Newsletter

April 2021 Newsletter

Internet Security Auditors News Bulletin
April 2021

twitter facebook linkedin Instagram youtube RSS
 

News

ISecAuditors Participates in the I STIC Conference – Colombia Chapter

The National Cryptologic Center (CCN) and INCIBE organized the I STIC Conference – Colombia Chapter for the first time.

This event, held on March 16 and 17 under the slogan "Cybersecurity: the commitment that unites us", aimed to promote collaboration and information exchange in cybersecurity at an international level.

Speeches, Events and Interviews

Carlos Seisdedos, head of the Cyber Intelligence Department, had the opportunity to participate again on the Onda Cero radio station, on the La Brújula program, talking about the implications of the ransomware attack and the ransom demanded from the SEPE (State Public Employment Service).

Speeches, Events and Interviews

Our head of the Cyber Intelligence area, Carlos Seisdedos, collaborated as a speaker at the II edition of #INTELQUORUM2021, a Conference dedicated to Intelligence and Global Security. Carlos spoke about Open Source Intelligence as a valuable element for the organization.

Highlights

PCI SSC Publishes Version 3.1 of the PCI PIN Standard

On March 12, the PCI SSC published version 3.1 of the PCI PIN security standard. This publication, categorized as a minor revision, adds a series of clarifications and updates to the standard based on the feedback received. The objective of this article is to comment on the main changes introduced.

Along with the publication of the new version of the standard, a post was published on the PCI SSC blog with a couple of questions answered by Emma Sutcliffe, Standards Officer at the PCI SSC, as well as a document summarizing the changes.

Wi-Fi DoS: CTS Frame Attack

CTS Frame Attack is a denial-of-service attack that can leave a wireless network inoperable for a long period of time. To understand how the attack works and what a CTS packet is, we must delve into the basics of Networking.

OSI Model

The OSI model (Open Systems Interconnection Model) is a conceptual framework used to describe the functions of a network system. These functions are characterized by a universal set of rules and requirements to support interoperability between different products and software.

CISO-as-a-Service (CISOaaS): An Option to Comply with Royal Decree 43/2021

If anything has shown during the Covid-19 pandemic is that states must rethink what is and is not strategic for the functioning of a country and entities such as the EU. No one thought about how important that small company specializing in the manufacturing of ICU ventilators could become, but they did think about how important that large hospital that used them was. No one thought about that small pharmaceutical company that could be able to manufacture a medicine or a vaccine in case of need, or that industrial company that was able to manufacture that small but extremely important part for medical equipment. This has happened in many cases. The productive fabric is essential in crisis situations, and many of the companies that make up that fabric were not valued as they deserved in terms of their criticality, but, as far as we are concerned here, they were not observed in terms of cybersecurity and the implication that results from that responsibility.

IIN (BIN) Expansion from 6 to 8 Digits: What Implications Does It Have?

This article deals with the expansion of the IIN value, and the implications this has for compliance with the PCI DSS standard. Before getting into the main topic, it is necessary to make a brief introduction to explain the parts that make up the Primary Account Number (PAN).

Said number is present on the front side of all payment cards, and according to what is established by the ISO/IEC 7812:2017 standard published by the International Organization for Standardization ISO/IEC (2017)…

Differences Between ISO22301:2012 and ISO22301:2019

The International Organization for Standardization (ISO) is an entity that was born in London in 1946, independent and non-governmental. It quickly became a worldwide benchmark in knowledge sharing, the development of standards that support innovation, and providing solutions for global challenges, with a total of 165 member countries at the time of writing these lines, in December 2020.

Open Source Intelligence (OSINT) in the Fight Against COVID-19

All information coming from open sources obtained during our investigation, or data collection for a client, whether through the use of our own collection systems or a third party, must be analyzed.

Therefore, it is necessary and convenient to apply different analysis techniques with the aim of creating an intelligence product that, as a result of said evaluation, integration, analysis, and interpretation, can be useful to our client.

Analysis of the Changes Introduced by PCI SSLCS v1.1

On February 18, 2021, the PCI SSC published in the repository of its website (https://www.pcisecuritystandards.org/document_library) the update of four documents to their 1.1 versions.

Said documents belong to the Secure Software Framework (PCI SSF - PCI Software Security Framework) and, specifically, the PCI Secure Software Lifecycle Standard (PCI SSLCS).

Most Read

OpenSSL Publishes Patches for Two High-Severity Security Vulnerabilities

OpenSSL has published a patch for two serious security flaws in its software that could be exploited to perform denial-of-service (DoS) attacks and bypass certificate verification.

Cybersecurity Company Qualys Is the Latest Victim of Accellion Hacks

Currently, no one is safe from being hacked, even cybersecurity companies can get us, and to show, a button: the cybersecurity firm Qualys has confirmed that its Accellion FTA server was hacked last December 2020, the company states that this server was deployed in its DMZ, segregated from its internal network and the Qualys product environment was not compromised.

Barcelona Metropolitan Area: Another Ransomware Attack

The AMB suspends its digital services after suffering a computer attack that is suspected to be a #Ransomware like the recent one from the SEPE.

PHP Source Code Repository Hacked: Strong Alarm for the Language Used by Almost 80% of All Websites

PHP source code repository hacked: the most used server-side language on the entire web and which is estimated to be in use on 80% of all websites.

Events

16/04 of 2021: Detcamp (Virtual Event, Spain).

12-13/05 of 2021: Tapas & Hacks (Virtual Event, Spain).

Upcoming Courses

26/04 ISO 27001 Implementation
(Spain)
10/05 Official CSSLP Course
(Spain)
03/05 Official CSSLP Course
(Colombia)
10/05 PCIP™ Preparatory Course
(Spain)
05/05 PCIP™ Preparatory Course
(Colombia)
10/05 OSINT Techniques Course
(Spain)
 
Internet Security Auditors
C. Santander, 101. Edificio A, 2º. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18
C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47
Carrera 13 # 90-17. 110221 Bogotá (Colombia) | Tel.: +57 (1) 638 68 88

This message has been sent pursuant to your authorization to receive commercial communications from Internet Security Auditors. You can view our Data Privacy Policy here. You have the right to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by writing a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email at the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com

This email is sent pursuant to your previous authorization to receive commercial communications from Internet Security Auditors. You can read our Data Privacy Policy here. You have the right at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com

← Back to Newsletters