DISC InfoSec blog

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

OWASP updated 2025 Top 10 Risks for Large Language Models (LLMs), a crucial resource for developers, security teams, and organizations working with AI.

Tags: iso 27001, ISO 27001 2022, iso 27001 certification

Comments (6)

Dec 02 2024

AI-based tools designed for criminal activity are in high demand

Category: Cyber crime,Cybercrime,Ransomware — disc7 @ 9:13 am

The landscape of ransomware attacks has shifted dramatically, with cybercriminals increasingly using AI to automate, accelerate, and scale their operations. These attacks now target sectors like healthcare, manufacturing, and critical infrastructure, exploiting their reliance on uptime and historical underinvestment in cybersecurity. The rise in ransomware attacks—up 67% in 2023—has expanded attack surfaces, making businesses of all sizes vulnerable. Small to medium enterprises are particularly at risk, as many lack adequate cybersecurity resources

AI, while leveraged by attackers, also offers a robust countermeasure for defenders. It enables organizations to automate detection, flag anomalies in administrative activities, and track malware proliferation through advanced techniques like hash-based monitoring. Generative AI tools, such as copilots, can guide IT teams in assessing vulnerabilities, crafting recovery strategies, and implementing tailored protection policies. These innovations reduce manual errors and enhance rapid response to ransomware incidents

Ransomware tactics are evolving, with a growing focus on data theft over traditional encryption methods. Stolen intellectual property, financial records, or customer data provides leverage in negotiations and inflicts lasting reputational damage on victims. Furthermore, attackers are exploiting dual-use tools like remote access software and file-sharing utilities, which blend into legitimate activity. Detecting such misuse requires behavioral analysis and proactive exposure management rather than traditional signature-based defenses

To mitigate these threats, businesses must adopt comprehensive cyber resilience strategies. These include maintaining a 3-2-1 backup model, integrating AI capabilities for automated responses, and regularly rehearsing recovery plans. Such preparation ensures faster containment and recovery, ultimately reducing the operational and financial impact of ransomware incidents

For further details, access the article here

How CISOs Can Drive the Adoption of Responsible AI Practices

The CISO’s Guide to Securing Artificial Intelligence

AI in Cyber Insurance: Risk Assessments and Coverage Decisions

Hackers will use machine learning to launch attacks

To fight AI-generated malware, focus on cybersecurity fundamentals

4 ways AI is transforming audit, risk and compliance

AI security bubble already springing leaks

Could APIs be the undoing of AI?

The Rise of AI Bots: Understanding Their Impact on Internet Security

The Little Book on Big Cyber Crime

Comprehensive vCISO Services

Tags: AI based tools

ISO 27001: Building a Culture of Security and Continuous Improvement

Nov 30 2024

10 key benefits of ISO 27001 Cert for SMBs

Category: ISO 27k — disc7 @ 9:19 am

Here are 10 key benefits of ISO 27001 certification for small and medium-sized businesses (SMBs)

Enhanced Data Security: Protect sensitive information against breaches, reducing the risk of financial loss or reputational damage.
Customer Trust: Demonstrate a commitment to safeguarding client data, boosting customer confidence and loyalty.
Regulatory Compliance: Meet legal and regulatory requirements (e.g., GDPR, HIPAA), avoiding penalties and ensuring smooth operations.
Competitive Advantage: Stand out in the marketplace by showcasing internationally recognized security standards.
Improved Risk Management: Identify and mitigate risks proactively with structured risk assessments and controls.
Operational Efficiency: Streamline security processes and eliminate redundancies, reducing inefficiencies and costs.
Scalability: Adapt security measures to grow alongside your business, ensuring protection as operations expand.
Incident Response: Prepare robust plans to detect, respond to, and recover from incidents quickly, minimizing downtime.
Employee Awareness: Cultivate a security-conscious workforce through regular training and awareness programs.
Partnership Opportunities: Meet vendor and partner requirements for security certifications, enabling new collaborations and business growth.

Overcoming Challenges

Resistance to Change: Highlight benefits to gain employee buy-in.
Resource Constraints: Use a phased approach to certification.
Integration Complexity: Leverage common principles with other frameworks like ISO 9001 for seamless integration.

The Way Forward
ISO 27001 isn’t just about protecting data—it’s about building trust, improving operations, and achieving competitive advantage. Start embedding its principles today for a stronger, more secure organization.

