Tal Mozes

This posting is about the EU Identity Wallet for PAYMENTS. Since the Large Scale Pilots (LSPs) keep their stuff under wrappers, I have only managed to find a single public specification 😥 This specification (https://lnkd.in/duDRtxfX) builds on standards that haven't yet been subjected to utility and implementability testing, like OpenID4VP and Berlin Group's "Signed Payment Request". In addition, the current specification deviates pretty dramatically from the beaten path by talking about Users "presenting" payment credentials to Merchants which in turn are supposed to "verify" such credentials. Unsurprisingly, what exactly Merchants could possibly "verify" isn't specified. This idea also seems to violate privacy-by-design principles and GDPR. In existing payment authorization systems, Issuers (Banks) are the only parties who can "verify" the User part of payment authorizations. If the EU is serious about payment support in the wallet (?), they may need to step in now.

24

7 Comments

Since our inception, we at Levo.ai have pioneered and championed a proactive approach to API Security- one that empowers your DevSecOp teams to build security into APIs and, as a result, applications instead of chasing false positives in production. As this approach becomes more widely adopted, new questions arise, such as: ‘Why can't this be a one-time process? Why do we need continuous discovery, documentation, and testing?’ Go through the below carousel to learn how the very nature of modern applications and APIs mandate an ongoing commitment to API Security. #apis #apisec #devsecops #enterprisesec #appsec

12

1 Comment

The world has changed, the weaponisation of #AI has already started, it is here - I do hope you can join us on 21 November: Register here: https://lnkd.in/eZRityxm Come to understand how the attacks unfold, the tactics that are being seen and discover ways to prevent this happening to your people. #J1TopTip J2 Software #J2CSC #cyber #security SlashNext

15

1 Comment

Open Source and Fully Decentralized, only secure path to AGI🖖🎵👍

3

If this is as prevalent as suggested, it is a sad day for the industry as a whole, and an excellent reminder of why during audits and assessments we evaluate topics such as: 1 - Consideration of fraud as a function of risk assessment practices. 2 - Evaluation of leadership and "tone at the top" as it relates to the design and implementation of the corporate information security program. 3 - Availability of mechanisms to report concerns associated with information security, regulatory compliance, ethics... And so much more... Integrity is the essence of everything successful. ~ R. Buckminster Fuller

5

Camouflage, phishing, political rhetoric and subterfuge all involve deception. Failing to distinguish fake from genuine can - literally - be life-threatening, but may be neutral, even beneficial. My latest philosophical phriday blog explores the spectrum. As always, comments and counterpoints are welcome. Go ahead, say what you REALLY think. https://lnkd.in/gUeyZNBH

1

At Cappricio Securities , we develop tools for finding security vulnerabilities and publish them on our Pip and GitHub accounts🛡️ you can check them out through these links: GitHub: https://lnkd.in/dtvuUwsR PIP: https://lnkd.in/dYYXg8Gn An interesting insight- We've even gained clients by the amazing reach of our cybersecurity tools. A detailed story will be coming up soon... 📰 Before that, take a look at our tools. 🔍 Cheers!🥂

35

2 Comments

Next up on the GenAI Summit are the seminars and workshops. 🔍 Seminars: **Information Security and Compliance for Generative AI by RapidSOC2: Having worked extensively in AML Compliance and preparing for audits, this topic was a natural draw for me. Vic Bhatia's approach to ensuring SOC2-compliant documentation is available quickly is particularly relevant for startups. Additionally, my advice, based on experience, is to maintain good processes and establish regular reviews to ensure ongoing compliance. **How to Use Data to Empower Your Business by speakers from Streetbeat, Zuora, Voicebot.ai, Openmart (YC W24): The session provided a comprehensive look at data quality, centralization, and data labeling. In today’s world, smart data management and effective governance are essential for a competitive edge. For those interested in understanding data labeling further, I recommend the TED talk by Kasia Chmielinski, a data reformist ( link posted in the comment), which breaks this down very well. 🛠 Workshops: Although I didn’t get around to attending any workshops in full, I found the following particularly interesting in the short time I spent at them: ** IBM watsonx: The team’s focus on AI governance was impressive, showing a thoughtful and intentional approach to managing the AI curve.  The IBM watsonx team members I met were incredibly knowledgeable and genuinely passionate about their work. Their enthusiasm was truly inspiring and contributed to a highly engaging experience. ** How to Monetize GenAI with Zuora: This workshop offered intriguing perspectives on consumption pricing strategies. It highlighted the vast monetization opportunities, and my key takeaway was that it is more important than ever for technology architects to have a holistic approach while defining strategy. #GenAISummit #AI #Innovation #TechConference #SanFrancisco #GenerativeAI #FutureOfAI #Networking #Learning #Collaboration

14

3 Comments

This is big. NIST’s latest report on PQC transition now has dates on when algorithms like RSA with lower bit strength be deprecated and then disallowed. If you are in security, what’s your crypto agility solution?

