ISACARuSec – Telegram
ISACARuSec
@IsacaRuSec
2.26K subscribers
1.76K photos
13 videos
302 files
5.62K links
Канал направления ИБ Московского отделения ISACA

Направление канала новости ISACA, новости в области управления ИБ в России и мире, обмен лучшими практиками.

https://engage.isaca.org/moscow/home

Связь с администрацией
@popepiusXIII
Download Telegram
About
Blog
Apps
Platform
Join
ISACARuSec
2.26K subscribers
ISACARuSec
https://github.com/R0X4R/Garud
GitHub
GitHub - R0X4R/Garud: An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more…
An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically. -...
452 views
ISACARuSec
https://www.nccoe.nist.gov/projects/trusted-iot-device-network-layer-onboarding-and-lifecycle-management
NCCoE
Trusted IoT Device Network-Layer Onboarding and Lifecycle Management | NCCoE
Project AbstractProvisioning network credentials to IoT devices in an untrusted manner leaves networks vulnerable to having unauthorized IoT devices connect to them. It also leaves IoT devices vulnerable to being taken over by unauthorized networks. Instead…
427 views
ISACARuSec
Краткое содержание недавнего симпозиума по экономике ИБ WEIS 2022.

https://www.lightbluetouchpaper.org/2022/06/21/weis-2022-liveblog/#comments
👍3
439 views
ISACARuSec
https://blog.pcisecuritystandards.org/pci-dss-v4-0-a-perspective-from-india
blog.pcisecuritystandards.org
PCI DSS v4.0: A Perspective from India
In this episode, PCI SSC’s Nitin Bhatnagar, Associate Director, India, is joined by three Indian stakeholders from Amazon Pay, SBI Card, and HDFC Bank to discuss the newly released PCI DSS v4.0.
412 views
ISACARuSec
https://medium.com/mitre-engenuity/put-mitre-att-ck-at-your-fingertips-f7dcad9727d2

Расширение для хром с целью работы с матрицей Митре.
Medium
Put MITRE ATT&CK® at Your Fingertips
Written by Mark E. Haase and Jon Baker.
1.32K viewsedited  
ISACARuSec
https://www.protocol.com/enterprise/cybersecurity-xdr-microsoft-crowdstrike-palo
Protocol
Cybersecurity hype keeps building around XDR. So does confusion.
Proponents say that extended detection and response services have huge potential for improving security for customers – if only top industry players could agree on what XDR actually is.
446 views
ISACARuSec
https://www.nccoe.nist.gov/automation-nist-cryptographic-module-validation-program
NCCoE
Automation of the NIST Cryptographic Module Validation Program | NCCoE
Project AbstractThis project will demonstrate automation that will improve the efficiency and timeliness of CMVP operations and processes. Many elements in the current validation processes are manual in nature, and the period required for third-party testing…
428 views
ISACARuSec
https://www.bleepingcomputer.com/news/security/cisa-log4shell-exploits-still-being-used-to-hack-vmware-servers/
BleepingComputer
CISA: Log4Shell exploits still being used to hack VMware servers
CISA warned today that threat actors including state-backed hacking groups are still targeting VMware Horizon and Unified Access Gateway (UAG) servers using the Log4Shell (CVE-2021-44228) remote code execution vulnerability.
449 views
ISACARuSec
https://www.nextgov.com/cybersecurity/2022/06/cisa-seeks-public-feedback-tic-30-cloud-use-case/368454/
Nextgov.com
CISA Seeks Public Feedback on TIC 3.0 Cloud Use Case
Trusted Internet Connections use cases provide guidance on secure implementations of specific platforms, services and environments.
441 views
ISACARuSec
Forwarded from k8s (in)security (Дмитрий Евдокимов)
Тренинг_Cloud_Native_безопасность_в_Kubernetes_.png
1.8 MB
Я уже писал, что веду 3-х дневное обучение "Cloud Native безопасность в Kubernetes".

И вот недавно на одном из таких тренингов, один из участников (респект тебе) сделал вот такой замечательный MindMap по его итогам! Выкладываю его с разрешения его создателя. Сначала я хотел внести туда какие-то свои мысли, корректировки и дополнения, а потом решил, что так будет даже лучше (или мне просто пока лень) показать, как видят материал участники! То есть тренинг "Cloud Native безопасность в Kubernetes" глазами его участников.

