NEW BOT Телеграм, страница

From 1 September to 30 September, specified PCI SSC stakeholders can participate in a Request for Comments (RFC) on the PTS POI Modular Security Requirements v6.2 draft. 

543 views08:10

ISACARuSec

https://www.bleepingcomputer.com/news/security/nsa-and-cisa-share-tips-to-secure-the-software-supply-chain/

BleepingComputer

NSA and CISA share tips to secure the software supply chain

The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have released guidance today with tips on how to secure the software supply chain.

664 views06:26

ISACARuSec

Forwarded from Yandex Cloud

🤓 Узнайте, как защитить свои облачные ресурсы

Мы запустили курс «Защита облачной инфраструктуры» — он научит:

🔹 использовать облачные сервисы безопасно;
🔹 грамотно настраивать доступ пользователей;
🔹 надёжно контролировать события безопасности.

Преимущества:

🔹 без воды: только нужная информация в коротких видео-уроках по 5–10 минут;
🔹 максимум практики: не только получите знания, но и отработаете их;
🔹 выгодно: 1 час теории и 5 часов практики бесплатно.

Кому подойдёт:

🔹 сотрудникам, отвечающим за информационную безопасность;
🔹 инженера DevOps или SRE;
🔹 разработчикам, интересующимся безопасностью облачных ресурсов.

Регистрируйтесь на курс ➡️ на сайте и прокачивайте навык информационной безопасности.

#yacloud_news

319 views06:21

ISACARuSec

https://medium.com/anton-on-security/more-sre-lessons-for-soc-release-engineering-ideas-cc410433e17

Medium

More SRE Lessons for SOC: Release Engineering Ideas

As we discussed in our blogs, “Achieving Autonomic Security Operations: Reducing toil” and “Achieving Autonomic Security Operations…

517 views06:24

ISACARuSec

https://blog.pcisecuritystandards.org/pci-dss-v4-0-is-the-customized-approach-right-for-your-organization

blog.pcisecuritystandards.org

PCI DSS v4.0: Is the Customized Approach Right For Your Organization?

This article focuses on considerations for entities thinking about implementing a customized approach, and details of the customized approach resources provided in PCI DSS for the assessed entity and in the PCI DSS Report on Compliance Template for the assessor.

522 views15:09

ISACARuSec

Forwarded from Rami Muleys

Всем привет!

Как вы знаете, с 1 сентября появились новые требвоания к защите персональных данных. Мы подготовили небольшой чеклист по тому, что нужно сделать чтобы соответствовать новым требованям и ничего не забыть.

https://storage.yandexcloud.net/yc-compliance/Checklist_new_requirements_152-FZ.pdf

Надеюсь будет полезным в работе.

675 views15:09

ISACARuSec

https://openssf.org/blog/2022/09/01/npm-best-practices-for-the-supply-chain/

Open Source Security Foundation

npm Best Practices for the Supply-Chain - Open Source Security Foundation

We are excited to announce the v1 release of the “npm Best Practices,” a new guide focused on dependency management and supply chain security for npm. This release is the result of the OpenSSF Best Practice Working Group. It is a critical step to help JavaScript…

515 views04:50

ISACARuSec

Forwarded from k8s (in)security (Дмитрий Евдокимов)

Стали доступны видеозаписи выступлений с Open Source Summit Latin America 2022. Конечно же не обошлось без тем о безопасности Kubernetes. Я для себя выделил:
- "Exploring Runtime Security and Forensic using eBPF" - очень базовый доклад с примерами на Tracee в конце.
- "A Checklist for Security from the Container to the Kubernetes: An Overview End to End " - упоминание chain-bench и двух checklists: Kubernetes Security Checklist и Container Security Checklist.
- "Edit, Debug, & Secure the K8s Manifest Lifecycle: Why is it Important and How Can You Get it Right?" - про жизненный цикл YAML manifests и работа с ними с помощью утилиты monokle (обратите внимание)!
- "Building a Secure By-Design Pipeline with an Open Source Stack" - доклад про kubescape.
- "SOAR with Postee: Automated Incident Response for Cloud Native Risks" - доклад про Postee. Данный доклад можно сравнить с моим докладом про SOAR.
- "MLSecOps with Automated Online and Offline ML Model Evaluations on Kubernetes" - MLSecOps 0_o

338 views05:38

ISACARuSec

https://csrc.nist.gov/publications/detail/sp/800-90c/draft

CSRC | NIST

NIST Special Publication (SP) 800-90C (Draft), Recommendation for Random Bit Generator (RBG) Constructions (3rd Draft)

The NIST Special Publication (SP) 800-90 series of documents supports the generation of high-quality random bits for cryptographic and non-cryptographic use. SP 800-90A specifies several deterministic random bit generator (DRBG) mechanisms based on cryptographic…

530 views07:12

ISACARuSec

https://csrc.nist.gov/publications/detail/nistir/8427/draft

CSRC | NIST

NIST Internal or Interagency Report (NISTIR) 8427 (Draft), Discussion on the Full Entropy Assumption of the SP 800 90 Series

NIST SP 800-90 series support the generation of high-quality random bits for cryptographic and non-cryptographic use. The security of a random number generator depends on the unpredictability of its outputs, which can be measured in terms of entropy. NIST…

541 views07:13

ISACARuSec

Forwarded from БДУ ФСТЭК России

Для тестирования доступен ТЕЛЕГРАМ-БОТ с функцией поиска уязвимостей по идентификаторам CVE и BDU, а также с возможностью подписаться на обновления БДУ; мгновенно получить топ 10 уязвимостей: по вендорам, по АСУ ТП и т.д.

Ссылка на бота:

@BDU_HELPbot

348 views07:18

ISACARuSec

https://blog.pcisecuritystandards.org/introducing-the-new-pci-ssc-mobile-app

blog.pcisecuritystandards.org

Introducing the New PCI SSC Mobile App

The PCI Security Standards Council is pleased to announce the release of its new mobile app. The PCI SSC mobile app allows for more direct engagement with payment industry stakeholders, including instant notification of Council news and announcements, and…

524 views07:02

ISACARuSec

https://blog.pcisecuritystandards.org/new-information-supplement-guidance-for-containers-and-container-orchestration-tools

blog.pcisecuritystandards.org

New Information Supplement: Guidance for Containers and Container Orchestration Tools

PCI Security Standards Council has published a new Information Supplement: Guidance for Containers and Container Orchestration Tools. This document was produced by the 2021 Special Interest Group (SIG), the members of which provided their expertise and shared…

917 views07:04

ISACARuSec

https://www.meritalk.com/articles/cisa-director-previews-new-strategic-plan-cyber-incident-reporting-rfi/

The Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly today previewed the agency’s new strategic plan, as well as a request for information (RFI) on cybersecurity incident reporting that will both be released “in a couple days.”

MeriTalk

CISA Director Previews New Strategic Plan, Cyber Incident Reporting RFI

The Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly today previewed the agency’s new strategic plan, as well as a request for information (RFI) on cybersecurity incident reporting that will both be released “in a couple days.”

659 viewsedited 07:13

ISACARuSec

https://www.fedscoop.com/nsa-sets-2035-deadline-for-adoption-of-post-quantum-cryptography-across-natsec-systems/

FedScoop

NSA sets 2035 deadline for adoption of post-quantum cryptography across national security systems

The intelligence agency expects traditional networking equipment to comply with the new standards by 2030.

793 views07:14

ISACARuSec

https://www.nextgov.com/cybersecurity/2022/09/traffic-safety-agency-issues-final-guidelines-vehicle-cybersecurity/376890/