Newsletter

January/February 2019 Newsletter

	Newsletter January-February 2019

What's New

Vicente Aguilera participated, once again as a speaker and jury member, in the #CyberCamp hackathon

Another edition of CyberCamp, the major annual cybersecurity event organized by Spain's National Cybersecurity Institute (INCIBE), was held this year, and Vicente Aguilera also served as a speaker and jury member in the hackathon.

Vicente Aguilera participates in the fourth Open Class organized by the Cybersecurity Campus

On Thursday, 31/01/2019, Vicente Aguilera participated as a special guest in the OpenClass organized by the International Cybersecurity Campus.

In this OpenClass, titled "Everything You Wanted to Know About Cyber Intelligence and Didn't Know Who to Ask", Vicente was interviewed by Juanjo Salvador (Academic Coordinator of the International Cybersecurity Campus), with whom he had a conversation in which cyber intelligence concepts were clarified and the need to have specialists who allow the carrying out of research processes in cyberspace was addressed due to the growing demand for these services in very diverse sectors.

Highlights

Security Requirements in PSD2

When we talk about PSD2 (Directive (EU) 2015/2366), we all think of the requirement for banks to provide APIs so that fintechs can access their customers' data without having to use screen scraping techniques (a technique that is expressly prohibited), but the Directive goes further.

In this post, we are going to focus on the articles that include security requirements for payment service providers (PSPs), which, although there are few articles, make references to delegated regulations and guidelines set by the European Banking Authority (EBA).

Legitimate Interest, the Catch-All of the GDPR

Since the General Data Protection Regulation (hereinafter GDPR) came into force, and even more so since it became mandatory on 25/06/2018, there are many doubts, on the part of companies and organizations, about using the so-called "legitimate interest" as a legal basis for their processing activities.

Although at first glance it may seem like a new topic, the truth is that it is not a novelty of the GDPR, but rather that this concept was already present in the previous Directive 95/46.

Data Minimization Principle

In today's era, in which practically everyone worldwide is connected through the internet, social networks, smartphones, etc. Our personal data, our tastes, our most intimate information, has become one of the biggest businesses and moves the most money in the world. [...]

This is why, with the arrival of the new European Data Protection Regulation, one of the biggest and most striking novelties is the obligation of the data controller to minimize the collected data. Broadly speaking, this obligation attempts to preserve and protect the personal data of natural persons, that is, by using the "need to know" policy, preventing third parties from improperly taking possession of data that is not necessary for the provision of the service they offer.

GDPR Novelties Regarding the LOPD

In our daily lives, and especially since the inclusion of the IT world in our society as an indispensable tool in our lives, we perform a great number of actions that impact our privacy. When we are walking we can be recorded by traffic cameras, when we enter any store there are also security cameras, when we browse the Internet we leave a huge footprint about our preferences, tastes, personal data, places we visit, moreover, unintentionally, we can appear in photographs uploaded to the Internet by third parties on their social networks.

Many times, we are not aware of the amount of data we share without stopping to think about who will process this data, how it will be used, if it is properly stored, and what is more important, if once shared we can recover it, delete it and / or modify it.

Banks, Fintech... How Far Does PSD2 Go?

For some months now we have all been hearing about Directive 2015/2366, better known as PSD2 (Payment Services Directive 2). Much has been said about this directive; about the obligation of banks to provide ways to access their services for retailers (probably in the form of APIs). However, this directive has a much broader scope of application and reach.

The European Union has published several regulations related to payment security. For example, in 2007, the European Union created the first Payment Services Directive, which set the precedent to later generate the SEPA Regulation, which defined the Single Euro Payments Area (or in Spanish, the Single Euro Payments Zone).

Online Privacy Policies After the GDPR

Recently the Spanish Data Protection Agency (AEPD) has published a press release and a report regarding the adaptation of online privacy policies to the General Data Protection Regulation (GDPR).

In this work, during the first months of the GDPR's life, that is, since May 25, 2018, which is when this regulation is mandatory, the AEPD has analyzed the privacy policies of several companies that provide their services from the Internet, and has collected in a press release the most common incidents and errors, offering the appropriate recommendations to mitigate them and, thus, comply with the GDPR.

Cybersecurity experts are urgently needed: what to study to become one?

The threat grows as companies and institutions around the world face another equally pressing danger, which is the shortage of expert cybersecurity professionals.

A field in which self-teaching has traditionally predominated, but which is beginning to make its way into official training at universities and other educational centers.

Thousands of Chromecast and Smart TVs Hacked to Warn of Their Vulnerability

New hack that has affected thousands of Chromecast and Smart TV devices around the globe. Hackers claim that the reason for this action is to warn about how vulnerable these devices are.

Google has stated that this is not a security flaw in its devices, and that this hack can be avoided by entering the router settings and disabling the UPnP option.

Critical RCE Flaw in Linux APT Allows Remote Attackers to Hack Systems

A package management system created by the Debian project that facilitates software installation and is widely used by GNU/Linux distributions derived from it, such as Ubuntu and others. The exploitation could have been mitigated if the administrator were strictly using HTTPS to download software and communicate securely.

Record-Breaking Security Breach Exposes 773 Million Email Accounts and 23 Million Passwords

Troy Hunt, administrator of Have I Been Pwned, has revealed a security breach affecting 772,904,991 unique email addresses, in addition to more than 21 million unique passwords. There is no confirmation that all this data comes from a single service breach, but rather that it appears to be a breach that accumulates 2,000 databases containing hacked passwords.

Events

28-30/03 2019: RootedCom (Madrid, Spain).

24/04 2019: MundoHacker Day (Madrid, Spain)

26/02 2019: Webinar - Implementation and Challenges of ISMS and CSMS (Bogotá, Colombia)

Training

		ISO 27001 Implementation Barcelona

ISO 27001 L.A.
Barcelona

		CCSP Madrid

ISO 27001 A.I.
Bogotá

		CISSP Barcelona

Crisis Management
Bogotá

Internet Security Auditors C. Santander, 101. Edificio A, 2º. E-08030 Barcelona (Spain) \| Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) \| Tel.: +34 91 763 40 47 Calle 90 # 12-28. 110221 Bogotá (Colombia) \| Tel.: +57 (1) 638 68 88
This message has been sent pursuant to your authorization to receive commercial communications from Internet Security Auditors. You can view our Data Privacy Policy here. You have the right to access, rectify, delete, restrict processing, object to, and port your data as provided in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by writing to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email at the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com This email is sent according to your previous authorization to receive commercial communications from Internet Security Auditors. You can read our Data Privacy Policy here. You have the right at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com

← Back to Newsletters