federated Advanced Cyber physical Test range 👉 an ambitious deliverable ❔ Did you know that FACT is related to the PESCO project ‘Cyber Threats and Incident Response Information Sharing Platform’ (CTIRISP)? The aim remain the same, i.e. the strengthening nations’ cyber defence capabilities, the FACT project will go further. It will design, prototype and demonstrate a federated cyber physical test capability which can be maintained and become a sustained capability to the European nations after the project. 🔋 The expected Technology Readiness Level (TRL) at the end of the project will be at least of 6 (Prototype System Verified) (out of 9), which represents a major step up in a technology’s demonstrated readiness. The aim is to demonstrate that the prototype is suitable for real-world application in the respective domains of surveillance, data communication and tactical communication, and commercial unmanned vehicles. 🇪🇺 EU FACT is a development project co-funded by the European Union under Grant-Agreement n. 101121335, awarded through European Defence Fund (EDF) in 2022. #FACT #Cybersecurity #EUDefenceIndustry #StrongerTogether

19

I wonder how many people on their #TelecomsSecurityAct journey would be surprised to read the following requirement: "Public telecoms providers should refer to the NCSC advice on risk management. The risk assessment that these providers must carry out as a part of the reviews process under Regulation 11 should be looking at not only the risks to the provider’s business and network, but also the risks to end users. This includes, but is not limited to, the risks of loss of availability and of personal data leaks." That's right, privacy management is supposed to be part of of your governance processes for the TSA, but are your guides just focussing on #Cyber? Give me a DM if you'd like to know more! :) #BeyondCyber #GovernanceMatters #PrivacyMatters #ReduceBurden

1

Imagination is now an authorised CVE Numbering Authority (CNA). The CVE Program is a collaborative initiative that allows authorised partners from around the world to identify, define and catalogue cybersecurity vulnerabilities within one publicly available database. Authorisation as a CNA strengthens our cybersecurity credentials and highlights the maturity of our vulnerability management practices. More details are available at: https://hubs.ly/Q02KydVC0 CVE Program #cybersecurity #CVE #vulnerabilities

49

How could your business benefit from Internal Audit as a Service?   ✅ Highly experienced, talented auditors ✅ Audit resource available when you need it ✅ Avoid expensive training fees ✅ Better quality audits   Read more: https://lnkd.in/eTRw__RM   #InternalAudit #CyberSecurity #InfoSec #Spritzmonkey

11