InfoSec and Compliance – With 20 years of blogging experience, DISC InfoSec blog is dedicated to providing trusted insights and practical solutions for professionals and organizations navigating the evolving cybersecurity landscape. From cutting-edge threats to compliance strategies, this blog is your reliable resource for staying informed and secure. Dive into the content, connect with the community, and elevate your InfoSec expertise!
Jan 27 2019
Facebook Messenger, Instagram and WhatsApp are to be integrated under the hood so that messages will travel across a unified communications platform. So, what are the implications on privacy for users of these services?
Source: How WhatsApp Merger With Facebook Messenger Puts Your Privacy At Risk
Jan 25 2019
UK-based Fidus Information Security was targeted by angler phishing
Source: How a Security Vendor Tricked Social Media Phishers
Subscribe to DISC InfoSec blog by Email
Jan 25 2019
Malware can spread much more easily on obsolete platforms, warns security body. With less than a year until the end of Windows 7 support, don’t get caught out.
Source: Windows 7 migration warning: Plan now to avoid security worries later | ZDNet
Subscribe to DISC InfoSec blog by Email
Jan 24 2019
Google Alphabet incubator Jigsaw says knowing how to spot a phish plus two-factor authentication are the best defenses against falling for a phishing email.
Source: Google Creates Online Phishing Quiz
Subscribe to DISC InfoSec blog by Email
Jan 24 2019
More than 70% of tech professionals said security spending has increased in the past year, according to a Ping Identity report.
Source: Security is the no. 1 IT barrier to cloud and SaaS adoption
Jan 23 2019
Follow the guidance in this CIS document to configure Microsoft 365 security settings to the level that suits your organization.
Source: Center for Internet Security releases Microsoft 365 benchmarks
Jan 23 2019
Here we have great news for all iPhone Jailbreak lovers and concerning one for the rest of iPhone users.
A Chinese cybersecurity researcher has today revealed technical details of critical vulnerabilities in Apple Safari web browser and iOS that could allow a remote attacker to jailbreak and compromise victims’ iPhoneX running iOS 12.1.2 and before versions.
Source: Chinese Hacker Publishes PoC for Remote iOS 12 Jailbreak On iPhone X
Jan 22 2019
Data belonging to online casinos found exposed online on unprotected Elastic search instance, it includes info on 108 million bets and user details
Source: Did you win at online casinos? Your data might have had exposed online
Jan 22 2019
Patching vulnerabilities is often seen as a key element of keeping systems secure. But a new report suggests businesses could be ‘smarter’ in their patching regimes and prioritize the i…
Source: Businesses can safely delay patching most vulnerabilities
Jan 21 2019
A new Rocke Group malware sample “captured” and analysed by Palo Alto Networks Unit 42 has adopted code to uninstall five cloud security protection products
Source: New Rocke Group Malware Turns off Your Cloud Security Tools
Jan 21 2019
A micropatch is now available for a zero-day vulnerability in Windows that allows unauthorized read access with the highest privileges to any file on the operating system.
Source: Windows Zero-Day Bug That Lets Attackers Read Any File Gets Micropatch
Jan 21 2019
An Iranian developer is promoting on a Telegram hacking channel the BlackRouter ransomware through a Ransomware-as-a-Service model.
Source: Iranian developer advertised BlackRouter Ransom-as-a-Service
Jan 20 2019
Cloud security experts weigh in with the practices and tools they prefer to monitor and measure security metrics in the cloud.
Source: 8 Tips for Monitoring Cloud Security
Jan 19 2019
Cyber security is among the essential subjects to boards, alongside business strategy and leadership. Your compelling case to gain an investment is now here!
Source: 3 Compelling Reasons To Invest In Cyber Security – Part 3
Sep 25 2018
A privacy notice is a public statement of how your organisation applies data protection principles to processing data
Articles 12, 13 and 14 of the GDPR outline
The GDPR says that the information you provide must be:
The privacy notice should address the following to sufficiently inform the data subject:
Below is an example of a customisable privacy notice template, available from IT Governance here.
Example of the privacy notice template available to purchase from IT Governance
If you are looking for a complete set of GDPR templates to help with your compliance project, you may be interested in the market-leading EU GDPR Documentation Toolkit. This toolkit is designed and developed by expert GDPR practitioners
; and
Sep 24 2018
By Laura Downes
Since the EU’s GDPR (General Data Protection Regulation) came into effect in May 2018, demand for DPOs (data protection officers) has increased. The Regulation stipulates that certain organisations must appoint a DPO to support their GDPR compliance
Your organisation will need to appoint a DPO
The GDPR does not stipulate the level of experience a DPO must have, meaning some organisations might appoint an internal team member who does not have the experience or qualifications required, leaving them wide open to error.
Why you should consider outsourcing your DPO
Suitably skilled and experienced DPO candidates are hard to find. Outsourcing the role not only satisfies the requirements of the GDPR but also ensures your organisation is employing proper data handling and privacy policies. Furthermore, there is no conflict of interest between the DPO and other business activities.