Думаю, что данный MindMap будет полезен многим ;)

Изучайте новое, от теории переходите к практике, не бойтесь не понятного! Чем больше в сообществе, в индустрии будет грамотных специалистов, тем лучше будет нам всем!
👍4
273 views
ISACARuSec
https://csrc.nist.gov/publications/detail/nistir/8323/rev-1/draft
CSRC | NIST
NIST Internal or Interagency Report (NISTIR) 8323 Rev. 1 (Draft), Foundational PNT Profile: Applying the Cybersecurity Framework…
The national and economic security of the United States (US) is dependent upon the reliable functioning of the nation’s critical infrastructure. Positioning, Navigation, and Timing (PNT) services are widely deployed throughout this infrastructure. In a government…
451 views
ISACARuSec
https://www.zdnet.com/article/cybersecurity-leaders-are-anticipating-mass-resignations-within-the-year/
ZDNET
Cybersecurity leaders are anticipating mass resignations within the year - here's why
The growing threat of attacks combined with industry skill gaps is leading to sky-high burnout rates among cybersecurity professionals.
496 views
ISACARuSec
https://vc.ru/future/450828-lyudyam-nelzya-botam-kak-evolyucionirovala-tehnologiya-kapchi
vc.ru
Людям нельзя ботам: как эволюционировала технология «капчи» — Будущее на vc.ru
Cервис Yandex SmartCaptcha вышел в Public Preview. Бизнес сможет использовать его для защиты от роботов, фиктивных регистраций и спама. Пользуясь случаем, вспоминаем, с чего начинались проверки пользователей на человечность 20 лет назад и как они выглядят…
👍1
502 views
ISACARuSec
https://www.nccoe.nist.gov/addressing-visibility-challenges-tls-13
NCCoE
Addressing Visibility Challenges with TLS 1.3 within the Enterprise | NCCoE
Project AbstractThe Transport Layer Security (TLS) protocol is widely deployed to secure network traffic. TLS 1.3 protects the contents of its previous TLS communications even if a TLS-enabled server is compromised. This is known as forward secrecy. The approach…
504 views
ISACARuSec
https://rusrim.blogspot.com/2022/06/blog-post_30.html

Росстандарт: Начато публичное обсуждение проекта стандарта ГОСТ Р «Менеджмент риска. Риск-аппетит и ключевые индикаторы риска»
Blogspot
ФНС России о применении бумажных и электронных доверенностей
Федеральная налоговая служба (ФНС России) в своём письме №ЕА-3-26/5811@ от 3 июня 2022 года разъяснила свою позицию по вопросу применения до...
504 viewsedited  
ISACARuSec
https://chronicle.security/blog/posts/how-to-think-about-cloud-threats-today/
Chronicle
Blog — How to think about cloud threats today
<p>In the cloud, are these new threats, or old and familiar threats against relatively new assets? What does the future potential hold for your adversaries? And what can your security operations team do to get ahead of this fast-moving landscape?</p>
527 views
ISACARuSec
https://www.wsj.com/articles/european-cloud-restrictions-could-limit-u-s-providers-reach-11656430248
WSJ
European Cloud Restrictions Could Limit U.S. Providers’ Reach
European cybersecurity authorities are drafting a new certification system for cloud services that could limit the amount of critical data held by American providers.
459 views
ISACARuSec
https://about.gitlab.com/releases/2022/06/30/critical-security-release-gitlab-15-1-1-released/#remote-command-execution-via-project-imports
GitLab
GitLab Critical Security Release: 15.1.1, 15.0.4, and 14.10.5
Learn more about GitLab Critical Security Release: 15.1.1, 15.0.4, and 14.10.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
604 views
ISACARuSec
https://www.nist.gov/blogs/next-integrating-information-and-communication-technology-risk-programs-enterprise-risk
NIST
Next Up: Integrating Information and Communication Technology Risk Programs with Enterprise Risk Management
Given the increasing reliance of organizations on technologies over the past
440 views
ISACARuSec
https://csrc.nist.gov/News/2022/pqc-candidates-to-be-standardized-and-round-4
CSRC | NIST
Announcing PQC Candidates to be Standardized, Plus Fourth Round Candidates | CSRC
NIST is announcing four Post-Quantum Cryptography candidates for standardization, plus candidates for a fourth round of analysis.
480 views
ISACARuSec
https://www.isaca.org/why-isaca/about-us/newsroom/press-releases/2022/new-toolkit-and-course-from-isaca-help-practitioners-develop-risk-scenarios
ISACA
New Toolkit and Course From ISACA Help Practitioners Develop Risk Scenarios
One of the challenges for IT risk management is to identify important and relevant risk, and one of the best ways to do that is through a well-developed risk scenario providing a realistic and practical view of risk that may prevent...
418 views