Kelvin Saitoti

Kenya, South Africa, & Nigeria are identified as the top three African countries susceptible to #cyberattacks. The CEH course will equip you with the skills to learn how to identify, combat & prevent cybersecurity attacks in businesses. To Apply: https://lnkd.in/djbC8zFP

5

SSCP Exam Changes – Effective September 2024 A title change is occurring for Domain 1. Security Operations and Administration will have a new title of Security Concepts and Practices. https://lnkd.in/dDmPu3iG #isc2 #sscp #cybersecurity #certification

3

🔐 SSL: How It Works, Its Benefits, and Critical Vulnerabilities 🔐 In the realm of cybersecurity, SSL (Secure Sockets Layer) has been pivotal in securing communications over the internet. But while it encrypts traffic and verifies authenticity, SSL/TLS is not immune to weaknesses. Let’s explore how SSL works, its advantages & critical vulnerabilities every organization should be aware of. How SSL Works: When a user connects to a website with SSL enabled (HTTPS), a secure connection is established via a handshake: 1. The server presents a digital certificate to prove its identity. 2. The client & server exchange public keys to establish encrypted communication. 3. Data is securely transmitted using session keys generated during the handshake. Benefits of SSL: 1. Encryption: Ensures sensitive data (like credentials & payment details) is secure from eavesdropping. 2. Authentication: Verifies the identity of the server, preventing users from connecting to malicious sites. 3. Data Integrity: Detects tampering during transmission, safeguarding the integrity of exchanged information. Limitations and Critical Vulnerabilities: 1. Outdated SSL Protocols: SSL 2.0 & 3.0 are considered obsolete & vulnerable to attacks like POODLE (Padding Oracle On Downgraded Legacy Encryption), which exploits SSL 3.0’s fallback mechanism to compromise encryption. 2. Heartbleed Vulnerability: This critical flaw in OpenSSL allowed attackers to steal data from a server’s memory, including private keys, usernames, and passwords. It underscores the need for up-to-date & patched SSL/TLS libraries. 3. BEAST & CRIME Attacks: BEAST (Browser Exploit Against SSL/TLS) exploits vulnerabilities in SSL/TLS encryption to decrypt sensitive data. Similarly, CRIME (Compression Ratio Info-leak Made Easy) exploits flaws in TLS compression to reveal encrypted data. 4. Certificate Authority Compromises: SSL relies heavily on trusted CAs to issue certificates, but if a CA is compromised (as seen in the DigiNotar breach), attackers can issue fraudulent certificates and perform MITM attacks. 5. Weak Ciphers & Keys: Using weak encryption algorithms or small key sizes (e.g., 1024-bit RSA) can make SSL vulnerable to brute-force attacks. Forward Secrecy should be implemented to ensure past communications remain secure even if long-term keys are compromised. 6. TLS Downgrade Attacks: Attackers can force a connection to use older, weaker encryption methods via downgrade attacks like Logjam and FREAK. These exploit flaws in the SSL/TLS handshake process & can undermine the security of modern TLS versions. Mitigating SSL/TLS Vulnerabilities: - Use TLS 1.2+ & disable SSL 2.0/3.0. - Implement HSTS to enforce HTTPS connections. - Use strong ciphers like AES-256 & 2048-bit RSA keys. - Regularly update & patch OpenSSL/TLS libraries. - Enable Forward Secrecy to protect past sessions if keys are compromised. #CyberSecurity #SSL #TLS #Vulnerabilities #Encryption #WebSecurity #AdvancedSecurity #Network

113

What's holding you back? In this fast-paced digital world, stay ahead with an ISACA certification exam prep. Get on track to building your credentials, boosting your earning power and advancing your career. https://lnkd.in/dj57HEk6

1

🔒 5 Tips For Data Phishing Awareness!!! 💪 Safe From Cyber Security Threats! ✅ Use Two Factor Authentication ✅ Don't click unknown Links ✅ Educate yourself and others ✅ Beaware of Urgent Requests ✅ Report Suspicious Activity Request For Free Assessment !!! 📞 +27 12 770 2257 🌐 erpsm.co.za 📧 [email protected] #applicationsecurity #cyberattacks #bankingsecurity #digital #cybersecurity #cybersecurityawareness #cybersecuritytraining #cyberthreats #digitaldefence

2

Passed Certified in Risk and Information Systems Control® (CRISC®) certification yesterday. This Exam is one of the best comprehensive assessment of Risk Management skills whish is required at workplace. #CISO #informationSecurity

156

40 Comments

ℹ️ 🔔 NEW CYBER THREAT ALERT!!!!!!!!!!** How fake job offers can be used to gather sensitive information #cysapafrica #africa #cybersecurity #informationsecurity #informationtechnology #cybersecuritynews

