Kamil Drzymała

DORA Update 2/2 4. Final Report - Draft Regulatory Technical Standards specifying elements related to threat led penetration tests under Article 26(11) of Regulation (EU) 2022/2554. https://lnkd.in/e2PurWwz Next steps - The ESAs will submit the final draft RTS to the European Commission for adoption. Following its adoption in the form of a Commission Delegated Regulation, it will then be subject to scrutiny of the European Parliament and the Council before publication in the Official Journal of the European Union. The expected date of application of these technical standards is 17 January 2025. 5. Final Report - Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554. https://lnkd.in/eCwSjhWP Next steps - The Joint Guidelines will be translated into the official EU languages and published on the ESAs websites. The deadline for competent authorities to report whether they comply with the Guidelines will be two months after the publication of the translations. The Guidelines should apply from 17 January 2025. 6. Final Report on Joint Guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities under Regulation (EU) 2022/2554. https://lnkd.in/erKCM8tn Next steps - The Guidelines will be translated into the official languages of the European Union and published on the websites of the ESAs. The deadline for competent authorities to notify the respective ESA whether they comply or intend to comply with the Guidelines will be two months after the publication of the translated Guidelines. The Guidelines should apply from 17 January 2025. Important Note. Article 20 of DORA mandates the European Supervisory Authorities (ESAs) to develop through the Joint Committee and in consultation with the European Central Bank and European Union Agency for Cybersecurity: - Draft Regulatory Technical Standards (RTS) establishing the content of the reports for ICTrelated incidents and the notification for significant cyber threats, and the time limits for FEs to report these incidents to competent authorities. - Draft Implementing Technical Standards (ITS) establishing the standard forms, templates and procedures for FEs to report a major ICT-related incident or to notify a significant cyber threat. Article 20 of DORA further requires the ESAs to ensure that the requirements of the draft RTS and ITS are proportionate and consistent with the approach for incident reporting under Directive (EU) 2022/2555 (NIS 2).

2

Would you like to learn new tools that you will use in your daily investigative work? eForensics Magazine will meet your needs. https://lnkd.in/d7_mm2JV #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

1

New feature in TaskForce 2024.6! 🎉 With the new TaskForce update, you can combine various ports into a group in Express mode. Each group has different settings of target folder, file format, type of hash to calculate, and case report fields. #dfir #digitalforensics #forensicimaging

13

Great advice! I spent 10 years perfecting the application of the RAF Police's Security Risk Estimate (SRE) and even used the basis of my 8,000-word work-based research project for my Security Management MSc. In its simplest form, it was the application of the 5 Ts (Treat, Terminate, Tolerate, Transfer, Take the opportunity) to create viable risk responses (aka 'Many Ways To Skin A Cat). Take the opportunity being pertinent to 9.5.1.2.1: "The frequency of periodic POI device inspections and the type of inspections performed is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1. Purpose Entities are best placed to determine the frequency of POI device inspections based on the environment in which the device operates." Risk By analyzing the risk profile of each POI device, entities can allocate inspection resources more effectively. High-risk devices in public or high-traffic areas may require more frequent inspections, while low-risk devices in secure locations can be inspected less frequently, optimizing the use of resources. Alternative approach: - Incorporate the security inspections into a 'Optimize Operational Efficiency' initiative. Business justification: POI device operational maintenance inspections provide several business benefits, including enhanced security, improved operational efficiency, regulatory compliance, cost savings, and customer trust. Businesses can ensure that their POI devices are reliable and secure by implementing a robust inspection regime, resulting in an efficient and trustworthy operation in the long run. Businesses may be more accepting of a risk-based POI device operational maintenance inspection schedule (which incorporates the security requirements). Instantly, the business leaders can better appreciate the potential ROI. #pcidss #pcidssv4 #returnoninvestment #riskmanagement #physicalsecurity #assetmanagement

1

New article published: "EU Cybersecurity Legislation Overview – NIS-2 and DORA with Complementary #SOC2 and #GDPR Frameworks" Link here: https://lnkd.in/e5k45Qns Trade Commissioner Service | Service des délégués commerciaux EU Economy and Finance Belgian Cyber Security Coalition TotalEnergies Power & Gas Belgium #NIS-2 #fintech #criticalinfra #europe #cybersecurity #compliance #blockchain

2

We’re happy to share with you the newest issue of eForensics Magazine - OSINT in Forensics. https://lnkd.in/dYKKHyZ3 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

