Charl van der Walt

In Sekurokon 2024 breakout session ‘Breaching Corporate Facilities: Redacted Stories of Physical Intrusions’, #Sekuro Offensive Security Consultant Craig Dutton and Managing Consultant Steven Knight delve into real-world physical intrusion tactics used in corporate environments. Through redacted examples from Sekuro’s own physical intrusion engagements, Craig and Steven break down the TTPs – tactics, techniques, and procedures that attackers use to target corporate infrastructure. Revealing the impact of commonly exploited vulnerabilities, the speakers will also recommend actionable security practices to strengthen an organisation's physical security. Expect practical takeaways and success stories that can help safeguard your infrastructure. Join us for this exciting breakout session and explore many more at Sekurokon: www.sekuro.io/sekurokon #WeAreSekuro #TrustTomorrow #InfoSec #CyberSecurity #OffSec #PhysicalSecurity #VulnerabilityManagement #VulnerabilityAssessment

13

1 Comment

What to expect from Arco Free. Measure yourself against international standards (ISO 27001, NIST CSF, NCSC CAF, CISv8, Cyber Essentials Plus), Digitally assess your performance, and benchmark your performance against similar organisations. #cybersecurity #arcofree Get Arco Free https://lnkd.in/eM_bp7iC

10

"The NPSA PerSec Maturity Model has been designed to specifically assess an organisation’s personnel #security maturity. This is a key factor, in addition to physical and #cybersecurity measures, in strengthening an organisation’s #resilience to insider and wider external security threats. " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

21

"The NPSA PerSec Maturity Model has been designed to specifically assess an organisation’s personnel #security maturity. This is a key factor, in addition to physical and #cybersecurity measures, in strengthening an organisation’s #resilience to insider and wider external security threats. " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

17

1 Comment

"The NPSA PerSec Maturity Model has been designed to specifically assess an organisation’s personnel #security maturity. This is a key factor, in addition to physical and #cybersecurity measures, in strengthening an organisation’s #resilience to insider and wider external security threats. " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

10

1 Comment

Fake Data Breach Alert ⚠ ⛔ - Earlier yesterday, a threat actor claimed to have breached and leaked sensitive employees data from a well-known Egyptian bank. Upon thorough investigation by DeXpose team, we have concluded that the claims are false. The alleged “leaked” data is simply recycled information from the 2019 Facebook breach, repackaged to appear as a fresh compromise. This serves as a reminder to always validate breach reports and stay cautious against misinformation. If you have any questions or concerns about potential breaches, feel free to reach out. #CyberSecurity #ThreatIntelligence #DataBreach #DeXpose #DataProtection

16

1 Comment

𝗤𝘂𝗶𝘀𝗵𝗶𝗻𝗴 𝗮𝗻𝗱 𝗲𝗺𝗲𝗿𝗴𝗶𝗻𝗴 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 : 𝗵𝗼𝘄 𝘁𝗼 𝘀𝗮𝗳𝗲𝗴𝘂𝗮𝗿𝗱 𝗔𝗳𝗿𝗶𝗰𝗮 ? Between January and July 2022, Kaspersky reported an alarming 15,769,298 phishing objects detected in Africa. This frightening figure was mentioned by Interpol in their latest Cyber Threat Assessment Report in Africa (African Cyberthreat Assessment Report 2023). Key Discussion Points: - While phishing remains one of the most common and dangerous cyber threats in Africa, how are states and businesses fighting against this threat? - How do they anticipate the emergence of new scams such as vishing, quishing, and other deep fakes, notably boosted by AI? - What solutions are provided by expert companies in Africa? - How can we strengthen cooperation for a global response? Join us to explore these pressing issues and discover expert insights on safeguarding Africa from these evolving cyber threats. Your participation and insights will be invaluable! 📍 𝗩𝗲𝗻𝘂𝗲: Circuit Moulay El Hassan, Marrakech 🔗 𝗦𝗲𝗰𝘂𝗿𝗲 𝗬𝗼𝘂𝗿 𝗦𝗽𝗼𝘁 : https://lnkd.in/dSCfvQNi 🔗 𝗟𝗲𝗮𝗿𝗻 𝗠𝗼𝗿𝗲 : https://lnkd.in/ecC7g7XA #CyberSecurity #Phishing #Quishing #EmergingThreats #AfricaPayIDExpo #TechInAfrica #CyberThreats #AI #CyberSafety #GlobalCooperation #TechEvent #Marrakech