7

Good Governance in Cybersecurity Guide The Guide to Good Governance in Cybersecurity by the Geneva Centre for Security Sector Governance is an essential resource for understanding the intersection of cybersecurity and governance. It outlines key principles of good security sector governance, emphasizing accountability, transparency, and the rule of law. Key Highlights: - Introduction to Governance Concepts: The guide explains governance within the security sector and how these principles apply to cybersecurity contexts. - Legal Frameworks: It discusses international and regional legal frameworks that shape cybersecurity policies and practices. - National Strategies and Collaboration: The document emphasizes the importance of national cybersecurity strategies and effective cooperation between public and private sectors to enhance security in cyberspace. - Best Practices: It features case studies and examples from various countries, showcasing effective governance practices in addressing cybersecurity challenges. This guide serves as a valuable tool for policymakers, technical experts, and civil society, aiming to foster a more secure and stable cyberspace through good governance practices. Ibrahim

72

2 Comments

Kenya, South Africa, and Nigeria are identified as the top three African countries susceptible to cyberattacks. The CEH course will equip you with the skills to learn how to identify, combat & prevent cybersecurity attacks in businesses. Apply Today: https://lnkd.in/djbC8zFP

7

#Cybersecurity "The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented." "...the policy on the security of network and information systems shall: (a) set out the relevant entities’ approach to managing the security of their network and information systems; (b) be appropriate to and complementary with the relevant entities’ business strategy and objectives; (c) set out network and information security objectives; (d) include a commitment to continual improvement of the security of network and information systems; (e) include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies; (f) be communicated to and acknowledged by relevant employees and relevant interested external parties; (g) lay down roles and responsibilities pursuant to point 1.2.; (h) list the documentation to be kept and the duration of retention of the documentation; (i) list the topic-specific policies; (j) lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security; (k) indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’). " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse

3

#Cybersecurity "The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented." "...the policy on the security of network and information systems shall: (a) set out the relevant entities’ approach to managing the security of their network and information systems; (b) be appropriate to and complementary with the relevant entities’ business strategy and objectives; (c) set out network and information security objectives; (d) include a commitment to continual improvement of the security of network and information systems; (e) include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies; (f) be communicated to and acknowledged by relevant employees and relevant interested external parties; (g) lay down roles and responsibilities pursuant to point 1.2.; (h) list the documentation to be kept and the duration of retention of the documentation; (i) list the topic-specific policies; (j) lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security; (k) indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’). " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse

15

Cisco’s report also provides some essential guidance that organizations should adopt in order to meet the growing challenge and provide more effective cyber security protection. Some of these measures include; 1. Implementing scalable cloud security solutions 2. Ensuring alignment of corporate policies for technology, applications and processes 3. Implementing network segmentation, advanced endpoint security and incorporating threat intelligence into security monitoring 4. Reviewing and practicing security response procedures 5. Adopting advanced security solutions that include AI and machine learning, especially where encryption is used to evade detection While the security report is essential reading for all personnel responsible for an organization's information assets, in many areas it reiterates what we have been hearing about in the news and trade publications. The essential call to action is really to make a good start by doing the essentials. If you have already done this, then keep testing, refining and improving your cyber security posture.

3

🔐 NIST Cybersecurity Framework (CSF): Understanding Subcategory GV.SC-05 🔐 Cybersecurity isn’t just about protecting your own organization—it’s also about ensuring your partners and suppliers are secure too. That’s where NIST CSF Subcategory GV.SC-05 comes in. GV.SC-05 is all about establishing and prioritizing requirements to address cybersecurity risks in your supply chains. It ensures that these requirements are not just discussed but also integrated into contracts and agreements with suppliers and other third parties. Why does this matter? In today’s interconnected world, the security of your supply chain is just as important as your internal security. A vulnerability in a supplier’s system can quickly become a vulnerability in yours. By embedding cybersecurity requirements into contracts, you ensure that your partners are held to the same standards, reducing overall risk. For those new to the NIST Cybersecurity Framework, it’s a set of guidelines designed to help organizations manage and reduce cybersecurity risks. It’s widely adopted across industries for its practical and flexible approach. 🌐 Protecting your organization means protecting the entire network it depends on. GV.SC-05 helps ensure that your cybersecurity efforts extend beyond your walls. #Cybersecurity #NISTCSF #SupplyChainSecurity #RiskManagement #ThirdPartyRisk

11

If you want to seek a certificate reflecting your skills, expertise, due care, and due diligence, distinguish yourself from dumpster certificate divers , challenge certificates from proven vendors like ISC2. You, generally won't see certificates from ISC2, among the certifications offered to you by some IT sales managers via LinkedIn chat because, I believe that ISC2 guards its reputation rigorously in the security market by all means. Let's switch to my CCSP journey and recommendations related to exam preparation: If you think you know concept deeply, It is not enough to claim "I know Kung Fu", you should show it on battle scene lasting 4 hours. Luckily, this time I also didn't violate the habit of passing ISC2 exam on first try. This is a third achieved certificate from ISC2 in a row. Below study materials and tests used for CCSP exam preparation are listed: 1.Official Study Guide by Mike Chapple 2. LinkedIn CCSP learning course also by Mike Chapple 3. LearnZapp test prep application 4. Invaluable YouTube CCSP course by invaluable Pete Zerger, vCISO, CISSP 5. Final nail beaten into the coffin using Pocket Prep. I will continue to challenge other certifications by ISC2 until the exam center provides a color printer for candidates. #ISC2 #CCSP #pass

253

28 Comments

simple report ,well elaborated and can be understood by non tech people.Good presentation to Management

4

1 Comment