3

CVE-2024-3661 - CVSS 8.8 - EPSS We don't have an EPSS score for this CVE yet - By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Ref.1: https://lnkd.in/eXEskBcn Ref.2: https://lnkd.in/e_KwDMtH

1

⚠️ Deadline extended: 2024 SANS Survey: Are You Prepared for the EU Cybersecurity NIS2 Directive? Participate in the SANS Institute's survey by security experts Dean Parsons and Bojan Zdrnja to gain essential insights and prepare your organisation. 1️⃣ Take the survey → https://sans.org/u/1vt5 2️⃣ Complete the questions to share your insights 3️⃣ Submit your responses by 31 May ✍️ Be a part of the solution; participate in the survey now! #SANSTraining #Cybersecurity #NIS2 #Compliance

6

1 komentarz

⚠️ Deadline extended: 2024 SANS Survey: Are You Prepared for the EU Cybersecurity NIS2 Directive? Participate in the SANS Institute's survey by security experts Dean Parsons and Bojan Zdrnja to gain essential insights and prepare your organisation. 1️⃣ Take the survey → https://sans.org/u/1vt5 2️⃣ Complete the questions to share your insights 3️⃣ Submit your responses by 31 May ✍️ Be a part of the solution; participate in the survey now! #SANSTraining #Cybersecurity #NIS2 #Compliance

1

[FREE ACCESS ARTICLE] Digital Forensics in Docker Environments: Challenges and Solutions https://lnkd.in/dfJ3Sna8 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

3

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

In this publication you can read about anti-money laundering tools and techniques, forensic investigations and financial audits, etc. https://lnkd.in/dK_JD3Vh #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

2

👉 CISO2CISO.COM 👈 Cloud Cybersecurity Market Analysis by Enisa - European Union Agency for Cybersecurity EXECUTIVE SUMMARY The present European Union Agency for Cybersecurity (ENISA) report is an analysis of the cloud cybersecurity market, planned for in ENISA’s Work Programme 2022 (2) under activity O.7.1., ‘Market analysis on the main trends in the cybersecurity market on both the demand side and the supply side’. The selection of this segment for this year’s cybersecurity market analysis is the result of a poll carried out with the involvement of multiple stakeholders, both outside and within ENISA. #ENISA Read the complete post in 👉 CISO2CISO.COM 👈 or clicking here in the image below 👇. If you find this information useful and valuable share it with your professionals contacts & networks and leave your comments. Thanks The CISO2CISO Advisors Team. #CISO2CISO #Cybersecurity #CISO https://lnkd.in/dB7rbbBK

2

🔐 Flashpoint and Onapsis' joint analysis exposes the sophisticated methods employed by cybercriminal and state-sponsored groups, emphasizing their increased aggression in exploiting SAP vulnerabilities for financial gain, espionage, and sabotage: 🔸 Increased aggression from cybercriminal groups and state actors in exploiting SAP vulnerabilities. 🔸 Trends in ransomware attacks specifically targeting SAP data and applications, outlining how these threats have evolved to become more dangerous. 🔸 Vital recommendations on safeguarding your SAP environments against these heightened threats. 📥 Download the full report now to equip yourself with the knowledge to mitigate these threats and secure your critical business applications: https://lnkd.in/dHW2xkiK #ThreatIntelligence #SAPSecurity

29

The key differences between the NIST Cybersecurity Framework (CSF) version 1.1 and version 2.0 are: Expanded Scope: CSF 2.0 has dropped the "critical infrastructure" terminology, broadening its applicability to all organizations, not just those in critical sectors. New Govern Function: CSF 2.0 introduces a new "Govern" function, emphasizing the importance of cybersecurity governance, strategy, and policy alignment with organizational objectives. Enhanced Risk Management: CSF 2.0 places a stronger emphasis on risk management, with new subcategories covering risk appetite, risk tolerance, and integrating cybersecurity risk into enterprise risk management. Streamlined Structure: The categories and controls have been updated and reorganized to enhance clarity and usability, with a total of 23 categories and 108 controls in CSF 1.1 compared to the revised structure in CSF 2.0. Alignment with Other NIST Guidance: CSF 2.0 ensures alignment with other NIST publications, such as the NIST Privacy Framework and Secure Software Development Framework, promoting a more comprehensive and integrated approach to managing information-related risks. Increased Flexibility and Adaptability: CSF 2.0 maintains the framework's emphasis on flexibility and customization, allowing organizations to tailor the guidance to their specific needs and risk profiles. Join our partners for your Certified CSF Professional training. #csf #nistcsf #nist #cybersecurity #informationsecurity #datasecurity #securitycompliance

1