InfoSec Compliance & AI Governance For over 20 years, DISC InfoSec has been a trusted voice for cybersecurity professionals—sharing practical insights, compliance strategies, and AI governance guidance to help you stay informed, connected, and secure in a rapidly evolving landscape.
Jul 21 2019
Get two risk management experts in a room, one financial and the other IT, and they will NOT be able to discuss risk.
Source: When It Come Down To It, Cybersecurity Is All About Understanding Risk
An Overview of Risk Assessment According to
ISO 27001
Jul 19 2019
The Small Business Cybersecurity Assistance Act may provide business owners with access to government-level tools to secure small business against attacks.
Source: The Problem With the Small Business Cybersecurity Assistance Act
The House passes Small Business Administration (SBA) Cyber Awareness Act (H.R. 2331), which requires the SBA to expand its ability to combat cyber threats.
Source: Small Business Cybersecurity: House Passes Key Bill – MSSP Alert
Jul 07 2019
How to Sell Cyber Security
[pdf-embedder url=”https://blog.deurainfosec.com/wp-content/uploads/2019/07/Talking-cybersecurity-to-board.pdf” title=”Talking cybersecurity to board”]
Todd Fitzgerald’s book,
Information Security Governance Simplified:
From the Boardroom to the Keyboard, presents 15 chapters of advice and real-world experience on how to handle the roll out of an effective program …. Todd has taken the time to include for the reader some practical security considerations for managerial, technical, and operational controls. This is followed up with a discussion on how legal issues are impacting the information security program.
#TomPeltier, CISSP
Jul 05 2019
PowerShell is a valuable tool for automating Windows administration tasks, including laborious security chores
Source: 10 essential PowerShell security scripts for Windows administrators
Defending Against PowerShell Attacks
Jul 03 2019
SEIA bill, inspired by the 2015 cyber-attack on Ukraine’s power grid, passes Senate.
Source: US wants to isolate power grids with ‘retro’ technology to limit cyber-attacks | ZDNet
US power grid increasingly vulnerable to cyber threats
Jul 01 2019
Says bye bye to #BigBlue
Bruce Schneier: “Click Here to Kill Everybody” | Talks at Google
Jun 27 2019
Source: Western intelligence hacked ‘Russia’s Google’ Yandex to spy on accounts
Jun 25 2019
Over 2,000 devices have been bricked in the span of a few hours. Attacks still ongoing.
Source: New Silex malware is bricking IoT devices, has scary plans | ZDNet
How dangerous are IOT devices? | Yuval Elovici | TEDxBGU
Jun 24 2019
OpenSSH introduces a new feature to prevent Side-Channel attacks, latest release encrypts secret keys in memory as temporary solution.
Source: OpenSSH introduces a security feature to prevent Side-Channel Attacks
Jun 20 2019
Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials.
Source: Seth : Perform A MitM Attack From RDP Connections
Jun 19 2019
Researchers discovered a new JavaScript-based and modular downloader Trojan camouflaged and distributed to targets in the form of game cheats via websites owned by its developers.
Source: Hackers Disguise New JavaScript-Based Trojan as Game Cheat
Worst JavaScript Flaws That Hackers Love To Abuse
Jun 17 2019
The Cybersecurity and Infrastructure Security Agency (CISA) published an alert for Windows users to patch the critical severity Remote Desktop Services (RDS) RCE security flaw dubbed BlueKeep.
Source: U.S. Govt Achieves BlueKeep Remote Code Execution, Issues Alert
How to check if a target is vulnerable to the new RDP vulnerability (BlueKeep).
Jun 15 2019
In the report, the cybersecurity company Symantec claims that a Chinese hacker group associated with Chinese government intelligence conducted a hacking campaign using a tool that at the time was only known to be the property of the NSA.
Source: Chinese spies stole NSA hacking tools, report finds
Jun 12 2019
Researchers discovered two vulnerabilities in Alaris Gateway Workstations that are used to deliver fluid medication. One of them is critical and an attacker could leverage it to take full control of the medical devices connecting to it.
Source: Critical Bug in Infusion System Allows Changing Drug Dose in Medical Pumps
Healthcare privacy and security
Jun 11 2019
Zydra is a file password recovery tool and Linux shadow file cracker. It uses the dictionary search or Brute force method for cracking passwords.
Source: Zydra : Password Recovery Tool & Linux Shadow File Cracker
Jun 10 2019
Security Awareness writer Keil Hubert describes a mysterious email message that could well have been an insidiously clever spear phishing attack.
Source: A guide to phishing emails and how they work -TEISS® : Cracking Cyber Security
This is what happens when you reply to spam email
Jun 09 2019
Cybercriminal group Carbanak has stolen hundreds of millions of dollars from financial institutions. Here’s a detailed analysis by Bitdefender of an attack on one bank.
Source: From phish to network compromise in two hours: How Carbanak operates
Jun 02 2019
Microsoft allows you to download the latest Windows 10 ISOs from their site, but only if you are using a non-Windows browser user agent. This article will explain how to change your user agent in Chrome and Edge so you can download an ISO instead of using the Windows 10 Media Creation Tool.
Source: How to Download a Windows 10 ISO By Impersonating Other Devices
Jun 01 2019
ESET researchers show how, in a bid to evade detection, the Turla group leverages PowerShell scripts to inject malware directly into memory.
Source: A dive into Turla PowerShell usage | WeLiveSecurity