Being certified with ISO 27001 can bring numerous advantages for medium to enterprise level organizations:

Minimizes the risk of cyber-attacks on your company.
Facilitates the demonstration of compliance with various regulations and standards.
Lowers operational expenses by implementing only necessary controls.
Prevents damage to reputation and financial penalties.
Enhances customer retention through a compelling security narrative.
Attracts new business opportunities by confidently addressing security concerns.
Streamlines the process of completing security questionnaires, freeing up valuable time.
Cultivates a stronger security culture and awareness within the organization.
Reduces Cyber Liability Premiums by potentially over 200%

Penetration Testing and ISO 27001 – Securing ISMS

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Penetration Testing and ISO 27001 – Securing ISMS

Tags: isms, iso 27001 certification, SMB

Comments (6)

Nov 29 2024

ISO 27001: Building a Culture of Security and Continuous Improvement

Category: Information Security,ISO 27k — disc7 @ 9:19 am

ISO 27001: Building a Culture of Security and Continuous Improvement

More Than Compliance
ISO 27001 is not just a certification; it’s a framework that embeds security into the core of your organization, fostering trust, efficiency, and resilience.

Security as a Journey
ISO 27001 promotes a proactive, continuous approach to security, adapting to ever-evolving cyber threats and embedding security as a company-wide mindset.

Key Practices for Continuous Improvement

Regular Risk Assessments: Periodically evaluate vulnerabilities and prioritize mitigation measures to stay ahead of potential threats.
Employee Engagement: Train employees to actively participate in protecting information and identifying risks early.
Performance Monitoring: Use metrics, audits, and reviews to refine and align security measures with business goals.
Incident Learning: Develop robust response plans, analyze incidents, and strengthen systems to prevent future issues.

Why a Security Culture Matters
A strong security culture builds trust, fosters innovation, and enables safe adoption of technologies like cloud computing and remote work, giving organizations a competitive edge.

Practical Steps to Embed Security

Set Clear Objectives: Align ISO 27001 goals with business priorities like risk reduction and client trust.
Engage Leadership: Secure top management’s active participation to drive initiatives.
Integrate Security: Make security a shared responsibility across all departments.
Focus on Risks: Prioritize and allocate resources effectively based on risk impact.
Encourage Communication: Foster open discussions about security concerns and solutions.
Scale with Growth: Adjust security practices as your organization evolves.

Overcoming Challenges

Resistance to Change: Highlight benefits to gain employee buy-in.
Resource Constraints: Use a phased approach to certification.
Integration Complexity: Leverage common principles with other frameworks like ISO 9001 for seamless integration.

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Open Source Intelligence Methods and Tools: A Practical Guide to Online Intelligence

Tags: iso 27001, security culture

Comments (5)

Nov 28 2024

5 cybersecurity open-source tools

Category: Open Source — disc7 @ 7:53 am

1. MISP (Malware Information Sharing Platform & Threat Sharing)

Purpose: Designed to facilitate sharing threat intelligence between organizations, MISP is invaluable for building a collaborative defense strategy against cyber threats.
Key Features:
- Collects, stores, and shares indicators of compromise (IOCs) efficiently.
- Supports STIX/TAXII for standardized threat intelligence sharing.
- Offers real-time alerts, advanced tagging, and classification of incidents.
Use Case: Organizations use MISP to streamline incident response and threat intelligence management, making it a cornerstone of cybersecurity strategies.
Learn More: MISP Project

2. OSForensics

Purpose: A digital forensics tool enabling investigators to uncover critical evidence from digital devices.
Key Features:
- Recovers deleted files, emails, and passwords from devices.
- Tracks USB interactions and recently accessed websites.
- Supports memory forensics with tools like Volatility Workbench.
- Generates detailed forensic reports.
Use Case: Widely used in legal investigations, incident response, and by forensic professionals to analyze compromised systems.
Learn More: OSForensics

3. ELK Stack (Elasticsearch, Logstash, Kibana)

Purpose: A highly adaptable SIEM solution for monitoring, detecting, and analyzing security threats.
Key Features:
- Elasticsearch indexes and searches log data.
- Logstash processes and enriches the log data from multiple sources.
- Kibana visualizes security metrics and logs with interactive dashboards.
- Provides seamless scaling for growing datasets and integration with third-party tools.
Use Case: Ideal for enterprises needing real-time log analysis and monitoring to proactively address threats.
Learn More: Elastic.co

4. AlienVault OSSIM

Purpose: Combines open-source tools into a cohesive SIEM platform for comprehensive security monitoring.
Key Features:
- Asset discovery and vulnerability assessment.
- Intrusion detection (IDS/HIDS) and behavioral anomaly detection.
- Incident response with robust reporting tools.
Use Case: Suitable for small to medium businesses looking for affordable yet powerful threat detection capabilities.
Learn More: AlienVault OSSIM

5. FreeIPA

Purpose: An IAM tool tailored for centralized authentication, authorization, and account management in Linux/UNIX environments.
Key Features:
- Built-in SSO via Kerberos.
- Integration with DNS and certificate management.
- Offers both CLI and GUI options for flexibility.
Use Case: Enterprises needing streamlined IAM solutions for securing access across Linux-based systems.
Learn More: FreeIPA

Here are some implementation tips for the highlighted tools:

1. MISP

Initial Setup:
- Deploy MISP on a Linux server (CentOS, Ubuntu, or Debian). Prebuilt virtual machines are also available.
- Use Docker containers for easier installation and maintenance.
- Configure database settings and enable HTTPS for secure communication.
Best Practices:
- Regularly update the taxonomy and tags for organizing IOCs.
- Leverage the API to integrate MISP with SIEMs or ticketing systems.
- Use its sharing groups feature to limit access to sensitive threat intelligence.
Resources:
- Official installation guide: MISP Documentation.

