Andreas Weinberger

THE RISK OF HEAT MAPS: How They Lead to False Security in Cyber Risk Management Heat maps, often used to visualize risk assessments in various shades of color, are popular in risk management. They offer a seemingly simple way to display risk levels and are used by executives and decision-makers as a quick overview tool. However, the convenience they offer often comes at the cost of depth and accuracy, leading to potentially misguided decision-making. In this article, published recently in the eGUIDE, Tobias Faiss explores 13 ways heat maps can do more harm than good in risk management. Come to the HUB to access Tobias' article in Vol 700 of the Continuity eGUIDE >> https://lnkd.in/ekg3wHNq Other practical resources and news in Vol 700 >> · Good Practices on Disaster Resilient Infrastructure · Let’s Do Great Things Together in 2025! · BCI Horizon Scan Report 2024 · Organizational Vulnerabilities due to 3rd-party Failures · Awards Winners at the 72nd IAEM Annual Conference Visit the Risk and Resilience HUB to connect, collaborate and build resilient organizations. https://lnkd.in/e4BVs58 #supplychainvulnerabilities, #heatmaps, #cyberriskmanagement, #risksin2025, #collaboration

2

Artificial Intelligence & Cybersecurity: How to Reconcile Them? Securing AI is the next challenge for CISOs. This is also the topic of one of Cybercompass’s webinars, scheduled for September 25 at 11:30 AM. ✅ What are the major risks to cover? ✅ What is the current state of the regulatory and normative framework? #IAact ✅ How to secure an application using AI? 🧭 Cybercompass, our new 100% online event, is your #Cyber compass! Its goal is to help CISOs navigate between threats and innovations, and to best prepare their 2025 roadmap. Short and impactful webinars! ➡️ Register via the link in the first comment.

5

1 Comment

#AI is the double-edged sword in #cybersecurity ⚔️ What happens when this innovation becomes a vulnerability? Jasmin Landry, Security Researcher and HackerOne Pentester put it together quite nicely (check out the quote in the post ⬇️) Two key fronts to consider here: 1️⃣ Security for AI: managing the risks that come with AI deployments. 2️⃣ AI for Security: leveraging AI to detect and manage vulnerabilities faster than ever before. But here’s the kicker: even with cutting-edge AI tools, human expertise is still critical to ensuring trustworthy, secure innovation. In our recent deep dive into AI and vulnerability management, we highlight how security teams are adapting to stay ahead of threats—and what it means for the future. 💬 What’s your take?

8

What is the role of the MITRE ATT&CK and similar frameworks in Identity Security? Statement from Gil Kirkpatrick, Semperis #ActiveDirectory #ADSecurity #Identity #IdentityProtection #IdentityThreatProtection #PurpleKnight #Cybersecurity Guido Grillenmeier Uwe Scholz Oliver Keizers #IdentitySecurity #Verzeichnisdienst #Identitätssicherheit #Cyberresilience #ITDR #EntraID https://lnkd.in/dsttwD7j

6

🚨 #Cybersecurity Alert: The German Federal Office for Information Security (BSI) has uncovered serious vulnerabilities in the social media app Mastodon and minor ones in the messenger service Matrix. 🛡️ Mastodon's version 4.1.6 was found to have two high-risk vulnerabilities, CVE-2023-46950 and CVE-2023-46951, which could allow attackers to compromise user data. Additionally, Mastodon has 22 dependencies on open-source code with critical or high security vulnerabilities. Matrix, on the other hand, had several low-risk issues, including unprotected uploaded files and a vulnerability that allows session terminations by privileged users. Both platforms lack a structured approach to identifying and correcting vulnerabilities, with code duplication suggesting untidy growth. The BSI recommends refactoring for better vulnerability management and future extensibility. This analysis is part of an ongoing project to enhance the security of open-source software used by public authorities and private users. Stay vigilant and ensure your software is up-to-date! 💻 #InfoSec #OpenSource #Mastodon #Matrix #VulnerabilityManagement #TechNews [Original source in the comments 👇]

🚨 #Cybersecurity Alert: The German Federal Office for Information Security (BSI) has uncovered serious vulnerabilities in the social media platform Mastodon and some minor ones in the messenger service Matrix. 🛡️ Key findings: - Mastodon v4.1.6 had two high-risk vulnerabilities, CVE-2023-46950 & CVE-2023-46951, allowing potential compromise of user data. - Matrix's issues were less severe but included unprotected uploaded files and session management concerns. The BSI's proactive approach to identifying and informing developers of these issues underscores the importance of regular code audits and vulnerability management. As we rely more on open-source software, such initiatives are crucial for maintaining trust and security in digital communication tools. Are you keeping your platforms secure? Share your best practices for software security below! 🔐 #InfoSec #OpenSource #DigitalSecurity #Mastodon #Matrix #VulnerabilityManagement [Original source in the comments 👇]

Hopefully you a process to frequently assess your organization's cyber risks. ⚠️ If you don't currently have process in place, and you should, here's 6 Types of Risk Assessment methodologies and their use case. 📝 Feel free to reach out if we can point you in the right direction🤝 #cybersecurity #nonprofit #riskassessment

