 | ||||
 What's New |
 Highlights |
|||
|
Watch Now: A Discussion on PCI DSS v4.0 and the New INFI Documents Watch a live LinkedIn event where Emma Sutcliffe, Senior VP of Standards, Lauren Holloway, Director of Data Security Standards, and Lindsay Goodspeed, Senior Communications Manager, answer stakeholder questions about PCI DSS v4.0 and discuss the latest updates from the PCI Security Standards Council. New Publication: Updated PCI Card Production Technical FAQs for Version 3 Two new technical FAQs have been added to the PCI Card Production and Provisioning Technical Security Requirements for use with version 3. They are now available in the PCI SSC Document Library.
These Technical FAQs are an integral part of the PCI Card Production and Provisioning Security Requirements and should be fully considered during PCI Card Production and Provisioning assessment processes. More information at the following link: New Publication: New PCI PTS PIN Technical FAQs for Version 3 The Technical FAQs in the PCI PTS PIN Technical Security Requirements for use with version 3 have been updated. They are now available in the PCI SSC Document Library.
These Technical FAQs are an integral part of the PCI PTS PIN Security Requirements and should be fully considered during assessments against the PCI PTS PIN Security Requirements. More information at the following link: |
Exploring National Cybersecurity in Spain in the OT World In a world characterized by digital interconnection and a growing dependence on technology, cybersecurity has emerged as an essential concern for nations around the globe. PCI DSS Version 4.0. Analyzing Requirements 1 and 2 The new version of the PCI DSS standard, version 4.0, was released in March 2022 and will definitively replace version 3.2.1 on March 31, 2024. PCI DSS version 4.0 maintains the structure of the 12 requirements but brings numerous changes that we will analyze in this and other blog posts. The main updates (risk-based approach, customization of subrequirements, etc.) were analyzed in another blog post (PCI DSS Updates in Version 4.0), so in this series of 6 articles we will focus on the changes introduced by each of the requirements, emphasizing the main changes in content in the subrequirements and omitting changes in numbering or the merging/separation of requirements. Strategic Actions for Challenging Times: Exploring the National Security Framework Currently, technological progress is leading to the evolution of threats as well as the creation of new attack vectors, thus affecting the cybersecurity of organizations. Likewise, as technology increases in society, the challenge of managing its security is greater and greater. To adapt to this new reality, it is necessary to develop new response mechanisms aligned with applicable European and national regulations. Event Report: ISACA DAY Bogotá Chapter 2023 On July 12, ISACA DAY was held, an event organized by the ISACA Bogotá Chapter, in which several talks with international speakers, industry companies, and several sponsors were presented, which had as its main topic "Understanding Cyber Risk". The congress of specialists in governance management, audit, control, assurance, security, and risks at the level of information technologies. In an increasingly volatile and uncertain world, companies constantly face a wide range of risks that could jeopardize their survival. Thus, business continuity risks are events or circumstances that can interrupt or negatively affect operations and an organization's ability to continuously provide products or services. These risks can arise both internally and externally. It is important to identify and manage them properly to ensure the resilience and continuity of the organization. The most common risks can be grouped into the following fields: natural disasters, threats of industrial origin, unintentional errors and failures, and intentional attacks. Important PCI SSC Notice About Recent Scams Using Your Name Phishing is a type of social engineering attack that seeks to steal user data, such as login credentials and credit card numbers. It is one of the most common attacks we can find today. |
 Incident Analysis |
||
|
The Internet Archive Was Down. The Main Suspicion: Someone Was Training an AI The Internet Archive is the great library of the web of networks, although that sometimes leads it to have problems. Thanks to this project we can, for example, take a trip to the past of the web, enjoy audio and video content, reminisce about the use of scientific calculators, or even play some old retro hits thanks to emulation. This type of service is one of the jewels of the internet, but these days something unheard of happened: The Internet Archive was down. What happened? | ||||
|
His Identity Was Stolen to Open a BBVA Account and Defraud 200,000 Euros in His Name: He Found Out Through a Letter from the Tax Agency Despite the fact that it seems we already have internalized a culture of cybersecurity, the truth is that there are many cases that continue to occur in our country. The latest that has stood out the most, due to the amount of money, has occurred in Seville where a 39-year-old man has reported a case of identity theft to open a bank account without his permission in his name. | ||||
|
Pro-Russian Hackers Attack Japan's Largest Commercial Port and Disrupt Toyota Operations Pro-Russian hackers have attacked the port of Nagoya, the largest in Japan commercially and responsible for some of Toyota's exports and imports, leaving the loading and unloading operations of containers suspended, according to reported by the newspaper 'The Japan Times'. | ||||
|
Hackers Have Stolen the Entire Discord.io Database: The Service Has Been Forced to Close One day you entrust certain information to a service or application and the next some of your data is for sale on piracy forums. This type of scenario is increasingly common in the digitized world we live in, where the consequences of cybersecurity incidents can end up affecting anyone. | ||||
