Virginie Mathieu

ESAs Publish Second Set of Rules for DORA Compliance Clarifying Third-party Risk and Reporting Requirements BCI has published an excellent distillation of the most recent DORA clarifications in ESAs publishes second sets of rules for the application of the Digital Operational Resilience Act (DORA) These rules further clarify requirements for ICT risk management, incident reporting, and digital operational resilience testing – with particular emphasis on third party software and supplier risks. As the January 2025 compliance deadline approaches, it is essential for financial firms to integrate these guidelines into their operational frameworks to ensure resilience and regulatory alignment. For more detailed info, see the article below and to learn how to best manage third party bug risk, visit www.findbugzero.com. #DORA #OperationalResilience #RiskManagement #Compliance #ICT #BugZero

3

#Cybersecurity "The Guidance is presented in chapters that outline five primary risk management categories and three overarching components that should be addressed across an FMI’s cyber resilience framework. The risk management categories are: governance; identification; protection; detection; and response and recovery. The overarching components are: testing; situational awareness; and learning and evolving. In order to achieve resilience objectives, investments across these guidance categories can be mutually reinforcing and should be considered jointly." #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

4

1 Comment

#Cybersecurity "The Guidance is presented in chapters that outline five primary risk management categories and three overarching components that should be addressed across an FMI’s cyber resilience framework. The risk management categories are: governance; identification; protection; detection; and response and recovery. The overarching components are: testing; situational awareness; and learning and evolving. In order to achieve resilience objectives, investments across these guidance categories can be mutually reinforcing and should be considered jointly." #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

5

1 Comment

#Cybersecurity "The Guidance is presented in chapters that outline five primary risk management categories and three overarching components that should be addressed across an FMI’s cyber resilience framework. The risk management categories are: governance; identification; protection; detection; and response and recovery. The overarching components are: testing; situational awareness; and learning and evolving. In order to achieve resilience objectives, investments across these guidance categories can be mutually reinforcing and should be considered jointly." #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

3

2 Comments

ICS Advisory Project Weekly Summary [8 - 12 April 2024] Here is this week's ICS Advisory, Other CERT, & Vendor vulnerability advisories weekly summary for 15 – 19 April 2024. Attached are this week's CISA ICS Advisory summary slides. This past week, CISA released five new ICS Advisories for Unitronics, Measuresoft, Electrolink, Rockwell Automation, and RoboDK. Updated CISA ICS Advisories were released for the Mitsubishi Electric MELSEC iQ-R Series CPU Module. Based on the new CISA advisories, Critical Manufacturing, Communications, Energy, and Water and Wastewater Systems are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified five new advisories from other CERTs and Vendors for the following vendors: Rockwell Automation [FactoryTalk], Siemens [Ruggedcom APE1808 industrial switch], Philips [VitalHealth Questionnaire Manager], CONTECT [SolarView Compact], and Proscend Communications Inc [LTE Industrial Cellular Routers]. See the Weekly Summary of Other Vendor & CERT Advisories for potentially impacted CI sectors. No new Known Exploited Vulnerability (KEV) Catalog this past week. However, on 19 April, Siemens released Security Advisory: SSA-750274 Impact of CVE-2024-3400 on RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW. CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection Vulnerability is listed on the CISA Known Exploited Vulnerability (KEV) Catalog. View the attached summary with details of other CERT & Vendor product advisories identified last week (15 - 19 April 2024).