An external DPO can work for your organisation on a fixed-fee or a per-hour basis. Signing up to a DPO service
DPO as a service (GDPR)
IT Governance’s annual subscription DPO service offers you hands-on support from one of our qualified DPOs, who will serve as independent data protection
; 
) and the manner of their implementation and outcomes; 
for all data protection issues
; 
.
Sep 21 2018
By Nick Calver @ITG
Drafting detailed data protection policies and documentation is vital for improving security for your customers, stakeholders and brand because it shows your understanding and commitment to the PCI DSS (Payment Card Industry Data Security Standard). From policy, to procedure, to configuration standard, a significant proportion of PCI DSS
Deploying security technologies can only go so far in protecting an organisation and helping maintain compliance.
Verizon’s 2018 Data Breach Investigations Report identified that almost 1 in 5 data breaches (17%) were the result of human error.
Policies are needed to address the weak link in security
PCI DSS compliance requires that all merchants and service providers document the processes and procedures they put in place. These policies and procedures can then serve as a guide, following the 12 requirements of the PCI DSS, from which you and your QSA (Qualified Security Assessor
The policies might address:
Information security
Formal security awareness
Incident response
Nothing here should surprise an experienced security professional. The policy requirements are basic information security best practices. Therefore, when structuring your PCI policy
Increase your employees’ knowledge of the Payment Card Industry Data Security Standard (PCI DSS) and how it affects your organization with the expertise at IT Governance USA Inc.
Sep 20 2018
Credit rating agency Equifax is to be fined £500,000 by the Information Commissioner’s Office (ICO) after it failed to protect the personal data of 15 million Britons.
A 2017 cyber-attack
The compromised systems were also US-based.
But the ICO ruled Equifax’s UK branch had “failed to take appropriate steps” to protect UK citizens’ data
It added that “multiple failures” meant personal information had been kept longer than necessary and left vulnerable.
Originally, Equifax reported that fewer than 400,000 Britons had had sensitive data exposed in the breach – but it later revealed that the number was nearly 700,000.
A further 14.5 million British records exposed would not have put people at risk, the company added last October.
The ICO, which joined forces with the Financial Conduct Authority
Equifax had also been warned about a critical vulnerability in its systems by the US Department of Homeland Security in March 2017, the ICO revealed.
And appropriate steps to fix the vulnerability were not taken, according to the ICO.
Because the breach happened before the launch of the EU’s General Data Protection Regulation
And the fine of £500,000 is the highest possible under that law.
“The loss of personal information, particularly where there is the potential for financial fraud, is not only upsetting to customers, it undermines consumer trust in digital commerce
“This is compounded when the company is a global firm whose business relies on personal data.”
An Equifax spokesperson said the firm was “disappointed in the findings and the penalty”.
“As the ICO makes clear in its report, Equifax 
“The criminal cyber-attack
By BBC.com
Sep 19 2018
By Kevin Townsend
Never-ending breaches
priorities.
A recent survey by security firm Varonis highlights that business and security are not fully aligned; and while security teams
The problem is well-known: security and business speak different languages. Since security is the poor relation of the two, the onus is absolutely on security to drive the conversation in business terms. When both sides are speaking the same language, aligning security controls 
Well-presented metrics
Using metrics to align Security and Business: Information security metrics
SecurityWeek spoke to several past and present CISO
Demolishing the Tower of Babel
“While some Board members may be aware of what firewalls are,” comments John Masserini: CISO at Millicom Telecommunications, “the vast majority have no understanding what IDS
CISOs, on the other hand, understand risk but do not necessarily understand which parts of the business are at most risk at any time. Similarly, business leaders do not understand how changing cybersecurity threats
The initial onus is on the security lead to better understand the business side of the organization to be able to deliver meaningful risk management metrics
The key and most common difficulty is in finding and presenting the initial metrics to get the ball rolling. This is where the different ‘languages’ get in the way. “The IT department led by the CIO typically must maintain uptime for critical systems and support transformation initiatives that improve the technology used by the business to complete its mission,” explains Keyaan Williams, CEO at CLASS-LLC. “The Security department led by the CISO typically must maintain confidentiality, integrity, and availability of data
Drew Koenig, consultant and host of the Security in Five podcast, sees the same basic problem. “In security there tends to be a focus on the technical metrics
Williams sees the problem emanating from a lack of basic business training in the academic curriculum that supports IT and security degrees. “The top management tool in 2017 was strategic planning,” he said. “Strategic planning is often listed as one of the top-five tools of business leaders. How many security leaders understand strategic planning and execution enough to ensure their metrics contribute to the strategic initiatives of the organization?”
It is not up to the business leaders to learn about security. “The downfall for many CISOs in the past is believing that business needs to understand security,” adds Candy Alexander, a virtual CISO
for more on this article: CISOs and the Quest for Cybersecurity Metrics Fit for Business
