Cornee Karels

Join our CISO track on CIODAY2024. We'll have sessions dedicated to cybersec execs, like this one: Best-of-breed vs best-of-suite in cybersecurity, with Esther Schagen-van Luit. Which side of "best-of" is your organization on? Join us and explore the pros and cons of best-of-breed or best-of-suite with Esther, Chief Security Advisor (CSA) at Microsoft. Discuss how your position as a CIO or CISO in that paradigm might rapidly shift as the cybersecurity threat landscape evolves and the vendor landscape seeks to follow suit. Join us and gain insights into which inflection points might tip the scale to the other side of "best-of" of your organization. 🔗 𝗙𝗼𝗿 𝗺𝗼𝗿𝗲 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻, visit: www.cioday.com 📌𝗥𝗲𝗴𝗶𝘀𝘁𝗲𝗿 𝗻𝗼𝘄: https://lnkd.in/dRSATezm #CISO #CIODAY2024

43

2 commentaren

🇮🇹 We’re bringing the expert-level stack exploit development class to Rome, Italy for the first time in history! 🇮🇹 You don’t want to miss out on this unique opportunity to take the first of our 2 world-renowned classes on exploit development for Windows. ⭐️ Our classes are an amazing investment in your future. The content will definitely broaden your offensive cybersecurity skills and put yourself in the drivers seat of your career ⭐️ Just to set the expectations straight: We’re not selling boxes, pdf files, videos. We’re only doing real classes, in person, lead by Peter Van Eeckhoutte himself. He has been working in the field of exploit development since 2005 and teaching classes since 2011. At the same time, you can still learn at your own pace. In fact, you’ll leave the class with: ✅ An unprecedented understanding of the inner workings and mechanics. We won’t tell you to “just do this or that”, but you’ll understand exactly “why”. ✅ The courseware is quite detailed and verbose ✅ Investment protection; Just to indicate how much we care about your education, we include FREE access to a post-training support system. You can ask questions at any time and we’ll be more than happy to guide you into the right direction. Yes, even years after you took one of our classes. Sign up now for our class in Rome, or check out our schedules page for other timings/locations: https://lnkd.in/e-GhbBW

55

1 commentaar

Want to know what top tech talent is earning in the Netherlands? Our new salary survey dives deep with insights from 1,600 professionals! Discover how you can offer competitive packages to attract the best in the industry. Download it now - link in comments🔗

14

1 commentaar

🚀 Starting up two new projects To help myself (and you) in determining the needed actions, I have written a blog about it. Happy reading! ✏ ✅ 📑 #project #prepare #activate #SAP #SalesCloud #ServiceCloud #Emarsys

2

** 𝐋𝐨𝐨𝐤𝐢𝐧𝐠 𝐟𝐨𝐫 𝐏𝐫𝐨𝐣𝐞𝐜𝐭 𝐒𝐮𝐜𝐜𝐞𝐬𝐬? 𝐁𝐞 𝐜𝐚𝐫𝐞𝐟𝐮𝐥 𝐰𝐢𝐭𝐡 𝐜𝐮𝐬𝐭𝐨𝐦𝐢𝐬𝐚𝐭𝐢𝐨𝐧! ** Last week I delivered a mini-Masterclass for the successful Dutch network organization Contakt Consulting. This company works with a flexible network of 700 IT professionals to deliver high-quality projects in a number of industries. And they have nice programs to train and inspire their network. The title of my Masterclass was‘𝐒𝐓𝐎𝐏 𝐢𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭𝐢𝐧𝐠! 𝐒𝐓𝐀𝐑𝐓 𝐝𝐞𝐥𝐢𝐯𝐞𝐫𝐢𝐧𝐠 𝐩𝐫𝐨𝐣𝐞𝐜𝐭 𝐬𝐮𝐜𝐜𝐞𝐬𝐬! With a group of around 20 people, we discussed the differences between the implementation of a software solution and the delivery of Project Success. Together we determined that 𝐢𝐧𝐯𝐨𝐥𝐯𝐢𝐧𝐠 𝐭𝐡𝐞 𝐜𝐮𝐬𝐭𝐨𝐦𝐞𝐫’𝐬 𝐦𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 is crucial for achieving success. We also concluded that the correct approach to customization is an important factor for achieving project success. I claimed that 𝐜𝐮𝐬𝐭𝐨𝐦𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐢𝐬 𝐜𝐨𝐦𝐩𝐚𝐫𝐚𝐛𝐥𝐞 𝐭𝐨 𝐩𝐞𝐞𝐢𝐧𝐠 𝐢𝐧 𝐲𝐨𝐮𝐫 𝐩𝐚𝐧𝐭𝐬. Yep - a bit of a weird metaphor of course. 🔥 So what is the logic behind this metaphor? ✅ Peeing in your pants is warm and comfortable in the beginning ☑ after a short time it gets cold ✅ it starts to smell ☑ everyone can see that you have wet your pants In other words: customisation oftentimes is enjoyable in the short term, but can be disastrous in the medium to long term! We discussed what both implementation partner and customer management must do and leave to minimize customization. Or even prevent it altogether. The attendees liked the session because of the provocation, the strong discussions and the concrete learning points. And luckily we also had a bit of fun together.  😊 This is what Business Partner Ruud Wijnants said after the Masterclass: “We asked Guus to give a presentation to our network of independent professionals of project managers and consultants. And what a great evening it was! His passion, energy, enthusiasm but especially his practical examples appealed to everyone. The tips & tricks flew around our ears. Not everything was taken for granted, so that there were also some tough discussions. But in the end, the value for the network and especially for our customers and relations remained proudly intact. We will certainly give this a follow-up.” So what do you do to inspire yourself and your customers to prevent (over-)customisation and achieve (more) Project Success? Check the comments to inspire both your own team as an implementation partner and your customers. #projectsuccess #cleveleducation #nocustomisation #d365 #microsoftdynamics

