Опубликована долгожданная первая версия матрицы техник атакующих MITRE ATT&CK for ICS

https://medium.com/mitre-attack/launching-attack-for-ics-2be4d2fb9b8

Вторая версия рекомендаций.

NISTIR 8259 (Draft), Recommendations for IoT Device Manufacturers | CSRC
https://csrc.nist.gov/publications/detail/nistir/8259/draft

Обновленная информация по аккредитованым SOC европы.

https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-inventory/certs-by-country-interactive-map

Ожидания на 2020 год от преподавателей SANS.

https://www.sans.org/security-trends/2020/01/03/14-sans-instructors-share-their-cyber-resolutions-for-2020

Стоимость практической атаки на sha-1 упала до 75 000 долларов.


"...В итоге атакующий может выдать себя за жертву и подписать любой документ от её имени..."

https://www.opennet.ru/opennews/art.shtml?num=52149

Why you should ignore Annex A when doing ISO27001

https://twitter.com/3dwave/status/1214780605537378311?s=09

Новости ИБ за новогодние праздники https://t.co/RWOmss0feq
— Alexey Lukatsky (@alukatsky) January 9, 2020

...
Edward Scheidt, Convenor of
ISO/TC 68/SC 2/WG 17, Security aspects of digital currencies;
and Ryan Pierce, Co-Chair of this working group:
Yet while convenience appears to be a big advantage for money in a digital format, three security-related issues need to be resolved:

1. Trust, so that the supporting international financial ecosystem can warranty its financial payments and financial transactions.
2. Binding liability, so that investments supporting a financial ecosystem do not have negative legal ramifcations.
3. Privacy, so that the individual, as
a consumer, with the supporting
financial infrastructure can ensure
that information remains private
when needed.

NIST Webinar:
Learning Principles for Cybersecurity Practice

https://www.nist.gov/news-events/events/2020/01/nice-webinar-learning-principles-cybersecurity-practice

Megalist of #CCPA Resources, Checklists and Guidance - Admiral Blog

https://twitter.com/3dwave/status/1216116679220047872?s=09

Main predictions for 2020 are:
1. First real attacks using deep fakes (voice), including attacks on C-level and individuals.

2. the convergence of physical infiltration with cyberattacks, challenging security across the board e. g. "electrician" getting access to the unprotected network device.

3.Get ready for SMS attacks to go mainstream. This type of attack will come in three main forms: SIM swap, IMSI factors and SS7 hacks.

4. IT should expect new O365 phishing and malware attacks.

5. Phishing emails related to common industry tools or masquerading as trusted sources will be a common attack vector for stealing credentials and sensitive information.

6.Disaster Recovery-as-a-Service (DRaaS) will be mainstream, even for SMB organizations.

7. State and state-sponsored cyber groups continue to be proxy for international relations.

8. We expect to see federal agencies to increasingly differentiate their IT consumption models (e.g. cloud, MSP, etc.).

9. The digital advertising ecosystem will be the next top target as a new class of attacks emerges – As consumer experience becomes more important — and elaborate — advertisers harvesting troves of customer data will find themselves susceptible to a new wave of attacks from cybercriminals.

10. The use of and evolution of biometrics. Decentralized, device-managed biometrics will continue to rise as a convenient way to authenticate users.

2020 cybersecurity predictions | SC Media
https://www.scmagazine.com/home/security-news/2020-cybersecurity-predictions/