2. OSForensics

Deployment:
- Install on a forensic workstation or USB stick for portable use.
- Combine with additional forensic tools like FTK or EnCase for broader capabilities.
Tips:
- Use OSFClone to create disk images for analysis without modifying evidence.
- Regularly train staff on the Volatility Workbench module for memory forensics.
- Automate reporting templates for quicker investigations.
Resources:
- Tutorial and guides: OSForensics Help.

3. ELK Stack

Installation:
- Set up Elasticsearch, Logstash, and Kibana on Linux. Docker and Helm charts for Kubernetes simplify deployment.
- Use Filebeat to collect logs from endpoints and forward them to Logstash.
Optimization:
- Configure indices carefully to handle high-volume logs.
- Implement role-based access control (RBAC) for Kibana to secure dashboards.
- Enable alerts and anomaly detection using Kibana’s machine learning features.
Resources:
- Elastic’s official guide: ELK Documentation.

4. AlienVault OSSIM

Setup:
- Install on-premises or use its hosted version. The installation ISO is available on its website.
- Configure plugins for data collection from firewalls, IDS/IPS, and endpoint devices.
Usage Tips:
- Regularly update correlation rules for detecting modern threats.
- Use its vulnerability scanner to complement other risk assessment tools.
- Train analysts to leverage its HIDS/IDS for actionable insights.
Resources:
- OSSIM setup and usage: AT&T AlienVault Documentation.

5. FreeIPA

Installation:
- Deploy FreeIPA on a Linux-based system. Red Hat-based distributions offer built-in packages.
- Integrate with Active Directory for hybrid environments.
Best Practices:
- Configure Kerberos for single sign-on and enable password policies.
- Regularly monitor and audit access logs using built-in features.
- Secure FreeIPA with SELinux and periodic updates.
Resources:
- FreeIPA admin guide: FreeIPA Documentation.

Checkout previous posts on Open Source here

Tags: open source tools

Open_Source_Intelligence_Techniques-Lite-1 Download

Nov 27 2024

OSINT for ICS/OT Course
Review Questions

Category: Information Security,OSINT,OT/ICS — disc7 @ 3:14 pm

by Mike Holcomb

The OSINT Bible: The Complete Guide to Mastering Open-Source Intelligence | Discover Critical Information, Protect Sensitive Data, and Gain a Competitive Edge

Checkout previous OSINT posts here

Tags: OSINT

Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CK(TM) Framework and open source tools

Nov 27 2024

Why Security Leaders Should Prioritize the MITRE ATT&CK Evaluation

Category: Attack Matrix,Information Security — disc7 @ 10:19 am

The article emphasizes the importance of the MITRE Engenuity ATT&CK Evaluations for security leaders in navigating the complex cybersecurity landscape. These evaluations simulate real-world threats to test how vendors’ solutions detect, respond to, and report adversary tactics, techniques, and procedures (TTPs). The evaluations leverage the globally recognized MITRE ATT&CK framework, which categorizes TTPs into a structured model, helping organizations assess and address security gaps effectively.

Key factors that set MITRE ATT&CK Evaluations apart include their focus on real-world conditions, transparent results, and alignment with the ATT&CK framework. Unlike traditional assessments, these evaluations emulate attack scenarios, enabling vendors to demonstrate their capabilities under realistic conditions. The transparency of the results allows organizations to evaluate performance metrics directly, helping security leaders choose solutions tailored to their unique threat environments.

The 2023 MITRE ATT&CK Evaluation highlighted notable advancements, with Cynet achieving 100% visibility and analytic coverage without configuration changes—a first in the evaluation’s history. For 2024, MITRE plans to introduce more targeted evaluations, testing vendor solutions against adaptable ransomware-as-a-service variants and North Korean state-sponsored tactics, expanding coverage to Linux, Windows, and macOS platforms.

Cybersecurity leaders are encouraged to closely monitor the upcoming results, which will offer valuable insights into the strengths and weaknesses of vendor solutions. By leveraging these findings, organizations can refine their defenses, mitigate risks, and strengthen resilience against evolving threats. The Cynet-hosted webinar provides an opportunity to understand and act on these evaluations, making them a critical resource for informed decision-making.

