 | ||||
 What's New |
 Highlights |
|||
|
PCI Secure Software Standard receives a new web software module in its 1.2 version Last December, the PCI Council (PCI Security Standards Council, PCI SSC) published version 1.2 of the PCI Secure Software Standard. The PCI secure software standard is one of the two standards that make up the PCI software security framework (SSF). This standard and its security requirements help ensure that payment software is designed, developed, and maintained in a way that protects transactions and payment data, minimizes vulnerabilities, and defends against potential attacks. The PCI Council (PCI SSC) presents its Online Knowledge Center Nicknamed the “Global Content Library,” as of last January, a PCI SSC Online Knowledge Center is available, housing hours of video content from its events, covering topics on industry trends, best practices strategies, and solutions for anyone within the payments ecosystem. With the goal of learning directly from the Council's executives and industry experts.
More information at the following link: We now have the results of the 2023 Special Interest Group elections Once the annual Special Interest Group (SIG) election process was completed, the PCI Council (PCI SSC) confirmed the winning SIG topic for this year 2023. The Council's participating organizations voted to finally select “Scope and Segmentation for Modern Network Architectures.”
More information at the following link: |
 Incident Analysis |
|||
|
Data of 9 million AT&T customers hacked This March, a security breach occurred at one of the providers that AT&T uses for its marketing. Unauthorized access to information from certain accounts was detected, including information such as monthly payment amounts, overdue payments, plan names and rates, monthly charges and/or the number of minutes used. The material did not include any confidential personal information, such as credit card details, Social Security numbers, account passwords, or any other information of that type. The affected customers have been notified. According to the company's statement, none of AT&T's direct systems were affected by the event.. | ||||
|
The cyberattack on Clínic one week later: an international group accused, 4 terabytes of data stolen, and a paralyzed hospital Last Sunday, March 5, at 11:17 a.m., alarms went off at the Hospital Clínic in Barcelona. At approximately 11:30 a.m., security forces were already aware of and working on the matter, which was none other than a ransomware cyberattack on the public facility. | ||||
|
Meta fined €413 million in the EU for breaching GDPR rules The Irish Data Protection Commission (DPC) has announced that it will fine Meta a total of $413 million for breaching the European GDPR (General Data Protection Regulation) related to the company's handling of personal information on Facebook and Instagram. | ||||
 Trends | ||||
|
Prevention and response capability against cyberattacks are the tools available to both Local Governments and other Administrations when ensuring the provision of safe and reliable public services for citizens. This was stated by the Secretary General of FEMP, Carlos Daniel Casares, and the Secretary of State and Director of the National Intelligence Center, CNI, Esperanza Casteleiro, in their opening speeches at the Cybersecurity in Local Entities Day, organized by both organizations. Within the framework of this meeting, the “Guide for Crisis Management for Cyber Incidents in Local Entities” was presented. The National Cryptologic Center has launched an initiative to consolidate the deployment of the National Network of Cybersecurity Operations Centers. Eleven public agencies are participating in this new pilot project to promote the exchange of information related to incidents. This initiative aims to improve detection and response capabilities within the National SOC Network, integrating new tools into the platform for incorporating information on security events and incidents, as well as vulnerabilities obtained from SIEM and vulnerability management tools. ChatGPT: cybercriminals can use it as part of their scams ChatGPT is an Artificial Intelligence system capable of generating texts that are barely distinguishable from those written by a person. Therefore, cybercriminals are applying this technology to spear-phishing attacks, email scams, or communications targeting specific people, organizations, or companies. Writing personalized messages used to require a great deal of effort from cybercriminals, but with ChatGPT, that will no longer be the case: it allows for the creation of persuasive, personalized, and mass phishing emails. In this way, successful attacks based on this Artificial Intelligence model are expected to grow. Google's Cybersecurity Center in Malaga will open in 2023 Google announced in 2021 the installation of a cybersecurity center of excellence in the Malaga Military Government building. To date, the multinational company continues to make progress on the adaptation work of the building located on Paseo de la Farola, with its opening expected in the first months of 2023. The European Parliament bans the use of TikTok on official mobile phones to prevent cyberattacks Other institutions, such as the European Commission and the EU Council, had already resorted to this preventive measure at the end of February. The reason that prompted Brussels to take such a radical initiative is the need to strengthen cybersecurity, as explained by spokesperson Sonya Gospodinova. “The measure is in line with our strict internal cybersecurity policies for the use of mobile devices in work-related communications,” the European Commission spokesperson highlighted. The latest scams use audio deepfakes that imitate the voices of loved ones to request urgent money It is becoming a recurring topic to talk about the dangers hidden behind AI-generated audio deepfakes that are capable of imitating the voices of loved ones to commit cybercrimes. One example is that of Ruth Card (73 years old), who received a call supposedly from her grandson Brandon, who told her he was in jail without a phone or card. "I need money for bail," said a voice that sounded exactly like her relative's. | ||||
 Webinars | ||||
|
ISecWebinar: Early proactivity in the business environment through a Cyber Intelligence SOC During the webinar, we addressed how to use Security Operations Center (SOC) tools and techniques to anticipate and prevent security problems in a business environment. We also showed how to identify different points where a Cyber Intelligence SOC can help counteract the techniques used by cybercriminals against our organizations by monitoring and analyzing activity on a business network, detecting patterns and trends that indicate possible threats, and thus being able to take proactive measures to mitigate those risks before they cause harm.
Link to access the video: |
ISecWebinar: A journey through the new versions to explore the present and future of the ISO 27001 standard Last year, in 2022, new versions of the ISO/IEC 27001 and ISO/IEC 27002 standards were published, but what new features do they add? What do these changes mean for companies? When must compliance with the new requirements begin? These and other questions are what we address in this webinar.
Link to access the video: |
|||
|
Internet Security Auditors C. Santander, 101. Building A-2. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Transversal 22 # 98-82 Ed. Porta 100 Of. 1003. 110221 Bogotá (Colombia) | Tel.: +57 601 638 68 88 | ||||
    
| ||||
This message has been sent pursuant to your authorization to receive commercial information from Internet Security Auditors. You can view our Data Privacy Policy here. You have the right to access, rectify, delete, restrict, object to, and port your data as provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by writing to Internet Security Auditors, Calle Santander, 101. Building A-2. 08030 Barcelona (Spain), or by email at the following address: legal@isecauditors.com, attaching a copy of your ID card or equivalent proof of identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com | ||||
Newsletter