 | ||||
 What's New |
 Highlights |
|||
|
The PCI Security Standards Council Announces the 2023-2025 Advisory Board The PCI Security Standards Council (PCI SSC) announced the newly selected 2023-2025 Advisory Board. The Advisory Board represents the Council's Participating Organizations (POs) worldwide to ensure the industry's global participation in the development of PCI standards and programs. As strategic partners, they are representative of the market and provide geographic and technical expertise to the Council. Welcome to the newest Associate Participating Organizations We are pleased to welcome the newest organizations to join as Associate Participating Organizations of the PCI Security Standards Council (PCI SSC). These organizations play a crucial role in supporting the evolution of PCI security standards and programs and promoting the implementation of PCI security standards worldwide to protect payment data. We look forward to their participation in the Council as we help secure the future of payments. More information at the following link: Major historical milestone for payment software security The PCI Security Standards Council recently reached a significant milestone of 100 products validated under the Secure Software Standard. We sat down with Jake Marcinko, Senior Solutions Standards Manager, and Matt O'Connor, Director of Products and Solutions, to discuss what this milestone means for payment security.
More information at the following link: |
Update your ISO 27001 ISMS to the new 2022 version The latest version of ISO/IEC 27001, published on October 25, 2022, gives organizations a 3-year transition period to adapt and certify their systems to the new standard.
Tips: How to Get Started in Hacking On this occasion, Héctor Berrocal, from the audit department at ISECAuditors, shares some tips for getting started in the world of Ethical Hacking and provides a brief overview of hacking. Regulatory changes and their impact on corporate decision-making structures In May 2017, the authorities that make up the European System of Supervisors for Financial Services—the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), and the European Insurance and Occupational Pensions Authority (EIOPA)—published a series of proposals reaffirming the need to create a common cooperation framework that would balance innovation with consumer protections from the perspective of digital service provision. ASV Scans Are Not Just a Compliance Task In 2006, a group of financial entities concerned about the high rate of card fraud founded a council called the PCI Security Standards Council. This group is composed of American Express, Discover Financial Services, JCB International, MasterCard, VISA, and other organizations that have joined these efforts, thus giving birth to PCI DSS.
To facilitate monitoring and support for compliance with the PCI Council standard, different roles were created so that organizations can obtain the appropriate assistance from security experts who can guide them and assess compliance. One of these is an ASV (Approved Scanning Vendor). Vicente Aguilera Once Again a Juror for the IT Security Awards Red Seguridad magazine is celebrating the 16th edition of its prestigious IT Security Awards this year, which also coincides with its 20th anniversary, promising a particularly significant turnout. These prestigious awards will be presented at the 15th Comprehensive Security Meeting (Seg2), which will take place in June. The purpose of these awards is to publicly recognize the most outstanding professionals, projects, programs, operations, and solutions from the past year. Once again, Internet Security Auditors will be there with Vicente Aguilera as a member of the jury representing OWASP, a role he has held since the second edition of these awards 16 years ago. Event Report: OSINTomático Conference 2023 On May 12 and 13, a new edition of OSINTomático was held at the La Nave Convention Center in Madrid. These conferences were created with the goal of educating and raising awareness among students, professionals, companies, and the general public about open-source intelligence and social engineering techniques through presentations and workshops delivered by internationally renowned speakers. |
 Incident Analysis |
||
|
SEGA Europe Suffers a Database Leak Due to Internal Negligence, Exposing Sensitive Information After an exhaustive investigation, the security firm VPN Overview discovered that SEGA Europe may have fallen victim to a data breach. The seriousness of the situation is that this problem could have been avoided, as it stemmed from internal negligence within the Japanese company itself. According to the security firm's investigation, SEGA apparently left sensitive information stored in a publicly accessible database. | ||||
|
Russian Cybercriminals Exploit a Vulnerability in MOVEit to Attack U.S. Government Agencies The Cybersecurity and Infrastructure Security Agency (CISA) reported that a group of Russian cybercriminals managed to infiltrate several U.S. government agencies. The group, known as 'CL0P' or 'TA505', has been identified as responsible for this cyberattack. Although there is no evidence of coordination with the Russian government so far. | ||||
|
This is how the cyberattack on Uber unfolded, step by step After the cyberattack on Uber and its IT infrastructure and access to confidential customer data became known, the human element of this story is gaining prominence, drawing attention to multi-factor authentication (MFA) and other best practice issues in Identity Security. | ||||
|
The CAV recorded 6,086 cybercrimes in the first quarter of 2023, a 22% increase from the previous year Of those crimes, 5,364 (up 19%) were cyber fraud, 279 identity theft (up 37%), 204 disclosure of secrets (up 15%), 44 threats or coercion (down 4%), 25 sexual crimes (up 108%), and the other 11 were cyberattacks (up 83%). | ||||
 Trends | ||||
|
LockBit: The destructive ransomware threatening cybersecurity LockBit is a type of ransomware that is gaining notoriety in the cybersecurity world due to its destructive capability and highly lucrative approach for cybercriminals. Today we delve into how it works and ways to minimize its impact.
Spain advances in building a cybersecurity network to protect computer systems Local and state authorities in Spain, in collaboration with private sector companies, are intensifying their efforts to strengthen cybersecurity and ensure the protection of computer systems across the country. A group of cybersecurity experts has discovered a malware campaign generating deceptive ads on Android devices to generate profit; it is estimated that this campaign affects more than 60,000 applications. Any server is exposed to brute-force attacks. Brute Fail is demonstrating it in real time This hacker, fed up with being attacked, wanted to show the world what the situation is like. Their servers were constantly receiving brute-force cyberattacks, so they set up a website called Brute.Fail where you can see in real time all attempts to enter their servers using various usernames and passwords. Is ChatGPT really capable of creating cyberattacks? Even though ChatGPT is not intended for criminal purposes, cybercriminals have discovered another open door in it for creating fraudulent emails or text messages to deceive unsuspecting people. How to turn ChatGPT's AI into an ally against cybercrime The network and cybersecurity company Sophos has published the report “The application of linguistic processing to cyber defenses,” on how the cybersecurity sector can leverage GPT-3, the language model used by ChatGPT, as a co-pilot to help defeat cyberattackers.
| ||||
 Webinars | ||||
|
ISecWebinar: API Security Testing now! before it's too late Through this webinar, a team of analysts from Internet Security Auditors will explain simply and practically how to perform a complete security audit of an API platform, as auditing an API environment (Application Programming Interface) requires applying an appropriate methodology to achieve the desired results.
Link to access the video: |
ISecWebinar: Journey to the new versions to learn about the present and future of the ISO 27001 standard New versions of the ISO/IEC 27001 and ISO/IEC 27002 standards were published last year, 2022, but what new features do they add? What do these changes mean for companies? When must compliance with the new requirements begin? These and other questions are what we address in this webinar.
Link to access the video: |
|||
|
Internet Security Auditors C. Santander, 101. Building A-2. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Transversal 22 # 98-82 Ed. Porta 100 Of. 1003. 110221 Bogotá (Colombia) | Tel.: +57 601 638 68 88 | ||||
    
| ||||
This message has been sent pursuant to your authorization for the communication of commercial information by Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, erasure, restriction, objection and portability provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC” by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or by email to the following address: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com | ||||
Newsletter