For further details, access the full article here

Previous articles on Mitre Att&ck Framework

Tags: CISO, MITRE ATT&CK Evaluation, Security Leaders

Penetration Testing : Step-By-Step Guide

Nov 27 2024

Penetration Testing and ISO 27001 – Securing ISMS

Category: ISO 27k,Pen Test — disc7 @ 9:06 am

The document highlights the integration of penetration testing within ISO 27001’s framework, emphasizing its critical role in identifying system vulnerabilities and maintaining security posture. It links pen testing to the standard’s risk management and continuous improvement principles, focusing on Annex A controls, such as Operations Security and Compliance.

It details the importance of scoping, balancing business needs with potential risks. The guide underscores embedding pen testing into broader risk assessment efforts to enhance resilience.

How does penetration testing fit into my ISO 27001 ISMS project?

There are three stages in your ISMS project when penetration testing can make a
significant contribution:

As part of the risk assessment process, to uncover vulnerabilities in any
Internet-facing IP addresses, web applications or internal devices and
applications, and link them to identifiable threats.
As part of the risk treatment plan, to ensure that security controls work
as designed.
As part of the ongoing performance evaluation and improvement
processes, to ensure that controls continue to work as required and that
new and emerging vulnerabilities are identified and dealt with.

ISO 27001 says that you must identify information security risks within the scope of
the ISMS (Clause 6.1.2.c). This involves identifying all assets and information systems
within scope of the ISMS, and then identifying the risks and vulnerabilities those
assets and systems are subject to.

A penetration test can help identify these risks and vulnerabilities. The results will
highlight detected issues and guide remedial action, and are a key input for your risk
assessment and treatment process. Once you understand the threats you face, you
can make an informed decision when selecting controls.

For further details, access the full document here.

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Significance of ISO 27017 and ISO 27018 for Cloud Services

Tags: isms, iso 27001, Penetration Testing

Comments (4)

Nov 26 2024

Secure Your Digital Transformation with ISO 27001

Category: Cloud computing,ISO 27k — disc7 @ 10:25 am

Secure Your Digital Transformation in Cloud with ISO 27001

In today’s fast-paced digital transformation era, cloud computing drives innovation, scalability, and global competitiveness. But with these opportunities come critical responsibilities—especially in protecting sensitive data.

Enter ISO 27001: the globally recognized standard for information security management. For organizations adopting cloud solutions, ISO 27001 provides a structured roadmap to safeguard data, build trust, and ensure compliance.

Why ISO 27001 is Essential in the Cloud Era

While cloud computing offers flexibility, it also introduces risks. ISO 27001 addresses these challenges by:

Adopting a Risk-Based Approach: Identifying and mitigating cloud-specific risks like breaches and misconfigurations. ISO 27001 Risk Management
Establishing Clear Policies: Developing tailored security controls for cloud environments.
Enhancing Vendor Management: Ensuring third-party agreements align with security objectives.
Strengthening Incident Response: Promoting readiness for potential cloud threats or breaches.

ISO 27001 + Digital Transformation = Success

When integrated into your digital strategy, ISO 27001 helps you:

Build Trust: Demonstrate commitment to security to customers, partners, and regulators.
Simplify Compliance: Align with GDPR, HIPAA, and other regulations.
Enable Secure Scalability: Grow your operations without compromising security or agility.

Elevate Your Cloud Security Strategy

Embracing ISO 27001 ensures you not only mitigate cloud risks but also gain a competitive edge. Certification showcases your dedication to safeguarding client data, fostering trust and long-term partnerships.

How secure is your cloud strategy? Let’s discuss how ISO 27001 can help you enhance your security while accelerating your digital transformation goals.

In the 2022 update, ISO 27001 introduces specific Cloud controls (Annex A, clause 5.23 – the control that specifies the processes for acquiring, using, managing, and exiting cloud services), highlighting key areas where organizations can tighten security:

Defining security requirements using the CIA Triad
Establishing supplier selection criteria based on your risk profile and needs
Assigning and tracking roles and responsibilities (Governance) for Cloud security
Ensuring data protection and privacy throughout operations
Implementing procurement lifecycle policies for Cloud services, from acquisition to termination

Given today’s reliance on Cloud services—and the risks posed by issues like faulty vendor updates—it’s critical to go deeper into Cloud security controls.

ANNEX A CLAUSE 8.26 APPLICATION SECURITY REQUIREMENTS

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Information Security Risk Management for ISO 27001/ISO 27002

Tags: Digital Transformation, Securing Cloud Services

Comments (5)

Nov 25 2024

Adding Value with Adding Value with Risk-Based Information Security

Category: ISO 27k,NIST CSF,Risk Assessment,Security Risk Assessment — disc7 @ 8:27 am

The article emphasizes the importance of integrating risk management and information security management systems (ISMS) for effective IT security. It recommends a risk-based approach, leveraging frameworks like ISO/IEC 27001 and NIST Cybersecurity Framework (CSF) 2.0, to guide decisions that counteract risks while aligning with business objectives. Combining these methodologies enhances control accuracy and ensures that organizational assets critical to business goals are appropriately classified and protected.

