Bruno Guerreiro Diniz

According to our Advisory Board member, Paulo Pereira, this topic is highly disruptive to our daily lives. https://lnkd.in/da-xpiYX #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

3

The Ethical Hacking and Penetration Testing Foundation is a certification intended for IT professionals seeking to validate their knowledge of Ethical Hacking and Penetration Testing. The exam is available in English and Portuguese. Learn more about the Ethical Hacking and Penetration Testing Foundation at https://lnkd.in/gMFdEhjP #EthicalHacking #PenetrationTesting #Cybersecurity #ProfessionalCertifications #OnlineProctoredExams #itcerts 

5

The Cybersecurity and Infrastructure Security Agency (CISA) announced the release of a new resource, the Vehicle Incident Prevention and Mitigation Security Guide. CISA created this Guide to provide stakeholders with a high-level overview of general security best practices to prevent vehicular attacks that can harm pedestrians and critical infrastructure, and potential actions to mitigate the consequences, should an incident occur. It also provides a current, detailed look at the threat environment for this vector, and underscores the fact that taking steps to mitigate against deliberate incidents can yield additional benefits for protection against accidental ones. The product outlines key steps organizations and individuals can take to increase their security in the face of vehicle incident threats. https://lnkd.in/dC9ynu9b

9

2 commentaires

🆕 The NOVA High Threat Response Committee April 2024 Update — +New incidents have been added to the High Threat Incidents Database and the Fire as a Weapon Incidents Database +Resources have been added to the following high threat topics: Active Violence, After-Action Reports, CBRN, and Key Components (Cybersecurity, Intelligence, Medical, Prevention, School Safety & Security, and Whole of Community) 💻 Want access* to these resources and more? Please submit request here: https://lnkd.in/gNWx726X 💡 For more information on NVERS, please visit: https://www.nvers.org/htr *Access is limited to active first responders and public safety professionals. #highthreat #threat #threats #resources #activeviolence #cybersecurity #intelligence #nationalsecurity #homelandsecurity #terrorism #extremism #violence #attack #attacks #fireasaweapon #FAW #targetedviolence #publicsafety #firstresponders #schoolsafety #schoolsecurity

2

Suggested reading of Security Library (Biblioteca de Segurança): Securing Critical Infrastructure. Check in: https://lnkd.in/dj3XN5Nd Download 24p. Security Library has the largest collection in the world about risk management, corporate security, cybersecurity, business continuity, etc. There are already over 3500 publications | Content in four languages: Portuguese, Spanish, English and French. Sinopse: Governments are having to work out how to protect their critical assets. Some assets are managed by themselves, and some by the private sector, but all fall under the state’s responsibility to provide services and protect its citizens. Which is why we have seen governments in recent years developing and enforcing security regulation over critical infrastructure. A critical infrastructure sector can be described as one whose assets, systems, and networks, whether physical or virtual, are considered so vital to their country that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. As more critical infrastructure is digitalised to respond to the increasing needs of society, the attack surface increases – and with it, the prospect of life-threatening disruption. This is a conundrum that is further exacerbated by the fact that Operations Technology (OT) often exists outside of Information Technology (IT), with one being more concerned about productivity and efficiency, versus the other whose priority is cybersecurity. Organisations understand the price of not complying with current regulations, but the cybersecurity impact can be even greater if an organisation is hit by hacking activity, ransomware, or stealing their “Crown Jewels”. Ransomware attacks have targeted everything from private businesses to the government to hospitals and health care systems. The latter are especially attractive targets, given how urgent it is to get their systems back up as soon as possible. #bibliotecadeseguranca #livrosdeseguranca #segurancacorporativa

7

3 commentaires

CISA Announced Vulnrichment : Project to Enrich CVE Records: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new initiative called “Vulnrichment” aimed at enriching Common Vulnerabilities and Exposures (CVE) records with additional metadata to help organizations better prioritize vulnerability remediation efforts. The Vulnrichment project, hosted in a public GitHub repository, will focus on adding key data points to CVE records, including: […] The post CISA Announced Vulnrichment : Project to Enrich CVE Records appeared first on Cyber Security News. #CyberSecurity #InfoSec

