ISECauditors Newsletter
  June 2018

Follow us on Twitter Follow us on Facebook Follow us on LinkedIn Follow us on Google + Visit our YouTube channel Stay up to date with our news
 

What's New

Internet Security Auditors member of the Global PCI SSC Executive Advisory Group

A few months ago, the PCI SSC launched a new initiative to assemble a global group of experts from companies, opening applications to all companies worldwide that participate as advisors, numbering over 450. Internet Security Auditors submitted the application represented by its Director of Consulting and Partner, Miguel A. Domínguez.

After two months of reviewing applications, which had to meet extensive company- and representative-level requirements, the PCI SSC confirmed that ours had been selected to join an exclusive group of 20 companies worldwide.


Vicente Aguilera participates in a book on IoT security.

In May, a book on IoT security in hospital environments was published, prepared for APISA (Andalusian Association of Health Information Professionals). Vicente Aguilera, as head of the Spanish chapter of OWASP, was invited to write the prologue of this interesting and necessary book, focusing on security in the use and deployment of IoT devices, where the authors share their extensive experience in this field.


DEF CON China featured the Internet Security Auditors RED TEAM.

Gonzalo Sánchez Delgado and Fabián Cuchietti, leader and member of the Internet Security Auditors RED TEAM, were selected by the DEF CON China committee to deliver their presentation "Spreading Malware With Google (Nice Quilombo)".


First Ibero-American company to obtain QSA(P2PE) and 3DS Assessor certifications.

Internet Security Auditors has become the first Ibero-American company to obtain PCI SSC accreditation as a P2PE (Point-to-Point Encryption) and 3DS Assessor in Europe and Latin America and the Caribbean.

This is a new milestone for the company, which after its QSA and ASV approvals in 2007, PA-QSA in 2010, now achieves two new certifications, which will allow the company to carry out certification processes for companies that want to certify their solutions and services under the two PCI SSC standards, P2PE and 3DS.

 

Highlights

Questions and Answers about the new CISSP CAT (Computerized Adaptive Testing) exam type

In recent months, many concerns have been raised about the change in the exam model adopted by (ISC)2, which is becoming a trend among many organizations for administering CISSP exams. This new exam model, in which the examinee answers questions and, based on their answers, the questions are adapted and defined, aims to reduce the time and number of questions and, it is intended, to more effectively assess the examinee's knowledge in the subjects they are examined on.

TLS 1.3 has now been formally approved as a standard by the IETF.

After many years of revisions and 28 drafts, the TLS version 1.3 (Transport Layer Security) protocol has been officially approved as a standard by the Internet Engineering Task Force (IETF).


Do you have a travel agency? Attention! PCI DSS compliance is not what you've been told.

PCI DSS is a standard that we have been reporting on since its origins -in 2004 by VISA and in 2006 by the PCI SSC- due to the significance of non-compliance for the affected entities.

Something important to mention is that at these origins it is clear that neither the people who were supposed to meet at VISA and Mastercard around the "discussion table" ever thought of small businesses, small businesses that decide to start their journey in electronic payment or, for example, travel agencies with the characteristics of this sector.

The travel agency sector ecosystem can be said to have the shape, due to the overall size of this with the shape of a pyramid where the walls of this are curves that narrow significantly at the top of the pyramid. That is, the vast majority of agencies have fewer than 25 people. Although from the PCI DSS point of view the size of a company is not that important, it is relevant to keep in mind that these agencies will have a relatively simple technological complexity: they do not have data centers, they do not have a DMZ where they publish services, they do not develop software and, also in many cases, they do not sell on the Internet.


Mundo Hacker Day 2018 Chronicle

Another year we attend MundoHackerDay, this year it has focused mainly on the digital era we live in. At this great event, it has shown us that we are increasingly connected to a world in which there are a series of threats that affect both companies and users. These threats, among others, can be identity theft, data leaks, and even the famous cryptocurrency scams.

 
 
 
 
 
 

Most Read

Published revision of the cloud computing information supplement.

In April, a revision of the cloud computing guidelines information supplement was released. It aims to help understand the shared responsibility to protect data and mitigate potential risks.

Analysis of the new version of the PCI SSC cloud payment environment security guidelines document.

This article analyzes the guidelines set by the PCI SSC in cloud computing, a guide designed for organizations that want to include these cloud services in their PCI DSS compliance.

Migrating from SSL and Early TLS. PCI Security Standards Council Resource Guide

June 30, 2018 is the deadline for those who still use SSL or TLS 1.0 as a mechanism for communication protection. From this date, all systems in the cardholder environment must have migrated to recent versions of TLS.

ECB publishes a European framework to test the financial sector's resilience to cyberattacks

The ECB has published a framework to test the resilience of this sector to cyberattacks. In addition to being the first framework of its kind for the sector, it facilitates testing in supervised transnational entities.

Events

20/09 of 2018: VIII Cybersecurity Forum of the Cyber Security Center of ISMS Forum (Madrid, Spain).

23-24/10 of 2018: ENISE. Cybersecurity: A pillar of the digital transformation (Leó, Spain)

November 2018: TACS (Las Palmas de Gran Canaria, Spain)

Training

CCSP BGT Course   CCSP
Bogotá
ISO 27001 L.A. BCN Course   ISO 27001 L.A.
Barcelona
 
CISSP MAD Course   CISSP
Madrid
CISA MAD Course   CISA
Madrid
 
CHFI MAD Course   CHFI
Madrid
Virtual PCIP Course   PCIP
VIRTUAL
 

← Back to Newsletters