An enterprise risk management system (ERMS) bridges IT operations and business processes by defining the business value of organizational assets. This alignment enables ISMS to identify and safeguard IT assets vital to achieving organizational objectives. Developing a registry of assets through ERMS avoids redundancies and ensures ISMS efforts are business-driven, not purely technological.

The NIST CSF 2.0 introduces a “govern” function, improving governance, priority-setting, and alignment with security objectives. It integrates with frameworks like ISO 27001 using a maturity model to evaluate controls’ effectiveness and compliance. This approach ensures clarity, reduces redundancies, and provides actionable insights into improving cybersecurity risk profiles and resilience across the supply chain.

Operationally, integrating frameworks involves a centralized tool for managing controls, aligning them with risk treatment plans (RTP), and avoiding overlaps. By sharing metrics across frameworks and using maturity models, organizations can efficiently evaluate security measures and align with business goals. The article underscores the value of combining ISO 27001’s holistic ISMS with NIST CSF’s risk-focused profile to foster continual improvement in an evolving digital ecosystem.

For example, let’s consider an elementary task such as updating the risk policy. This is part of control 5.1 of ISO27001 on information security policies. It is part of the subcategory GV.PO-01 of the NIST CSF on policies for managing cybersecurity risks, but it is also present in the RTP with regard to the generic risk of failure to update company policies. The elementary control tasks are evaluated individually. Then, the results of multiple similar tasks are aggregated to obtain a control of one of the various standards, frameworks or plans that we are considering.

Best method for evaluating the effectiveness of control activities may be to adopt the Capability Maturity Model Integration (CMMI). It is a simple model for finding the level of maturity of implementation of an action with respect to the objectives set for that action. Furthermore, it is sufficiently generic to be adaptable to all evaluation environments and is perfectly linked with gap analysis. The latter is precisely the technique suitable for our evaluations – that is, by measuring the current state of maturity of implementation of the control and comparing it with the pre-established level of effectiveness, we are able to determine how much still needs to be done.

In short, the advantage of evaluating control tasks instead of the controls proposed by the frameworks is twofold.

The first advantage is in the very nature of the control task that corresponds to a concrete action, required by some business process, and therefore well identified in terms of role and responsibility. In other words, something is used that the company has built for its own needs and therefore knows well. This is an indicator of quality in the evaluation.
The second advantage is in the method of treatment of the various frameworks. Instead of building specific controls with new costs to be sustained for their management, it is preferable to identify each control of the framework for which control tasks are relevant and automatically aggregate the relative evaluations. The only burden is to define the relationship between the companys control tasks and the controls of the chosen framework, but just once.

More details and considerations on pros and cons are described in recent ISACA Journal article, “Adding Value With Risk-Based Information Security.”

Source: National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, USA, 2024, https://www.nist.gov/informative-references

Information Security Risk Assessment Workshop

Tags: Risk-Based Information Security

Comments (1)

Nov 22 2024

Explore the new Atomic Red Team website

Category: Attack Matrix,Information Security — disc7 @ 11:35 am

The redesigned Atomic Red Team website features a new browser interface, improved search capabilities, and easier test execution

Red Canary’s Atomic Red Team is an open-source framework designed to help security teams test their detection capabilities against adversary tactics defined in the MITRE ATT&CK framework. It provides small, portable tests, enabling organizations to simulate specific attacker techniques in a controlled environment. This framework empowers defenders to validate their security controls, identify gaps in detection, and better understand malicious behaviors. Atomic Red Team offers a highly flexible approach, supporting manual execution via command-line scripts or automated tools like Invoke-Atomic, a PowerShell module that simplifies running tests

The platform focuses on making security testing accessible to teams of all sizes by offering easy-to-follow documentation and a community-driven approach. Tests are mapped to MITRE ATT&CK tactics, allowing users to tailor simulations to their environment while ensuring compliance with security protocols. By leveraging these tests, organizations can proactively enhance their detection capabilities, address visibility gaps, and prepare for real-world threats effectively

The new site provides several long-requested feature additions such as an easier method to execute the sometimes complex command lines in your environment, more detailed searching and filtering capabilities, and a generally more streamlined interface. This convenient interface ensures that even a casual user can learn about and launch tests in their own environment to help improve their security posture.

Previous posts on Att&ck Matrix

3 ISO 27001:2022 Controls That Help Secure Your Cloud Services

Nov 22 2024

Significance of ISO 27017 and ISO 27018 for Cloud Services

Category: Cloud computing — disc7 @ 9:26 am

ISO 27017 and ISO 27018 are critical standards for enhancing information security, specifically in cloud environments.

