Weekly #cybersecurity digest to your inbox

Subscribe for our weekly digest and get each Friday the most important cyber security news, list of upcoming free webinars and a summary of Cyberday development to your inbox.
Thanks! See you in your inbox on Fridays. :)
Unfortunately something went wrong. You can contact us at team@cyberdayai.

ISO 27001 and ISO 9001: Differences, how they work together and benefits of combining

Learn about the synergy between ISO 27001 and ISO 9001. Learn how integrating these standards enhances information security, quality management, and overall operational efficiency, using case examples and actionable insights.

article

6.6.2024

NIS2 Compliance: Top 5 Reasons for the Manufacturing Sector

The article highlights the critical importance for manufacturers to comply with NIS2 regulations to safeguard their operations and infrastructure from cyber threats.

article

31.5.2024

Cannes Hospital data breach, the impact of AI and NIS2 evolution: the Cyberday product and news round-up 5/2024 🛡️

May's Product and News Update presents the new monthly ISMS reports as well as the Metrics page. Other topics include Cyberday's new framework DORA and recent news around the world.

article

17.5.2024

6 ways to assess security work effectiveness

Evaluating the effectiveness of your cybersecurity involves examining the adequacy of your existing security measures. This process helps you identify your current security status and determine the necessary actions to enhance and fortify.

article

3.5.2024

System acquisition and development in NIS2: Suggested best practices

Get tips on securely acquiring and developing systems with a focus on ISO 27001, helping meet NIS2 requirements. Post explains key aspects like secure coding, acquiring secure applications and testing or publishing changes in a controlled manner.

article

16.4.2024

Continuity management in NIS2: Benchmark measures for business continuity and backups with ISO 27001

This post offers insight on complying with NIS2's continuity and backup requirements using ISO 27001's best practices. It guides you through continuity planning, backup processes, challenges, and achieving compliance effectively.

article

12.4.2024

HR security in NIS2: Best practices for compliance

Learn how HR drives ISO 27001 and NIS2 compliance through security training, roles, and policies essential for building a strong information security culture.

article

5.4.2024

Access control & MFA in NIS2: Build a solid foundation with ISO 27001 controls

What are the requirements for access control and MFA in NIS2 and ISO 27001 and how can they be implemented successfully? Learn more about the controls, requirements, best practices and how to overcome potential challenges in this blog post.

article

4.4.2024

TrickBot Now Steals Windows Active Directory Credentials

A new module for the TrickBot trojan has been discovered that targets the Active Directory database stored on compromised Windows domain controllers. [...]

Go to article at
15.5.2020
Insider Attacks

Severe Auth Bypass and Priv-Esc Vulnerabilities Disclosed in OpenBSD

OpenBSD, an open-source operating system built with security in mind, has been found vulnerable to four new high-severity security vulnerabilities, one of which is an old-school type authentication bypass vulnerability in BSD Auth framework. Here's a brief explanation of all four security vulnerabilities in OpenBSD—a free and open-source BSD-based Unix-like operating system—along with their assigned CVE identifiers The authentication bypass vulnerability resides in the way OpenBSD's authentication framework parses the username supplied by a user while logging in through smtpd, ldapd, radiusd, su, or sshd services. Using this flaw, a remote attacker can successfully access vulnerable services with any password just by entering the username as "-schallenge" or "-schallenge: passwd," and it works because a hyphen (-) before username tricks OpenBSD into interpreting the value as a command-line option and not as a username.

Go to article at
15.5.2020
Unpatched Vulnerabilities

RDP and VPN use skyrocketed since coronavirus onset

The use of remote access technologies like RDP (Remote Desktop Protocol) and VPN (Virtual Private Network) has skyrocketed 41% and 33%, respectively, since the onset of the COVID-19 outbreak.

Go to article at
15.5.2020
Man-in-the-Middle Attacks

Fake Tech Support Company Dupes 40K Victims Out of $8 Million

A college drop-out has admitted using malware and a fake tech support company to con 40,000 victims out of millions of dollars.

Go to article at
15.5.2020
Phishing

Hackers Using APTs To Exploit Covid-19 Fears

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency and the U.K. National Cyber Security Centre recently released a rare joint statement warning of the rise of APT groups using phishing campaigns exploiting the world’s fears about COVID-19. “Their goals and targets are consistent with long-standing priorities such as espionage and ‘hack-and-leak’ operations,”.. The post Hackers Using APTs To Exploit Covid-19 Fears appeared first on Security Boulevard.

Go to article at
15.5.2020
Malware

Netflix warned to step up after dormant credentials were hijacked by hackers

NETFLIX cordcutter-cutters are demanding answers after it emerged that some former users' accounts were being reactivated by criminals. An investigation by Auntie Beeb's You and Yours programme found that if someone finds a dormant Netflix account and is able to get into it, the provided bank details from the subscription are still listed, meaning that all the hacker has to do is start watching, whilst the original customer pays. Plus, of course, if the criminal then changes the password, then that's it, the account is locked out for the legitimate account holder. In order to give leavers an easy way of rejoining the service, accounts that are deactivated have all their details, including bank account info, stored for ten months from the date of leaving, unless the customer specifically asks Netflix to delete them sooner. For its part, Netflix has made a number of appropriate purring noises and advises anyone who notices unusual or unauthorised use of their account, or erroneous charges, to contact customer service immediately.

Go to article at
15.5.2020
Password Attacks

Cloud-based collaboration tools are a major driver of data exfiltration

Cloud-based collaboration technologies and workforce turnover have become major drivers of data exfiltration as insider threat programs fail to keep pace with today’s digital workplace, a Code42 survey reveals. Nearly 5,000 knowledge workers at companies with more than 1,000 employees in the U.S., U.K. and Germany were surveyed. “When it comes to data loss, leak and theft, for too many companies, the inside is their blindside,” said Joe Payne, Code42’s president and CEO. “Insider threat … More → The post Cloud-based collaboration tools are a major driver of data exfiltration appeared first on Help Net Security.

Go to article at
15.5.2020
Insider Attacks

Faking fingerprints — doable, but hard

Researchers found a way to create fake fingerprints to fool many devices, although it took a lot of effort.

Go to article at
15.5.2020
Outdated Access Rights

MITRE ATT&CK: Endpoint denial of service

Introduction Denial-of-Service (DoS) attacks have been around since the 1970s, and they can be downright paralyzing to an organization. Not only does it shut down the ability to use a targeted... Go on to the site to read the full article The post MITRE ATT&CK: Endpoint denial of service appeared first on Security Boulevard.

Go to article at
15.5.2020
Denial-of-Service Attacks