3

🌐 The European Union Agency for Cybersecurity (ENISA) recently released its "Foresight Cybersecurity Threats for 2030 - Update" report, providing an in-depth analysis of the evolving cybersecurity landscape. This comprehensive report follows the Executive Summary version of a few weeks ago and is more complex: 🛡️ Dynamic Threat Landscape Advanced persistent threats, nation-state actors, and sophisticated cybercriminal organizations are on the rise, evolving rapidly to exploit new vulnerabilities. 🤖 Emerging Technologies: Opportunities and Risks Quantum computing and artificial intelligence (AI) present both significant opportunities and vulnerabilities, requiring proactive cybersecurity measures to mitigate potential risks. 🌐 Top 10 Cybersecurity Threats for 2030 The report identifies and prioritizes threats such as supply chain compromises, skill shortages, human error, and exploitation of unpatched systems. 🏛️ Political Trends The increasing influence of non-state actors and the critical role of cybersecurity in elections highlight the evolving political landscape. 💼 Economic Trends Growing data collection and analysis, alongside increasing reliance on outsourced IT services, present new cybersecurity challenges. 🧠 Social Trends Automated decision-making is becoming more prevalent, raising questions about data quality, safety, and accountability. 🚀 Technological Trends The rise in satellite use and the connectivity of vehicles emphasize the need for robust cybersecurity measures. 🌱 Environmental Trends The increasing energy consumption of digital infrastructure is a concern, though advances in energy efficiency may mitigate this by 2030. 📜 Legal Trends Controlling personal data is becoming more desirable yet technically challenging, necessitating new regulatory approaches. 🌐 Scenario Analysis Experts call for more nuanced scenarios to address trust, privacy, technology misuse, and environmental impacts, emphasizing the need for comprehensive strategic planning. __________ ℹ️ To download a document, open it here on LinkedIn in full view, and the download button will become visible in the top-right area. 👇  All the valuable content shared by the shiftavenue team you can find here:  https://lnkd.in/eExqPwWH ☝️ Do not forget - shiftavenue has brilliant people who can guide and help you with this and similar topics. 📧 Please don't hesitate to reach out directly to start working together.

8

🚨 Fresh update on DORA! Today 17th of July, the European Supervisory Authorities (ESAs) have published the second set of rules under the Digital Operational Resilience Act (#DORA). These new guidelines provide clarity on #ICT-related incident reporting, third-party supplier requirements, and threat-led penetration testing. 𝐖𝐢𝐭𝐡 𝐨𝐧𝐥𝐲 𝐬𝐢𝐱 𝐦𝐨𝐧𝐭𝐡𝐬 𝐥𝐞𝐟𝐭 until the January deadline, financial entities must act swiftly to ensure #compliance. Read the article here 👉https://lnkd.in/eSuY7rT4

10

The #CyberResilienceAct is Here! The Cyber Resilience Act (CRA) was published in the European Union Official Journal, today, 20th November 2024. Twenty days later, on 11th December 2024, the CRA will enter into force across all EU member states. The 11th December 2024 will also mark the start of the 36-month transition period, meaning that manufacturers, distributors and importers of products with digital elements will need to be fully compliant with the new CRA legislation by 11th December 2027. The clock has started ticking for all businesses implicated by the new legislation. What is the Cyber Resilience Act? The CRA is a new EU legislation that aims to improve baseline cybersecurity standards for products with digital elements made available on the EU internal market. Products with digital elements are defined as products with hardware and/or software components and any associated remote data processing solutions. This encompasses a breadth of product types including internet of things (IoT) devices. This is a horizontal legislation, meaning it is not specific to one business sector. The CRA will implicate all products with digital elements bar a few exceptions such as medical devices and motor vehicles. The CRA legislation sets out essential requirements for cybersecurity and vulnerability handling of products with digital elements. Manufacturers of products with digital elements must implement these essential requirements and show proof of compliance by completing a conformity assessment. Once the product with digital elements has passed the conformity assessment, the CE mark must be affixed to the product. This shows customers that the product has met the CRA legislation requirements. Next Steps Manufacturers of products implicated by the CRA should start researching what they need to do to incorporate the CRA into their product lifecycle process. The CRA expects cybersecurity to be taken into account across all stages of the product lifecycle and this may be a change for some manufacturers. Start your CRA journey by checking out our blog posts on the CRA, such as information on product scope: https://bit.ly/4el2Mco and CRA product categories: https://bit.ly/3Ux7b51 . Follow Cyber Cert Labs on LinkedIn for more information and updates on the CRA. Have questions? Need more specific advice about the CRA? Reach out to us at our website: https://lnkd.in/ezGHFnuM

13

The NIST (National Institute of Standards and Technology) Cybersecurity Framework is a widely recognized and widely used set of guidelines, best practices, and standards for managing and improving cybersecurity risk management processes. Learn about the five core functions here: https://bit.ly/3JIh0r1 #Cybersecurity #NIST #ITSecurity #DigitalTransformation #SecuritySolutions