ISO 27017: This standard provides guidelines for information security controls in cloud services. It extends the general ISO 27001 framework to address cloud-specific risks, such as shared resources, multi-tenancy, and data location. It offers recommendations for both cloud service providers (CSPs) and customers to ensure the security of cloud infrastructure, operations, and data. Key areas include responsibilities of CSPs, customer monitoring, and cloud-specific risk management.
ISO 27018: This standard focuses on protecting Personally Identifiable Information (PII) in cloud computing environments. It ensures CSPs comply with privacy laws and practices by offering controls specifically tailored for PII processing. These include requirements for data access, consent management, incident notification, and restricting data usage for marketing without explicit approval. It promotes trust by addressing privacy in a structured and transparent way.

Together, these standards build confidence in cloud adoption by mitigating risks associated with data security and privacy in shared digital ecosystems. They are particularly valuable for organizations handling sensitive data, such as financial institutions and healthcare providers.

Cloud Security Toolkit – ISO 27017 & ISO 27018

Cloud Security Toolkit – Start the journey to ISO 27017 and ISO 27018 compliance for Cloud services security with customizable templates, documents, policies and records.
Designed to integrate with our ISO 27001 DocumentKits toolkit to ensure you have complete control over the security of your Cloud services.
Get professional guidance and become an expert in securing your Cloud services, putting you fully in control of managing your information security.
Guarantee full coverage of ISO 27017 and ISO 27018 with comprehensive documentation covering topics including backup and restoration, compliance checking, information security planning and risk assessments.
Reduce your implementation costs and time spent generating your documentation.
Get compliant and stay compliant with more than 500 free annual updates.
Benefit from using the world’s only fully Cloud-based toolkit platform, making collaboration and accessibility easier than ever.
This is an annual subscription product, however, you can cancel at any time. (T&Cs apply)

Previous posts on cloud computing

Tags: cloud services, CSP, iso 27017, ISO 27018

Comments (6)

Nov 22 2024

Researchers crack RSA and AES data encryption

Category: cyber security,Data encryption,Information Security — disc7 @ 7:19 am

For the first time ever researchers crack RSA and AES data encryption

Chinese scientists reveal D-Wave’s quantum computers can break RSA encryption, signaling an urgent need for new cryptography solutions.

A group of Chinese researchers has successfully cracked RSA and AES encryption using D-Wave quantum computers. This breakthrough marks the first time such widely used encryption methods have been defeated. RSA, used in digital security protocols like HTTPS, relies on the difficulty of factoring large prime numbers. AES, on the other hand, protects sensitive data by converting it into unintelligible code. Both encryption methods are foundational to modern cybersecurity and global data protection systems.

The researchers employed a combination of advanced quantum computing and innovative algorithms to break the encryption. Quantum computers, unlike classical systems, process information using quantum bits (qubits), enabling parallel computations at an unprecedented scale. This capability makes them uniquely suited to solving problems like factoring large numbers or solving complex mathematical challenges—processes essential for breaking RSA and AES.

This achievement signals an urgent need for post-quantum cryptography, which can withstand quantum attacks. Governments and technology organizations worldwide are now accelerating the development of cryptographic systems designed for this new era. This breakthrough emphasizes the importance of adopting quantum-resistant encryption to ensure long-term security for sensitive information in areas like banking, healthcare, and national defense.

The implications of this research extend beyond encryption. Quantum computing’s power could revolutionize fields such as medicine, artificial intelligence, and materials science. However, it also presents significant challenges to current cybersecurity practices. Researchers and policymakers must urgently address these dualities to harness quantum computing’s potential while mitigating its risks.

You can access the details here

The value of quantum-resistant cryptography, post-quantum cryptography, and decentralized technologies just skyrocketed.

The research team’s experiments focused on leveraging D-Wave’s quantum technology to solve cryptographic problems. (CREDIT: DWave)

Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security

Advancing Cyber Security Through Quantum Cryptography

Tags: PQC, QuantumComputing, Web3

Nov 21 2024

How to Create a Strong Security Culture

Category: Security Awareness — disc7 @ 12:45 pm

Building a robust cybersecurity culture within the workplace requires a comprehensive approach that integrates technical measures, employee training, and leadership commitment. Organizations must prioritize educating their workforce on cybersecurity risks and best practices, emphasizing their role in safeguarding sensitive data. Practical measures include implementing regular staff awareness training and fostering a proactive attitude toward identifying and reporting threats

A successful cybersecurity culture hinges on leadership involvement. Executives should model the importance of cybersecurity by prioritizing it in organizational strategies and communications. This leadership sets the tone for employees, demonstrating that security is not just an IT issue but a company-wide priority. Encouraging cross-departmental collaboration helps embed cybersecurity in every aspect of the business

Technology and policy also play vital roles. Organizations should maintain updated cybersecurity policies tailored to their specific risks, covering areas like secure password practices, remote access controls, and patch management. Regular reviews of these policies ensure they evolve with emerging threats and business changes, reinforcing their relevance and effectiveness

Lastly, fostering a culture of accountability and openness is critical. Employees should feel encouraged to report mistakes or incidents without fear of blame, as honest communication allows for quick and effective responses. Investing in ongoing training, including simulated phishing exercises, can reinforce vigilance and adaptability against evolving threats

For more details on the topic here

But to ensure that all staff truly take note of security and apply the knowledge gained from any staff awareness training, security should be embedded in your organization’s culture.