21

6 commentaren

Mission accomplished, Offensive X has ended. Now it’s time for me, Marek and Konrad to relax. But first, a quick recap of what I've learned from the conference. 1️⃣ A solid approach to Red Teaming exercises with a sprinkle of TIBER framework presented by Pieter Ceelen from (Outflank). 2️⃣ Apparently CREST created OWASP Verification Standard which is an accreditation for companies providing security assessments. This came straight from Tom Brennan during his keynote. 3️⃣ Bug hunting & exploit development was, is and will be hard(er). This is my conclusion from talk by Patroklos Argyroudis, Zisis Sialveras and Chariton Karamitas. (BTW. Good luck on your BH talk Zisis!) 4️⃣ Challenges with vulnerability disclosure within automotive industry are actually pretty similar to what we already know. So even though there is experience that could be gathered same mistakes are made. Thanks to Yashin Mehaboobe for this talk. And last, but not least we've had a chance to interact with Sofia by Hanson Robotics Limited which is a robot whose brain is powered by #AI. (Of course we immediately asked problematic questions and quickly got banned, hehe.) Thanks again to Athena and the entire team for this great event. See you next year! ☺️

69

1 commentaar

𝗔𝗜 𝗳𝗲𝗲𝗹𝘀 𝗹𝗶𝗸𝗲 𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝗶𝗻 𝗮𝗻 𝗶𝗺𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲 𝘀𝗽𝗹𝗶𝘁 𝘀𝘁𝗮𝗻𝗰𝗲. On one side, we witness incredible value creation and efficiency gains. On the other, there are predictions of doom: scenarios where LLMs take on more control, make critical mistakes, or amplify existing biases. The answer lies in 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗹𝗲 𝗔𝗜 and effective 𝗿𝗶𝘀𝗸 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁—making risks tangible and decisions explicit. This time, in Dutch! If that's an issue, you can always call on an AI assistant to help you translate it. Just remember—there's always a bit of risk involved. 😉

19

3 commentaren

I finished reading this book about cyber espionage and state sponsored hacking. There is an invisible war going on. I recommend this to anyone who is interested in cyber security and especially to those who are working in critical infrastructure, advanced research and state of the art products. You can never say you were not warned. A political observation: also on this topic Mark Rutte and his cabinets were asked to prioritise it but did next to nothing. Like on housing, emissions, energy infrastructure, asylum, healthcare, social care and intensive farming. Unfortunately the next cabinet won't be any different, bleak times ahead #cyberdefense #cybersecurity #itsecurity #stedin #enexis #alliander #tennet #waternet #rijkswaterstaat #asml #diginotar https://lnkd.in/egsTCXEe

3

So Useful! Must read blog. Elisa captured in 7 vivid visuals the essence of your mindset, and how to it can impact your daily life in a negative / positive way. She gives us useful tools to train the mindset so that you are better equipped to deal with fear, opinions, surrounding, and challenge.

5

Read more about Cyber Security to upgrade your and our business & IT security.