2

𝗪𝗲𝗲𝗸𝗹𝘆 𝗧𝗢𝗣 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗡𝗲𝘄𝘀 Resistine and AI picked the five most important cybersecurity news stories last week, so you don't need to go through thousands of them! 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗶𝗻 𝗢𝗽𝗲𝗻𝗦𝗦𝗛: 𝗿𝗲𝗴𝗿𝗲𝗦𝗦𝗛𝗶𝗼𝗻 A critical flaw, CVE-2024-6387 (regreSSHion), found in OpenSSH affects millions of servers. It allows unauthenticated remote code execution. While attempts to exploit it have been seen, mass attacks are unlikely for now. #cybersecurity #OpenSSH https://lnkd.in/eszuUjUR 𝗚𝗼𝗼𝗴𝗹𝗲 𝗣𝗮𝘁𝗰𝗵𝗲𝘀 𝟮𝟱 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 𝗙𝗹𝗮𝘄𝘀 Google's latest update fixes 25 Android vulnerabilities, including a critical privilege escalation bug in the Framework component. Users should update their devices immediately to stay protected. #Android #securityupdate https://lnkd.in/eDbZJbwm 𝗧𝘄𝗶𝗹𝗶𝗼 𝗖𝗼𝗻𝗳𝗶𝗿𝗺𝘀 𝗗𝗮𝘁𝗮 𝗕𝗿𝗲𝗮𝗰𝗵 Twilio confirms a data breach impacting 33 million phone numbers associated with its Authy app. This incident underscores the need for strong security measures for multi-factor authentication systems. #databreach #Twilio https://lnkd.in/df_wPT2q 𝗘𝘂𝗿𝗼𝗽𝗼𝗹 𝗖𝗿𝗮𝗰𝗸𝘀 𝗗𝗼𝘄𝗻 𝗼𝗻 𝗖𝗼𝗯𝗮𝗹𝘁 𝗦𝘁𝗿𝗶𝗸𝗲 𝗦𝗲𝗿𝘃𝗲𝗿𝘀 Europol has taken down nearly 600 Cobalt Strike servers used by cybercriminals. This significant operation disrupts the infrastructure for sophisticated cyberattacks. #cybercrime #Europol https://lnkd.in/eWBq26yJ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗖𝗼𝗰𝗼𝗮𝗣𝗼𝗱𝘀 𝗘𝘅𝗽𝗼𝘀𝗲 𝗔𝗽𝗽𝗹𝗲 𝗔𝗽𝗽𝘀 hree critical vulnerabilities in CocoaPods, a dependency manager for iOS and macOS apps, could enable supply chain attacks, compromising millions of applications. Developers should update dependencies. #Apple #CocoaPods #supplychainattack https://lnkd.in/e-WiyASP 𝗢𝗽𝗲𝗻𝗔𝗜 𝗛𝗮𝗰𝗸 𝗥𝗲𝘃𝗲𝗮𝗹𝘀 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗗𝗮𝗻𝗴𝗲𝗿𝘀 𝗼𝗳 𝗔𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 A 2023 breach of OpenAI reveals potential dangers in AI security. Despite no access to source code or customer data, the incident highlights the need for robust protection of AI assets. #AIsecurity #OpenAI https://lnkd.in/dMaeu8We

8

🚀 10 Days before #Eurosatory 🚀 We can't wait to share our expertise, knowledge, and solutions in CBRN threat management ! 🌟 Make sure to mark your calendars for a GIE Defense NBC conference that is a must-attend and that will focus on the evolution of threats and new #CBRN challenges in the context of high-intensity conflicts. 🕒 Don't miss Henri Lancelin's talk on emerging threats and agents, new forms and detection challenges await. Meet Henri Lancelin throughout the week at our #booth 261 in Hall 5A to discuss these critical threats, our innovative detection solutions, and our capabilities to detect new agents like PBAs (including #opioids) or 4th generation agents. #Eurosatory2024 #NRBC #Proengin #ThreatManagement #DetectionSolutions #HighIntensityConflicts #4thGenerationAgents #SaveTheDate COGES EVENTS GICAT

