November Newsletter

Highlights

What's New

Update PCI DSS to Version 4.0

On March 31, 2022, the PCI Security Standards Council (PCI SSC), the council responsible for overseeing the Payment Card Industry Data Security Standard (PCI DSS), published version 4.0, which will replace version 3.2.1 and whose main objectives are to address emerging threats and technologies, as well as enable innovative methods to combat new threats.      

At Internet Security Auditors, we have a team of experts in PCI DSS who have been disseminating the updates of version 4.0 for two years through blog posts and webinars available on our platforms [...]

Update Your ISO 27001 ISMS to the New 2022 Version

The latest version of ISO/IEC 27001, published on October 25, 2022, gives organizations a 3-year transition period to adapt and certify their systems to the new standard.     

At Internet Security Auditors, we have a team of experts in the Implementation and Auditing of ISO/IEC 27001:2022 Information Security Management Systems (ISMS), and we will help and guide you through the entire update process to the new version.

ISecAuditors Participates in a Talk with Students from the UPC Official Master's Degree in Cybersecurity

Last September, Carles Sans from the consulting department was with the students of the Official Master's Degree in Cybersecurity at the Polytechnic University of Catalonia (UPC), giving a talk on practical cases of application and non-compliance with the GDPR in the Applications Security course. 

Event Report: ISACA DAY Bogotá Chapter 2023

Last July 12, ISACA DAY was held, an event organized by the ISACA Bogotá chapter, in which several talks with international speakers, industry companies, and several sponsors were presented, which had as its main topic "Understanding Cyber Risk". The congress of specialists in governance management, auditing, control, assurance, security, and risks at the level of information technologies. 

Hunting in a Vulnerable Amazon Environment

Every cloud provider has its own particularities, so it is necessary to have a good understanding of the configured environment and the services used. Misconfigurations, services that should not be exposed, deficient validations, privilege escalation, are some of the common problems of environments configured on Amazon.     

In this ISecWebinar, our analysts explain to us in a simple and practical way how to perform a security audit on an environment in Amazon both in black box and gray box. 

Risk Analysis in PCI DSS v.4.0

The new version of the PCI DSS 4.0 standard has arrived and brings with it changes in the implementation of risk analysis and in the way organizations are assessed for compliance.     

Do you want to know more about these changes and how they impact the risk methodology? Our experts analyze in detail in this ISecWebinar the differences with respect to the previous version and what the standard will assess in its new version. 

Version 4.0 of PCI DSS. Analyzing Requirements 1 through 9.

In March 2022, the new version of the PCI DSS standard came to light, version 4.0 which will definitively replace 3.2.1 on March 31, 2024. Thus, the PCI DSS standard, in its version 4.0, has undergone a series of significant changes in the key requirements. If you want to know the changes and how they affect your organization, check out our articles.

How to Manage PCI DSS v4.0 Requirement 12.3.1 Using a FRA

Since the publication of v4.0 of the PCI DSS standard, the new requirements included and detailed in the change summary document from v3.2.1 to v4.0, have been divided into two groups; on one hand, those that are mandatory from the moment the environment aligns with v4.0 and, on the other hand, those that are recommended, best practices or, as the standard describes in its Spanish version, "recommended practices" that will become mandatory on March 31, 2025.      

This would be the case of requirement 12.3.1 that we are going to analyze and for that our colleague Alberto Villar Arévalo will try to answer in this article, various fundamental questions to understand the context and content of this specific requirement.

Navigating the Labyrinth of Cyber Risks: How Their Management Drives Business Success

Cyber threats evolve, and if we do not address them proactively we can suffer devastating attacks that endanger the integrity of the organization.      

Don't miss this new post where our colleague Albert Moner talks to us about how risk management can help drive business success.  

The Dangers of “Default”

Today, the different systems, applications, frameworks, etc… come with a host of configurations that sometimes are not even reviewed. It is usually relatively easy to get a platform up and running, but not so much to do it securely both for the ecosystem itself and for the user.     

In this article, our colleague Guim Auró explains to us the dangers that different types of "default" can cause in any company.

Cybersecurity is Not How It Reads or Looks, But How It Is Assimilated and Acted Upon

Many companies when they are told about a cybersecurity plan interpret it as an additional cost that is difficult to amortize and justify. And it is understood. There are several factors involved that could back it up: the lack of knowledge in Computer Security, the lack of foresight, the lack of user training, the lack of trusted specialized advisors and above all assuming risks unnecessarily or worse, not knowing the real risks and threats of the organization. […]

Exploring National Cybersecurity in Spain in the OT World

Spain has forged a solid path toward the protection of its critical infrastructures and the safeguarding of its digital and industrial environment through a series of comprehensive strategies and regulatory frameworks. This article, our colleague Marina Talló Palomar delves into the complex network that makes up national cybersecurity in Spain, exploring four fundamental pillars: the National Cybersecurity Strategy, the Critical Infrastructure Protection Law, the National Security Framework, and the NIS Directive.

CISO: The Master Key for Business Cybersecurity

Discover how the CISO has become the key to business cybersecurity. In our article, we tell you about the importance of this position in the business environment and how it gains greater relevance day by day. It doesn't matter if you have a small, medium or large company, the CISO is essential to protect your digital assets! Don't miss this interesting article from our colleague Albert Moner.

Most Read

Now that GPT-4 is capable of analyzing images, hackers have a new way to attack it: prompt injection attacks

New AI cyberattack: prompt injection. The same capability that allows GPT-4 to interpret images also makes this model vulnerable to prompt injection attacks. What does this class of attacks consist of?     
 

Microsoft accidentally exposes sensitive employee data by sharing an open source project

Microsoft AI researchers accidentally exposed dozens of terabytes of sensitive data, including private keys and passwords, while publishing an open source training data “storage bucket” on GitHub.     
 

If you use your mobile NFC to pay, these are the risks

Whenever we use any wireless technology there is a risk of suffering attacks. Therefore, when you decide to use your mobile NFC, you must be aware of what the problems can be and thus try to maintain maximum security.     
 

When the real malware is that window that says it has detected malware (false) on your PC

Scareware, malware whose malicious action is based on convincing you of the presence of other types of malware in order to deceive the user to visit insecure websites or to pay for fake security software.     
 

Events

Upcoming courses

This message has been sent pursuant to your authorization for the communication of commercial information from Internet Security Auditors. You can view our Data Privacy Policy here. You have the option to exercise the rights of access, rectification, erasure, restriction, objection, and portability provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email to the following address: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com     

This email is sent according to your previous authorization for sending commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com