|
Japan Has a Cybersecurity Agency to Protect the Country. It Was Hacked and They Found Out Nine Months Later Japan's National Center of Incident Readiness and Strategy for Cybersecurity (NISC) is the body responsible for formulating and coordinating the nation's cybersecurity strategy. It is a key element for the Asian nation to keep its most important government and business infrastructures protected. | ||||
|
Seville City Council suspends all online services due to a cyberattack: “We will not negotiate” The Seville City Council has returned to paper records and in-person procedures after its computer systems were hijacked by a group of cybercriminals, according to the City Council. The hackers demanded up to one and a half million dollars (1,396,642 euros) from the municipal government, although it has stated that “under no circumstances will it negotiate with cybercriminals.” This is the second successful attack on the municipal website in three years. | ||||
|
300-euro fine for installing a digital peephole in the door of your apartment: the AEPD's opinion raises doubts once again It is becoming increasingly common to purchase electronic peepholes to enhance the security of our homes. However, there is a problem with these video surveillance devices: the Data Protection Law. The AEPD (Spanish Data Protection Agency) has been involved in related cases, and we recently learned of one involving this type of device. | ||||
 Trends | ||||
|
Be careful with what your child does on social media, parents can be fined up to 10,000 euros There are certain comments on the internet that cannot go unpunished. Cyberbullying is a fairly widespread practice, but fortunately, there are mechanisms to pursue it and stop it quickly. When the person writing that harassing message is an adult, the case is quite straightforward. But what happens when the person sending such messages about a minor is also a minor? Your answer when you pick up the phone could cost you: how the 'yes' scam works INCIBE warns of the risk that responding with a simple 'yes' when answering the phone can pose. May 2000, thousands of people received an email in their inbox with the subject ILOVEYOU. The body of the message invited recipients to check “an attached love letter,” and many people did not think twice before opening the attachment. What happened to the worm that infected millions of computers? QR codes became an important part of our lives during the COVID-19 lockdown: this technology was used to maintain distance and avoid multiple contacts, for example in bars and restaurants with menus. Like any technology that becomes popular, fraudulent uses eventually appeared, and the latest of them has made its appearance in the BiciMAD service in Madrid. Europe and the US sign an agreement to transfer data. They have fallen into the same mistakes again They say that third time's the charm, but it is not so clear. The European Commission has announced a new agreement for data transfer between the United States and Europe. A legal framework so that Europeans' personal data can be processed by American companies, provided they follow a series of mechanisms. But its fate may end up being the same as the previous two. The Bank of Spain is clear that the digital euro is the future. These are the advantages it defends Margarita Delgado, Deputy Governor of the Bank of Spain, has published her speech at the V European Summer Courses, in which she refers to the objectives that are set for the digital euro. We have been hearing about this great project for years, about its limitations and current status. The Digital Services Act (DSA) comes into effect: today a new era begins for Big Tech As of August 25, the Digital Services Act (DSA) comes into effect. The major European regulation that implements a whole series of new obligations for large technology companies. Changes that affect companies like Google, Meta, or TikTok, but also directly impact users. What is bluesnarfing and how even Bluetooth headphones can be a gold mine for hackers We are used to hearing about how a malicious attacker can enter our lives in different ways. From using identity theft (in English phishing) using a simple email to using systems like the WPS on our router. And by the way, although not as well known, there is bluesnarfing. | ||||
 Webinars | ||||
|
ISecWebinar: Risk analysis in PCI DSS 4.0 In this session we analyze the most relevant changes, how these changes impact the risk methodology and what the PCI DSS standard will evaluate in its new version 4.0
Link to access the video: |
ISecWebinar: API Security Testing before it is too late Through this webinar, a team of analysts from Internet Security Auditors will explain in a simple and practical way how to perform a complete security audit of an API platform, and to audit an API environment (Application Programming Interface), we must apply an appropriate methodology to achieve the desired results.
Link to access the video: |
|||
|
Internet Security Auditors C. Santander, 101. Building A-2. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Transversal 22 # 98-82 Ed. Porta 100 Office 1003. 110221 Bogotá (Colombia) | Tel.: +57 601 638 68 88 | ||||
     
| ||||
This message has been sent pursuant to your authorization for Internet Security Auditors to communicate commercial information to you. You can view our Data Privacy Policy here. You may exercise your rights of access, rectification, erasure, restriction, objection, and portability as provided for in “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by writing to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or by email at the following address: legal@isecauditors.com, attaching a copy of your ID card or equivalent document proving your identity to your request. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com | ||||
Newsletter