6

𝗙𝗼𝗿𝘁𝗶𝗳𝘆 𝘆𝗼𝘂𝗿 𝗖𝗹𝗼𝘂𝗱 𝗥𝗶𝘀𝗸 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝘾𝙡𝙤𝙪𝙙 𝙎𝙩𝙧𝙖𝙩𝙚𝙜𝙮: 𝙄𝙣𝙩𝙚𝙜𝙧𝙖𝙩𝙚𝙙, 𝙙𝙞𝙫𝙚𝙧𝙨𝙚, 𝙣𝙤𝙣𝙚 ... ⬇ Tune into the next episode of my series ⬇ Does your institution have a defined Cloud Strategy? Do your stakeholders understand the risk resulting from their cloud adoption? Just "letting cloud happen" by each stakeholder setting their own risk acceptance definition is not good enough. Your institution may be exposed to unwanted and uncontrolled risks and in particular unacceptable impact. The current post shows in continuation of the series "Fortifying Your Cloud Risk Governance" what to look out for, after having covered Cloud Risk Governance, Education, Assessments in earlier posts. 𝗞𝗲𝘆 𝘁𝗮𝗸𝗲-𝗼𝘂𝘁𝘀: An integrated Cloud Strategy, built on an agreed and top management endorsed Cloud Risk Governance with defined risk appetite, risk framework and impact assessment is important to embed and drive your cloud adoption. Later posts in this series will cover the Control Framework, monitoring and enforcing the controls, and the related 3rd Party Risk Management Framework.

31

1 commentaar

Radius protocol vulnerable to MITM Researchers from various universities, and the Dutch Centrum Wiskunde & Informatica and Microsoft have discovered a significant vulnerability in the RADIUS protocol, which is widely used for network access management in many ICS. This vulnerability, named Blast-RADIUS, allows for spoofing attacks where an attacker can log in to any device using RADIUS for authentication or grant themselves arbitrary network rights. The Blast-RADIUS attack exploits a fundamental flaw in the RADIUS protocol that uses an MD5 hash to verify responses, combined with the predictability of part of the hashed text, enabling a chosen-prefix collision attack. A man-in-the-middle attacker can intercept a failed authentication request and forge a valid ‘accept message,’ gaining access without needing to guess or brute-force passwords or shared secrets. The attack involves injecting a malicious attribute into a request, causing a collision between the authentication information in the server’s valid response and the attacker’s forgery. This manipulation can turn a server’s ‘reject’ response into an ‘accept’ and add arbitrary protocol attributes.

25

2 commentaren

Merge Approved! 🥳 I was recently able to give a small addition to the great toolset Dirk-jan Mollema has provided to our community for assessing Azure, https://lnkd.in/eg9Mr-2Z. These changes came after encountering a hardened Azure environment on a client assessment where obtaining Azure tokens in the organization was restricted almost exclusively to authorized browsers. With necessity being the muse of ingenuity, I worked with my team to make the best use of the access we had and perform collections once we had exfiltrated Single Page Application refresh tokens. I will eventually come up with a blog post to help explain how to leverage these changes in more detail. Anyone wanting to learn more about Azure and what it means when someone gets their hands on access and refresh tokens should check out SpecterOps and Dirk-jan's Azure courses. These taught me a large portion of what I now know and use for our client work. https://lnkd.in/eGgjFnWe https://lnkd.in/e_cfqcBz

97

Dear network, including board-members and ESG-folks :-) Listen in on this one, lifting your ESG-reporting, using Microsoft Cloud for Sustainability. My Fellowmind-colleague Merwin Olthof together with Microsoft is on - and it will be an eye-opener for ´how to´ :-) #sustainability #csrd #coludforsustainability #esg

8

How Ninjible can help with the powerful Kooboo platform

7

Are you aware of the vulnerabilities in your business processes and systems? Discover how you can protect your organisation against cyber incidents during the CGI 'Cyber Safety in the Supply Chain' event on Thursday 5 September at 'De Loft by RDM Next' in Rotterdam. Learn the latest insights from experts and peers on cybersecurity, business continuity, and supply chain security. With the advent of NIS2 regulations, it is essential to ensure not only your own cybersecurity, but also that of your suppliers. Don't miss out on this opportunity to increase your knowledge and strengthen your cybersecurity position. Sign up now and make your business resilient to cyber threats. hashtag #cybersecurity hashtag #supplychain hashtag #NIS2 hashtag #cybersafety

19