3

Handbook on IAM (Identity and Access Management) and IGA (Identity Governance and Administration) available for $99 as an eBook. Includes: Introduction to IAM and IGA Overview of IAM and IGA concepts, their importance in modern enterprises, and how they contribute to security and compliance. Core Principles of IAM and IGA Understanding the fundamental principles like least privilege, segregation of duties, and role-based access control (RBAC). Key Components of IAM Systems Identity lifecycle management, access management, privilege management, and governance. Understanding Identity Lifecycle Management Detailed exploration of identity creation, modification, deactivation, and deletion processes. Access Management Techniques and Best Practices Overview of access control models including RBAC, ABAC (Attribute-Based Access Control), and policy-based access control. IAM/IGA Risk Management and Compliance How IAM and IGA help in mitigating risks and ensuring compliance with regulations like GDPR, HIPAA, and SOX. Deep Dive into SailPoint: IdentityNow and IdentityIQ Overview, features, and use cases of SailPoint's IAM/IGA solutions. SailPoint Implementation and Best Practices Step-by-step implementation guide for SailPoint with real-world best practices. Saviynt: A Modern Approach to Identity Governance Introduction to Saviynt’s capabilities, key features, and use cases. Implementing Saviynt in Complex Environments Detailed implementation steps, integration points, and tips for maximizing the efficiency of Saviynt. EmpowerID: Unified IAM and Governance Overview of EmpowerID’s platform, features, and advantages. Deploying and Managing EmpowerID Practical guide to deploying EmpowerID, managing identities, and streamlining workflows. Comparative Analysis of SailPoint, Saviynt, and EmpowerID A side-by-side comparison focusing on their strengths, weaknesses, and best-fit scenarios. Advanced Identity Analytics and Reporting Tools and techniques for generating insights from identity data and enhancing governance with analytics. Managing Privileged Access with IAM/IGA Solutions How these tools help in controlling and monitoring privileged accounts and sensitive access. Integrating IAM/IGA with Other Security Tools How to integrate IAM solutions with SIEMs, PAM (Privileged Access Management), and other security solutions. Identity and Access Management in Cloud Environments Managing identities and access in hybrid and multi-cloud setups with the mentioned tools. Securing DevOps with IAM and IGA Addressing the role of IAM in DevOps and CI/CD pipelines, focusing on automation and secure access. Future Trends in IAM and IGA A look into upcoming developments like AI-driven identity governance, decentralized identity, and more.

CYBER SECURITY RISK HANDBOOK: KEY TOOLKITS - Internet Security Alliance / ecoDa a.s.b.l - The European Confederation of Directors Associations Tool A: #Ransomware Readiness Tool B: Assessing the Board #Cyber #Risk - Oversight Effectivenees Tool C: #Insider #Threats Tool D: #Supply #Chain and Third - Party Risks Tool E: #Incidents #Response Tool F: #Board - Level Cybersecurity #Metrics Tool G: Mergers and #Acquisitions Tool H: Building a #Relationship with the CISO Tool I: Enhancing #Cybersecurity oversight disclosures: 10 questions for boards Tool J: Securing #Cloud #Services Tool K: Supporting #national #security and five triangulation questions for boards members to ask their CISOS Tool L: Tool for the #board of #Directors to decide general use of #artificial #intelligence Centro de Investigación de Ciberseguridad IoT - IIoT

104

1 Comment

Navigate the complexities of threat hunting with the SANS Institute ninth annual Threat Hunting Survey. This comprehensive report provides invaluable insights into evolving practices, challenges, and methodologies that are shaping global cybersecurity strategies. Key highlights: ⭐️ Adoption of formalized methodologies increased from 35% to 50% in one year. ⭐️ Half of the surveyed organizations now prioritize in-house threat intelligence. ⭐️ The industry is progressing towards standardized processes for enhanced threat detection and incident response. Despite these advances, challenges such as skilled staff shortages and data quality issues persist. The survey also examines the growing trend of outsourcing threat hunting and its implications. Equip yourself with essential knowledge to tackle upcoming cyber challenges. Download the "SANS 2024 Threat Hunting Survey" now and confidently advance your cybersecurity strategies: https://lnkd.in/gbW-NuDp #ThreatHunting #ThreatIntelligence #CTI #ThreatIntel #CyberSecurity #SecurityProfessionals #infosec #SANSInstitute #InfosecCommunity

18