6

Brute force attacks, compromised IT networks and poor account management investigated in the latest Commission’s Decision cases. 🔍 Here’s an overview: - 3 organisations were found to have breached the Protection Obligation for failing to put in place reasonable security arrangements to protect personal data in its possession or under its control. - One of these organisations also breached the Accountability Obligation for failing to appoint an individual to ensure compliance with the PDPA. - The PDPC has also accepted voluntary undertakings from six organisations. Learn more about what happened, ways that organisations could have prevented these incidents and remediation actions taken in the quick summary below. 🔗 For the full case facts, visit https://lnkd.in/gyFMVTJM (In determining on whether to impose a financial penalty, and if so, the amount of any such financial penalties, the PDPC will deliberate over the factors listed in section 48J and 48J(6) of the PDPA respectively. Each case is decided on its specific facts and circumstances as listed at Section 48J(6) of the PDPA.) #PDPCSingapore #PDPA

13

The Joint Standard 2 of 2024 on cybersecurity & cyber resilience requirements https://lnkd.in/dvuD7c65 Gabi Richards-Smith, Mateen Memon and Malibongwe Zwane | Webber Wentzel | The Financial Sector Regulation (FSCA) and the Prudential Authority (PA) published Joint Standard 2 of 2024 on  Cybersecurity and Cyber Resilience Requirements on 17 May 2024. The Joint Standard 2 of 2024 (Joint Standard) applies to all financial institutions as defined in the Joint Standard. It sets out the requirements for sound practices and processes relating to  cybersecurity and cyber resilience for financial institutions. The Joint Standard is expected to commence on 1 June 2025. The FSCA and PA will formally publish the effective date by publishing a notice on their websites... #cybersecurity #cyberresilience #standards #FSCA #authentification #data Gabi Richards-Smith Mateen Memon Malibongwe Zwane Webber Wentzel

3

#CISA Preparation: Brief yet useful Kerberos: "Securing Your Network with Trusted Authentication" This article provides an overview of Kerberos, detailing its components, functionality, benefits, and associated risks. For CISA Prep Training Batch, Enquire Here -https://lnkd.in/dwpDkrJk #cisa #cism #isaca #isc2 #informationsystems #informationsystemsauditing #informationsystems #isaudit #itaudit #audit #auditor #auditing

15

The NCSC would like to draw your attention to CVE-2024-4358 and CVE-2024-1800 affecting Progress Telerik Report Servers. The chaining of these two vulnerabilities can lead to unauthenticated remote code execution on vulnerable servers. The NCSC is aware of a publicly available proof of concept (PoC).   👉 CVE-2024-4358 can allow an unauthenticated attacker to gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.   👉 CVE-2024-1800 can lead to remote code execution through an insecure deserialisation vulnerability.   The NCSC encourages organisations in New Zealand that use the affected product to review the vendor advisory, check impacted devices for evidence of exploitation and compromise, and apply the patches as soon as possible.   Vendor advisory 🔗 https://lnkd.in/gTVKEvng #cybersecurity #infosec #vulnerability

21

🚨 If your organisation uses Progress #Telerik Report Servers, we recommend reading the Progress Software vendor advisory to protect it from two identified vulnerabilities. Chained together, these vulnerabilities can lead to unauthenticated remote code execution on vulnerable servers.   Tracked as CVE-2024-4358 (CVSS: 9.8) and CVE-2024-1800 (CVSS: 9.9), both are critical and require updating your version of Report Server. 🔗 https://lnkd.in/gTVKEvng 🔗 https://lnkd.in/eMGfwQRb #cybersecurity #infosec #vulnerability #TelerikReportServers #ProgressTelerikReportServers #ProgressSoftware