“As cyber security leaders, we have to create our message of influence because security is a culture and you need the business to take place and be part of that security culture.”

– Britney Hommertzheim

Build a security culture

Previous security awareness posts

Tags: security culture

The Risk Assessment Process and the tool that supports it

Nov 20 2024

3 ISO 27001:2022 Controls That Help Secure Your Cloud Services

Category: Cloud computing,Information Security,ISO 27k — disc7 @ 12:52 pm

The article highlights three critical controls from ISO 27001:2022 to enhance cloud security, providing organizations with guidance on how to protect sensitive data stored in the cloud effectively:

Contractual Assurance: Control 5.10 emphasizes acceptable use and handling of information, particularly third-party assets like cloud services. It stresses the importance of establishing contractual agreements with cloud providers to ensure data security. Organizations should verify providers’ compliance with standards like ISO 27001 or other independent certifications, check for business continuity guarantees, and ensure compliance with regulations like GDPR or PCI DSS where applicable.
Cloud-Specific Policies: Control 5.23 introduces the need for processes and policies tailored to cloud services. These should cover the acquisition, use, management, and exit strategies for cloud services. Organizations are advised to define security requirements and clarify roles, responsibilities, and controls between the organization and the provider. Policies should also include handling incidents and outlining exit procedures to maintain security throughout the service lifecycle.
Extending ISMS: While ISO 27001:2022 offers foundational controls, organizations can enhance their information security management system by adopting supplementary standards like ISO 27017 (focused on cloud-specific controls) and ISO 27018 (privacy in cloud services). However, these extensions currently align with the older ISO 27001:2013 Annex A, necessitating careful integration with updated frameworks.

These controls underscore the importance of robust policies, contractual due diligence, and clear delineation of responsibilities to secure cloud environments effectively. More details can be found here.

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

The Risk Assessment Process and the tool that supports it

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: cloud services, ISO 27001 2022

Comments (1)

Nov 19 2024

Choosing the Right ISO 27001 Certification Body

Category: ISO 27k — disc7 @ 3:45 pm

A Strategic Guide

This guide emphasizes the importance of choosing the right certification body for ISO 27001 certification. Key points include:

Why the Choice Matters:

Credibility: A recognized certification body adds legitimacy.
Expertise: Industry-specific knowledge ensures relevant audits.
Global Recognition: Important for organizations with international reach.
Rigorous Audits: Ensures compliance and resilience.

Factors to Consider:

Accreditation: Look for reputable accreditations (e.g., ANAB, UKAS, IAF).
Industry Expertise: Ensure familiarity with your sector’s needs.
Global Reach: Necessary for multinational operations.
Reputation: Verify through reviews and recommendations.
Cost vs. Quality: Prioritize quality to avoid re-certification issues.

Recommended Certification Bodies:

TÜV SÜD
Bureau Veritas
DNV GL
BSI
UL

Practical Tips:

Request multiple proposals for comparison.
Interview representatives to gauge fit.
Check references and past client experiences.
Align the choice with your business needs.

The guide stresses that selecting the right body ensures long-term success and strengthens your ISMS’s value. You can access the full guide here

Selecting the right certification body for ISO 27001 can turn your certification into a strategic advantage, enhancing your security framework and boosting your brand’s reputation. A thoughtful decision ensures long-term success and resilience.

Feel free to contact us to explore ISO 27001 strategies tailored to your organization’s needs!

What will the certification auditor ask regarding risk assessment and treatment?

During the audit, an auditor might ask for the following evidence regarding ISO 27001 clause 6.1 Actions to address risks and opportunities:
1. The risk assessment methodology.
2. The report about the performed risk assessment and treatment, together with the list of all the risks.
3. If each risk has impact, likelihood, level of risk, and risk owner listed, and whether it is considered acceptable.
4. If each unacceptable risk has been treated with at least one option; if the option is decreasing the risk, then the risk needs to have appropriate controls selected.
5. If the selected controls are marked as applicable in the Statement of Applicability.
6. If you have planned the implementation of your controls through the Risk Treatment Plan.
7. If the risk owners have accepted the Risk Treatment Plan and the residual risks.

