https://twitter.com/thor_scanner/status/1459549486070513670
https://youtu.be/ONuK9NIXoOs
https://t.co/tdt4CNt9Yz
https://youtu.be/ONuK9NIXoOs
https://t.co/tdt4CNt9Yz
Twitter
Nextron Systems
Aurora - Free Sigma-based EDR Agent Preview - Introduction - Features - Advantages over other solutions - Response Actions - Roadmap - Live Demo Video session youtube.com/watch?v=ONuK9N… Slides nextron-systems.com/wp-content/upl…
https://twitter.com/cyb3rops/status/1491156207029334019
https://docs.google.com/spreadsheets/d/1BhR3cymZ53ZJfJdKAGKszuB-jgsr8GBJBOCJl50WGKE/htmlview
https://docs.google.com/spreadsheets/d/1BhR3cymZ53ZJfJdKAGKszuB-jgsr8GBJBOCJl50WGKE/htmlview
Twitter
Florian Roth ⚡️
Years ago I've created a spreadsheet that maps audit policy settings to corresponding events It's an outdated list but people still find it useful It also contains columns in which I've estimated the volume & rated the usefulness of these events docs.goo…
первый пост в серии по разделу ответственности в public cloud.
https://medium.com/anton-on-security/who-does-what-in-cloud-threat-detection-a7a4f44e7672
https://medium.com/anton-on-security/who-does-what-in-cloud-threat-detection-a7a4f44e7672
Medium
Who Does What In Cloud Threat Detection?
This post is a somewhat random exploration of the cloud shared responsibility model relationship to cloud threat detection.
Forwarded from Пост Лукацкого
Росстандарт утвердил ГОСТ Р 59548-2022 "Защита информации. Регистрация событий безопасности. Требования к регистрируемой информации", который был введен в действие с 1-го февраля 2022 года.
fstec.ru
Приказ от 13 января 2022 г. N 2-ст - ФСТЭК России
Официальный сайт Федеральной службы по техническому и экспортному контролю (ФСТЭК России)
Forwarded from Пост Лукацкого
В пару с ГОСТом по регистрации событий, Росстандарт утвердил еще и ГОСТ Р 59547-2021 "Защита информации. Мониторинг информационной безопасности. Общие положения", который введен в действие с 4-го января 2022 года.
NIST has published NISTIR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management. This report builds on the risk strategy and risk identification activities described in NISTIR 8286A and illustrates the need to ensure that enterprise context, priorities, and strategies are considered when making decisions about how best to respond to cybersecurity risks.
Additionally, a draft companion document – NISTIR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight – describes activities to help complete the CSRM/ERM integration cycle throughout the enterprise and is currently available for public comment. Submit your public comments by March 11, 2022.
https://csrc.nist.gov/publications/detail/nistir/8286/final
Additionally, a draft companion document – NISTIR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight – describes activities to help complete the CSRM/ERM integration cycle throughout the enterprise and is currently available for public comment. Submit your public comments by March 11, 2022.
https://csrc.nist.gov/publications/detail/nistir/8286/final
CSRC | NIST
NIST Internal or Interagency Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM)
The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended…
https://twitter.com/cloudsa/status/1491850240290398215
https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4/
https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4/
Twitter
CloudSecurityAlliance
CCM v4 has now been mapped to PCI DSS v3.2.1 and #NIST Special Publication 800-53 rev5! With this update, the CCM #cloudsecurity controls are now accompanied by nine total mappings. Download the CCM and all of its mappings here → bit.ly/3uD3bDF
https://twitter.com/ISACANews/status/1491888350940303360
https://www.isaca.org/resources/isaca-journal
https://www.isaca.org/resources/isaca-journal
Twitter
ISACA Global
The ISACA Journal is turning 50 and we’re celebrating all year! As a member-exclusive benefit, the ISACA Journal offers the latest industry news and insights. Download the digital version or sign up to get your print copy here: bit.ly/3Lq3Nmk
Forwarded from Social Engineering
⚙️ S.E.Заметка. GitHub дорки.
📌 В дополнение:
• Дорки:
https://news.1rj.ru/str/S_E_Reborn/1389
http://recruitin.net
https://github.com/techgaun/github-dorks
https://github.com/H4CK3RT3CH/github-dorks
https://github.com/jcesarstef/ghhdb-Github-Hacking-Database
• Инструменты:
https://github.com/BishopFox/GitGot
https://github.com/Talkaboutcybersecurity/GitMonitor
https://github.com/michenriksen/gitrob
https://github.com/tillson/git-hound
https://github.com/kootenpv/gittyleaks
https://github.com/awslabs/git-secrets https://git-secret.io/
• Полезный мануал: https://shahjerry33.medium.com/github-recon-its-really-deep-6553d6dfbb1f
‼️ Другую дополнительную информацию ты можешь найти по хештегу #СИ и #OSINT. Твой S.E.
🖖🏻 Приветствую тебя user_name.• Для быстрого и удобного поиска скрытой информации касательно GitHub, мы можем использовать всем известные дорки. Сегодня ты узнаешь о полезной табличке, из которой можешь подчеркнуть для себя полезные запросы и найти скрытую информацию.
📌 В дополнение:
• Дорки:
https://news.1rj.ru/str/S_E_Reborn/1389
http://recruitin.net
https://github.com/techgaun/github-dorks
https://github.com/H4CK3RT3CH/github-dorks
https://github.com/jcesarstef/ghhdb-Github-Hacking-Database
• Инструменты:
https://github.com/BishopFox/GitGot
https://github.com/Talkaboutcybersecurity/GitMonitor
https://github.com/michenriksen/gitrob
https://github.com/tillson/git-hound
https://github.com/kootenpv/gittyleaks
https://github.com/awslabs/git-secrets https://git-secret.io/
• Полезный мануал: https://shahjerry33.medium.com/github-recon-its-really-deep-6553d6dfbb1f
‼️ Другую дополнительную информацию ты можешь найти по хештегу #СИ и #OSINT. Твой S.E.
Forwarded from Пост Лукацкого
Интересная заметка про реальность и маркетинг вокруг Zero Trust. Схожая ситуация и с другими разрекламированными концепциями, например, XDR. На картинке все хорошо, но реальность вносит свои коррективы
Mayakaczorowski
BeyondCorp is dead, long live BeyondCorp
No organization has successfully implemented a fully zero trust architecture. Many proponents of zero trust, including the US government, have ignored device...
👍2