3

Maturity Assessment package includes the following: Comprehensive Assessment: An assessment is undertaken to evaluate your cyber security posture and maturity against 20 security controls. The assessment looks at 20 of the most critical NIST CSF controls, split across 15 core security domains, covering people, processes, and technology. Maturity Gap Report: You will receive a detailed report that benchmarks your current cybersecurity posture and identifies any gaps. This report will also provide you with clear next steps to help elevate your maturity level. Risk Scenario Assessment Report: Based on supplied cyber risk scenarios, including the potential impact they would cause should they occur. Executive Summary and Strategy Document: A valuable resource for your senior management, this document will be based on the gap and risk assessments. Optional Follow-Up: To ensure your ongoing cyber security success, we offer an optional complimentary follow-up assessment after your initial consultation. For more information - https://lnkd.in/gtuNxxHb

5

👏 Secure by Design: A Lighter Version from CISA At the RSA conference, between 68 and 80 major IT companies (depending on the CISA link you follow), under the auspices of CISA, made a voluntary commitment to develop products that are secure by design. https://lnkd.in/g2nJW6Zd https://lnkd.in/eGUPfiCR This commitment appears ambitious, as secure by design implies at least a product created using the SDL methodology, and at most, cyberimmune. https://lnkd.in/dQSdNGdU However, as the saying goes, set yourself achievable goals. Over the next 12 months, the signatories have pledged to demonstrate measurable progress in seven areas: 🟣 Incorporating mechanisms in products that extend the use of MFA; 🟣 Eradicating default passwords; 🟣 Utilising coding methodologies to eliminate entire vulnerability classes: SQLi, XSS, memory corruption; 🟣 Promoting timely patching: implementing auto-updates or simplifying manual updates for users; 🟣 Establishing a vulnerability disclosure policy, facilitating vulnerability research, publishing contact information for these purposes, publicly committing to refrain from legally pursuing security researchers responsibly disclosing vulnerabilities; 🟣 Transparently and promptly reporting discovered CVEs, including data on CWE and CPE for each vulnerability; 🟣 Simplifying artifact collection for users if a cyberattack impacts the developer's products. All of the above is indeed extremely necessary and beneficial, even if these measures are not labelled as secure by design. Let's observe how Cisco, Fortinet, Ivanti, Microsoft, Netgear, or Okta, who have signed the pledge, will progress along this roadmap 🤪 #news #cybersecurity #SDL

13

𝐊𝐞𝐲 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐞𝐬 𝐢𝐧 𝐂𝐲𝐛𝐞𝐫 𝐒𝐮𝐩𝐩𝐥𝐲 𝐂𝐡𝐚𝐢𝐧 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: 𝐎𝐛𝐬𝐞𝐫𝐯𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐫𝐨𝐦 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 The National Institute of Standards and Technology (NIST) document outlines key practices in #CyberSupplyChain Risk Management (C-SCRM). It emphasizes identifying critical suppliers, assessing risks across the #SupplyChain, and implementing #SecurityControls. It highlights #IndustryCollaboration, #Monitoring, and #AontinuousRiskAssessment to protect against vulnerabilities and #CyberThreats throughout the supply chain.

6

#FINSEC2024: Panel discussion - "Emerging Technologies and Transaction Security 2027", offered deep insights on the role of security practitioners as guardians in the cybersecurity environment. The panelists highlighted the importance of understanding the cybersecurity business model to develop cost-effective and fit-for-purpose security solutions. The debate on whether we need exceptional products or robust, resilient ones was particularly enlightening, stressing the need for resilient solutions over merely advanced ones. Kalpesh Doshi, Ramesh Gurram, Nasser Prakash

112

1 Comment