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: ISO 27001 Certification Body

OWASP updated 2025 Top 10 Risks for Large Language Models (LLMs), a crucial resource for developers, security teams, and organizations working with AI.

Nov 19 2024

Threat modeling your generative AI workload to evaluate security risk

Category: AI,Risk Assessment — disc7 @ 8:40 am

AWS emphasizes the importance of threat modeling for securing generative AI workloads, focusing on balancing risk management and business outcomes. A robust threat model is essential across the AI lifecycle stages, including design, deployment, and operations. Risks specific to generative AI, such as model poisoning and data leakage, need proactive mitigation, with organizations tailoring risk tolerance to business needs. Regular testing for vulnerabilities, like malicious prompts, ensures resilience against evolving threats.

Generative AI applications follow a structured lifecycle, from identifying business objectives to monitoring deployed models. Security considerations should be integral from the start, with measures like synthetic threat simulations during testing. For applications on AWS, leveraging its security tools, such as Amazon Bedrock and OpenSearch, helps enforce role-based access controls and prevent unauthorized data exposure.

AWS promotes building secure AI solutions on its cloud, which offers over 300 security services. Customers can utilize AWS infrastructure’s compliance and privacy frameworks while tailoring controls to organizational needs. For instance, techniques like Retrieval-Augmented Generation ensure sensitive data is redacted before interaction with foundational models, minimizing risks.

Threat modeling is described as a collaborative process involving diverse roles—business stakeholders, developers, security experts, and adversarial thinkers. Consistency in approach and alignment with development workflows (e.g., Agile) ensures scalability and integration. Using existing tools for collaboration and issue tracking reduces friction, making threat modeling a standard step akin to unit testing.

Organizations are urged to align security practices with business priorities while maintaining flexibility. Regular audits and updates to models and controls help adapt to the dynamic AI threat landscape. AWS provides reference architectures and security matrices to guide organizations in implementing these best practices efficiently.

*Threat composer threat statement builder*

You can write and document these possible threats to your application in the form of threat statements. Threat statements are a way to maintain consistency and conciseness when you document your threat. At AWS, we adhere to a threat grammar which follows the syntax:

A [threat source] with [prerequisites] can [threat action] which leads to [threat impact], negatively impacting [impacted assets].

This threat grammar structure helps you to maintain consistency and allows you to iteratively write useful threat statements. As shown in Figure 2, Threat Composer provides you with this structure for new threat statements and includes examples to assist you.

You can read the full article here

Proactive governance is a continuous process of risk and threat identification, analysis and remediation. In addition, it also includes proactively updating policies, standards and procedures in response to emerging threats or regulatory changes.

How CISOs Can Drive the Adoption of Responsible AI Practices

The CISO’s Guide to Securing Artificial Intelligence

AI in Cyber Insurance: Risk Assessments and Coverage Decisions

Hackers will use machine learning to launch attacks

To fight AI-generated malware, focus on cybersecurity fundamentals

4 ways AI is transforming audit, risk and compliance

AI security bubble already springing leaks

Could APIs be the undoing of AI?

The Rise of AI Bots: Understanding Their Impact on Internet Security

Comprehensive vCISO Services

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: LLM, OWASP, Threat modeling

Comments (5)

Nov 18 2024

WinRAR and ZIP File Exploits: This ZIP File Hack Could Let Malware Bypass Your Antivirus

Category: Antivirus,Malware — disc7 @ 9:16 am

WinRAR and ZIP File Exploits: This ZIP File Hack Could Let Malware Bypass Your Antivirus

A new vulnerability affecting WinRAR and ZIP file extraction tools has been identified, which can allow malware to bypass antivirus programs. Attackers exploit this by embedding malicious scripts within specially crafted ZIP or RAR files, which can evade detection and execute upon extraction. The flaw takes advantage of how some extraction tools handle paths and permissions, potentially leading to unauthorized access and execution. Users are advised to update their software and exercise caution with untrusted compressed files to mitigate the risk of such attacks.

You can read the full article here

Cyber Resilience – Defence-in-depth principles. Winner of Best Cyber Book of the Year at the Real Cyber Awards 2023.

Understand how information security standards can improve your organization’s security and set it apart from competitors with this introduction to the 2022 updates of ISO 27001 and ISO 27002.

Previous posts on malwares

Tags: Cyber Resilience, winrar, zip file

Tor: From the Dark Web to the Future of Privacy

Nov 15 2024

Law Enforcement Deanonymizes Tor Users

Category: Anonymous — disc7 @ 9:54 am

Law Enforcement Deanonymizes Tor Users

The German police have successfully deanonymized at least four Tor users. It appears they watch known Tor relays and known suspects, and use timing analysis to figure out who is using what relay.

Tor has written about this.

Tags: Deanonymizes, Tor Users