November 2020 Newsletter

Protection mechanisms against the main email threats (I)

Although decades have passed since their emergence, email is still a basic communication tool in the personal sphere, but above all, in the professional sphere. Over all these years, instant messaging apps, social networks, and countless corporate solutions have emerged, each more innovative than the last, and yet, classic email remains the premier formal communication medium within any company.

For this reason, cybercriminals see email as a very attractive window to try to “sneak” into an organization or to contact and deceive its employees, while remaining anonymous.

Protection mechanisms against the main email threats (II)

As we mentioned in the previous article in this series, currently one of the major email threats is phishing and spoofing (identity theft), whose identification can be particularly problematic.

There are mainly three mechanisms to mitigate this problem:

• SPF, the sender agreement. It allows an organization to define which servers or IPs can send email on its behalf.
• DKIM, which uses a signature to guarantee the authenticity of the email.
• DMARC, the combination of SPF and DKIM, which allows cross-validation and, based on the results, determines what to do with an email (delete it, quarantine it, or deliver it normally).

Anonymization and Pseudonymization of Personal Data

Since the introduction of the new GDPR, many techniques have been studied and used to comply with each of its articles and, in particular, to effectively protect the personal data processed by an organization, so that there is a balance between security and business. There are techniques and/or concepts that still cause considerable confusion.

These personal data protection techniques are known as Personal Data Anonymization and Pseudonymization. In our article, we explain the differences between these two techniques

The Importance of Encryption Suites in Communications in PCI DSS

Since 1995, SSL (Secure Sockets Layer) became one of the most widely used and widespread protocols worldwide for encrypting communications. The large number of vulnerabilities in SSL led to the development of Transport Layer Security 1.0 (TLSv1.0) in 1999, a protocol that aimed to improve communication security, although, as happened with SSL, vulnerabilities began to emerge in this protocol, mainly against BEAST attacks, so it had to evolve and be replaced by TLSv1.1 in 2006.

Most Read

FBI and CISA warn of an increase in vishing cases.

Although this alert was issued with corporate users in the United States in mind, it is important to remember that vishing can occur in any country. In fact, a similar threat that also uses telephone communication and impersonates a major company such as Microsoft has long had Spanish users among its targets. For this reason, it is advisable to stay alert and follow the advice to be able to detect this type of threat.

Facebook launches website about WhatsApp security

The company states that it will report more extensively on the vulnerabilities and security issues that emerge on the platform.

Ironically, Windows Defender Can Be Used to Download Malware and Other Files on Windows 10 Discovered

A group of security researchers from Cymulate discovered this new technique for evading security controls.

The new technique based on Windows Remote Desktop would allow malicious code to be executed using DLL side-loading, thereby avoiding security controls.

Bluetooth Flaw Allowing Connection to Mobile Devices Discovered, Still Unpatched

A vulnerability in the component that configures the authentication keys allowing two devices to pair via Bluetooth allows cyberattackers to access devices supporting this connectivity standard by manipulating those keys.

Events

Training

OSINT Techniques Remote   CEH Remote

CSSLP Remote   ISO 27001 L.A. CLL format (Spain)

This message has been sent pursuant to your authorization for the communication of commercial information from Internet Security Auditors. You can view our Data Privacy Policy here. You have the option to exercise the rights of access, rectification, erasure, restriction, objection, and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email at the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com

This email is sent pursuant to your previous authorization for sending commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the option at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com