28

1 commentaire

🔒 The Federal Police launched Operation PF, aimed at investigating cyber intrusions into the systems of the Federal Police and other international institutions. A search and seizure warrant, along with a preventive detention warrant, was executed in Belo Horizonte/MG against a hacker suspected of selling Federal Police data in 2020 and 2022. #Cybersecurity #FederalPolice #DataBreach 🕵️ The suspect, a well-known malicious actor, has claimed responsibility for leaking sensitive data from entities including InfraGard, a partnership between the FBI and critical infrastructure organizations in the U.S., as well as information from Airbus and the U.S. Environmental Protection Agency. #CyberAttack #DataLeak #FBI 💻 The individual is charged with invasion of a computer system, aggravated by the sale of stolen information. The investigation will continue to uncover any further cyberattacks linked to the suspect. #CyberCrime #DataProtection #Justice 📁 The operation highlights the growing threat of data breaches, where hackers exploit advanced techniques to infiltrate systems and steal sensitive information. Authorities are actively working to mitigate these threats and hold cybercriminals accountable. #CyberThreats #DataSecurity #LawEnforcement

4

Episode 21 - Graph DB: A must have for intelligent IAM systems 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   In this episode, we take a deep dive into the role of graph databases in Identity and Access Management (IAM) and explore why they are becoming indispensable in modern IAM systems.    For over 25 years, LDAP and relational databases have been the backbone of IAM. However, as the demands of IAM systems evolve, particularly in cloud-native and enterprise environments, it's clear that traditional databases are struggling to keep pace. It's time to introduce graph databases, a technology inherently suited for many IAM use cases.   While relational databases offer consistency and robust transactional support, they falter in handling the growing complexity of dynamic access control and scalable architectures. Graph databases, on the other hand, excel at managing complex relationships and connections—key elements in modern IAM systems.    In this episode, we discuss the limitations of RDBMS systems and explore how graph databases can transform IAM by offering smarter, more adaptable solutions for today's identity challenges.   https://lnkd.in/eV8QZDxt   #TheIdentityNavigator #IAM #Podcast #TechTalk   #IdentityAndAccessManagement

36

6 commentaires

"CISA has received multiple reports of a large-scale spear-phishing campaign targeting organizations in several sectors, including government and information technology (IT). The foreign threat actor, often posing as a trusted entity, is sending spear-phishing emails containing malicious remote desktop protocol (RDP) files to targeted organizations to connect to and access files stored on the target’s network. Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network." Are you confident that your employees have what they need to spot and avoid attacks like this? Training alone is NOT working. It's time to arm your employees, and your security team, with the real-time tools they need to spot and block attacks before they happen, across ALL digital platforms, not just email. It's time for change! It's time for PhishCloud Inc. PHISH360°! PhishCloud Phish360° addresses the critical weaknesses in today’s phishing defense systems by providing a real-time, comprehensive solution that not only detects and blocks phishing attacks but empowers employees and security teams to actively defend against them. PhishCloud Phish360° delivers a comprehensive, real-time phishing defense solution designed to protect the modern workplace. Stay ahead of phishing threats with PhishCloud Phish360°—because in today’s digital world, confidence is your strongest defense. Sound too good to be true? Give us 15 minutes to show you the power of PhishCloud Inc. www.phishcloud.com https://lnkd.in/gg2hPzyY