80

Excited to ship the next milestone for the Trinsic Identity Acceptance Network - our suite of SDKs 🚀 Our SDK allows businesses to accept digital IDs inside their existing IDV stack, alongside their existing vendors. Ever since our successful launch in May, this has been the most requested feature: compatibility with customers' existing IDV/fraud stack. Today’s SDK release does just that - extends the magic of digital ID acceptance to any existing flow. ✨ I started Trinsic because to me, it's unacceptable that humanity has self-driving cars, space tourism, gene editing, etc. and yet the cutting edge of verifying a user’s identity involves photographing a plastic ID card. Obviously digital IDs, which are 10x faster than uploading a physical ID and result in less fraud, are the future. If they're so much better, why isn't digital ID acceptance widespread? Because digital IDs are extremely fragmented and adoption rates vary wildly by geography. Trinsic's new SDKs solve this by allowing businesses to check for a digital ID before a doc scan. If a user can share a digital ID, great! Less friction & fraud! If they can’t, no problem! Fallback to your existing process! In fact, regardless of whether adoption rates are 8% or 88%, this model works. Checking first for a digital ID + falling back to a doc scan is the win-win model for businesses and consumers. Setting up ID Acceptance in this way, it’s really a no brainer for businesses. In fact, I had back-to-back calls recently where prospects asked “Are there any downsides?” and then “What objections do you usually get? I’m struggling to think of any.” Digital ID acceptance isn’t a far off future, it's a game-changer now. If you’re doing doc scanning (or if you’re a doc scanning vendor!) shoot me a DM, I’d love to show you how easy this is. Or see the attached announcement to learn more: https://lnkd.in/eP6B4gSj Big shoutout to the team, we shipped these SDKs insanely fast and with a very high quality bar. Happy with everybody who worked to make this happen 🚀

78

6 Comments

An #Iranian #cyber-operations group, #Emennet Pasargad — also known as #Cotton Sandstorm — has broadened its attacks, expanding its targets beyond Israel and the United States and targeting new #IT assets, such as #IP cameras. In an advisory published last week, the #US Departments of Justice and Treasury — along with the #Israel National Cyber Directorate (#INCD) — called out the change in tactics and noted that the group had provided resources and infrastructure services to Middle Eastern threat groups by operating as a legitimate company, Aria Sepehr Ayandehsazan (#ASA). In addition, since the beginning of the year, Emennet Pasargad has scanned for IP cameras, targeted organizations in #France and #Sweden, and actively probed a variety of #election sites and systems, according to the government advisory. #cyberespionage #cybersecurity

3

Transparency in our digital infrastructure is crucial. Just as we insist on knowing the ingredients in our food, we must demand detailed 'receipts' for the complex software and hardware systems in our enterprise stack—including laptops, servers, networking devices, IoT, OT, GenAI and more.

10

1 Comment

Thought for the day…   In the physical world, one hobby I have is researching the many asteroid impact craters around the planet. https://lnkd.in/eFCsJjfc It’s interesting to reflect back across the millions of years since the planet experienced these catastrophic events.   In the cyber world, I have a similar hobby of researching the many privacy “impact craters” around the planet. Though here we can look back across the billions of records exposed since the planet experienced each of these catastrophic events. https://lnkd.in/eePbcDNG   With my CISO hat on, I’m working to make sure my organization isn’t the source of the next large breach on this map/timeline. With my DPO hat on, I’m working to make sure my data subjects don’t (again) find themselves at the bottom of the next privacy impact crater.   #cio #ciso #dpo #cro #privacy #privacyrisk #cyberrisk #privacyenhancingtechnology #informationsecurity #riskmanagement #riskmitigation #boardofdirectors

26

2 Comments

Token theft - stealing temporary access credentials from the user's browser - is a powerful threat vector. To reduce damage from token theft, we can clip its wings (something the browsers are working on), and / or we can reduce its bite. Read all about it in this latest blog post:

19

2 Comments

What is Transaction Monitoring? With Transaction Monitoring, you gain the ability to precisely mimic user interactions within a browser environment. Whether navigating your website, adding items to a shopping cart, or progressing through the checkout process, our solution allows you to replicate any actions performed by real users. https://lnkd.in/dF63qGyw https://lnkd.in/ddi7Gc5e MonSpark #Monitoring #UpDown

8

Last week, Francis Odum released a very well-written new research report titled, "The Evolution of the Modern Security Data Platform," which highlights Observo.ai as a key player in this new landscape. Our customers are implementing modern SOC architectures with our tech, and it was refreshing to see Francis's thoughts. The age of simply throwing data over the wall and expecting the SOC to work efficiently and effectively is over. The future of SOC architectures will be quite different with more loosely coupled pieces that work together well. Data becomes the king and AI approaches assist in making the SOCs leverage this data fully to secure enterprises efficiently. As the tech landscape evolves and the data tsunami continues, it's clear that existing SOC platforms don't scale, and a modern SOC architecture is the need of the hour. Check out our piece on the Modern SOC and how Observo.ai fits into it: https://lnkd.in/gzNWPTBJ #soc #siem #etl #security #observability

28

6 Comments

🗣️ Huge news today! I’m proud to announce Snyk has acquired Probely to boost our API security Testing and modern DAST capabilities 🚀 Why Probely and why now? Throughout 2024, we’ve heard from our global customers, especially those that are early AI adopters, that the need for API security testing has become increasingly crucial as they create more AI-native applications. The Probely team’s API-first approach perfectly aligned with Snyk’s mission to create a robust security ecosystem that will now also incorporate dynamic testing. By powerfully combining these Probely capabilities with the Snyk Developer Security Platform, we’ll be equipping and empowering more global enterprises to: ✅Shift Security Left ✅Proactive defense in depth for Modern Applications ✅Accelerate Secure AI App Development Welcome to Nuno Loureiro and the entire Probely team – thank you to them and all of the Snykers worldwide and our design partner customers, that helped make today’s acquisition come to fruition. Now, let’s get to work! I wrote more on the acquisition deal for Snyk's blog, check it out here to dig in deeper: https://lnkd.in/exP4UmCk  If you’re interested in learning more, please join me in a webinar on Mon., 12/9, at 11:30 a.m. ET ➡️https://bit.ly/4foRXHq

105

3 Comments

It's time for open source stakeholders to step up and invest in sustainable security solutions. Are we ready? Check out this discussion at TechCrunch featuring Tidelift's Chief Counsel Luis Villa and various other Cybersecurity experts...

5