2

"CISA has received multiple reports of a large-scale spear-phishing campaign targeting organizations in several sectors, including government and information technology (IT). The foreign threat actor, often posing as a trusted entity, is sending spear-phishing emails containing malicious remote desktop protocol (RDP) files to targeted organizations to connect to and access files stored on the target’s network. Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network." Are you confident that your employees have what they need to spot and avoid attacks like this? Training alone is NOT working. It's time to arm your employees, and your security team, with the real-time tools they need to spot and block attacks before they happen, across ALL digital platforms, not just email. It's time for change! It's time for PhishCloud Inc. PHISH360°! PhishCloud Phish360° addresses the critical weaknesses in today’s phishing defense systems by providing a real-time, comprehensive solution that not only detects and blocks phishing attacks but empowers employees and security teams to actively defend against them. PhishCloud Phish360° delivers a comprehensive, real-time phishing defense solution designed to protect the modern workplace. Stay ahead of phishing threats with PhishCloud Phish360°—because in today’s digital world, confidence is your strongest defense. Sound too good to be true? Give us 15 minutes to show you the power of PhishCloud Inc. www.phishcloud.com https://lnkd.in/gg2hPzyY

1

Suggested reading of Security Library (Biblioteca de Segurança): A Guide for Anti-Corruption Risk Assessment - United Nations Global Compact Office. Check in: https://lnkd.in/dy7KArDi Download 74p. Security Library has the largest collection in the world about risk management, corporate security, cybersecurity, business continuity, etc. There are already over 3500 publications | Content in four languages: Portuguese, Spanish, English and French. Sinopse: The promulgation of regulatory guidance on the importance of an effective anti-corruption compliance programme has been steady and significant over the last few years, and has garnered media attention given the size of the fines some enterprises have paid. That media attention has, in turn, led to increased focus from management, board members and investors alike on corruption-related risk’s impact on stock value, company reputation, employee morale, and the people of the impacted countries. Effective assessment and mitigation of an enterprise’s corruption risk has been an element of many recent settlements with regulatory agencies. It is highlighted in both the OECD’s Good Practice Guidance on Internal Controls, Ethics and Compliance, and the Guidance issued to accompany the UK Bribery Act. It is also a critical element of the UN Convention against Corruption, including the 10th Principle of the UN Global Compact. The need for risk assessment and the approach outlined in this document is consistent with the “assess” step of the UN Global Compact Management Model framework. This step allows an enterprise to identify risks that can affect its performance and reputation from nonalignment with the 10 Principles of the Global Compact. Increasingly, companies across the world receive more lenient treatment in bribery prosecutions as an affirmative defense for the quality of their anti-corruption programmes in the event of employee misconduct. One key component of an effective programme is the assessment of the anti-corruption risk facing a given enterprise. Though much of the available regulatory guidance is instructive and highlights the importance of effective risk assessment, it fails to provide a “how-to” of such an assessment. #bibliotecadeseguranca #livrosdeseguranca #segurancacorporativa

9

🆕 The NOVA High Threat Response Committee June 2024 Update — +New incidents have been added to the High Threat Incidents Database and the Fire as a Weapon Incidents Database +Resources have been added to the following high threat topics: Active Violence, After-Action Reports, CBRN, and Key Components (Cybersecurity, Intelligence, and Whole of Community) 💻 Want access* to these resources and more? Please submit request here: https://lnkd.in/gNWx726X 💡 For more information on NVERS, please visit: https://www.nvers.org/htr *Access is limited to active first responders and public safety professionals. #highthreat #threat #threats #resources #activeviolence #CBRN #explosives #cybersecurity #intelligence #AAR #nationalsecurity #homelandsecurity #terrorism #extremism #violence #attack #attacks #fireasaweapon #FAW #targetedviolence #publicsafety #firstresponders #wholeofcommunity #resource #resources

6

Automated Generation of Cyber Threat Intelligence, written by the following authors: KAKUMARU Takahiro, TAKAHASHI Wataru, KATSUSE Riku, SIRACUSANO Giuseppe, SANVITO Davide, BIFULCO Roberto. Share and follow Threat Intelligence Lab!

26