1

The key differences between the NIST Cybersecurity Framework (CSF) version 1.1 and version 2.0 are: Expanded Scope: CSF 2.0 has dropped the "critical infrastructure" terminology, broadening its applicability to all organizations, not just those in critical sectors. New Govern Function: CSF 2.0 introduces a new "Govern" function, emphasizing the importance of cybersecurity governance, strategy, and policy alignment with organizational objectives. Enhanced Risk Management: CSF 2.0 places a stronger emphasis on risk management, with new subcategories covering risk appetite, risk tolerance, and integrating cybersecurity risk into enterprise risk management. Streamlined Structure: The categories and controls have been updated and reorganized to enhance clarity and usability, with a total of 23 categories and 108 controls in CSF 1.1 compared to the revised structure in CSF 2.0. Alignment with Other NIST Guidance: CSF 2.0 ensures alignment with other NIST publications, such as the NIST Privacy Framework and Secure Software Development Framework, promoting a more comprehensive and integrated approach to managing information-related risks. Increased Flexibility and Adaptability: CSF 2.0 maintains the framework's emphasis on flexibility and customization, allowing organizations to tailor the guidance to their specific needs and risk profiles. Join our partners for your Certified CSF Professional training. #csf #nistcsf #nist #cybersecurity #informationsecurity #datasecurity #securitycompliance

1

😱 𝗡𝗮𝘃𝗶𝗴𝗮𝘁𝗶𝗻𝗴 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗮𝗻𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁(𝗜𝗔𝗠) 𝗶𝘀 𝗮 𝗺𝗮𝘇𝗲. 𝗕𝘂𝘁 𝗶𝘁 𝗱𝗼𝗲𝘀𝗻'𝘁 𝗵𝗮𝘃𝗲 𝘁𝗼 𝗯𝗲! The concept of IAM (Identity and Access Management) can seem complex, but understanding the three basic workflows of the IAM process—identification, authentication, and authorization—doesn’t have to be daunting. Let’s simplify these concepts with an easy-to-understand story. Imagine Jonas ordered a cake from a local bakery. Over the phone, he provided all the required details—flavor, filling, icing, and decorations—to a busy bakery employee. To ensure every customer received the correct order, the bakery started using unique invoice numbers for each bill. When Jonas went to pick up his order, the bakery first needed to identify him (𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻). They did this by matching him with his unique invoice ID. This way, they knew who he was and could start the verification process. Next, the bakery needed to verify Jonas' identity (𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻). When he showed his invoice ID to the employee, they checked it against their records to confirm Jonas was indeed the person who placed the order. This step was crucial to ensure someone else does not walk away with Jonas’s cake. Finally, after his identity was verified, Jonas was granted access to his cake (𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗮𝘁𝗶𝗼𝗻). The bakery handed him the cake, confident it was going to the right person. In your organization, the same principles apply. - You are identified as a distinct user when you log in (identification). - The system then verifies that it is indeed you, often through a password, biometrics, or another method (authentication). - Once verified, you are granted access to the specific resources you need (authorization). 𝗧𝗵𝗶𝗻𝗸 𝗼𝗳 𝗶𝘁 𝗹𝗶𝗸𝗲 𝘁𝗵𝗶𝘀: 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗸𝗻𝗼𝘄𝗶𝗻𝗴 𝘄𝗵𝗼 𝘆𝗼𝘂 𝗮𝗿𝗲, 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗽𝗿𝗼𝘃𝗶𝗻𝗴 𝗶𝘁 𝗶𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝘆𝗼𝘂, 𝗮𝗻𝗱 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗴𝗲𝘁𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗿𝗶𝗴𝗵𝘁 𝗮𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝘆𝗼𝘂𝗿 𝗿𝗲𝘀𝗼𝘂𝗿𝗰𝗲𝘀—𝗷𝘂𝘀𝘁 𝗹𝗶𝗸𝗲 𝗝𝗼𝗻𝗮𝘀 𝗴𝗼𝘁 𝗵𝗶𝘀 𝗰𝗮𝗸𝗲. Hopefully, this story helps you understand the basic concepts of IAM. If you have any questions or thoughts, let us know in the comments below! 👇

3

Cybersecurity Lessons Businesses Can Learn From The Russia-Ukraine War Credits: Forbes, Stu Sjouwerman, SACP #CyberSecurity #CyberResilience #DataProtection #SwissStartUp #InfoSec #CyberCrime #DigitalTransformation #CyberResilienz #Datenschutz #Cybersécurité #RésilienceCyber #Innovation #Switzerland #CyberSicurezza https://lnkd.in/ecRgaizB

5

1 Comment

📢 New Phishing Kit Yara Rules added to our GitHub repository! 🌈 Rules which detect phishing kits targeting customers of: 📌 Nickel 📌 Royal Mail 📌 SBB CFF FFS SwissPass 📌 Wells Fargo 📌 WordPress This project now counts: 🚩 2️⃣0️⃣1️⃣ commits! 🚩 6️⃣6️⃣6️⃣ rules! 🤘 🚩 4️⃣+ years of activity

2

Welcome to the October 2024 edition of our newsletter (6.22 MB, 94 pages), sharing the latest news, advancements, and opportunities from Cyber Risk GmbH (CHE-244.099.341). Explore this month’s release for essential updates in cyber risk and compliance management. October 2024 Newsletter Highlights. 1. Cyber Law and International Security. • The Cyber Law Toolkit: A web-based resource for legal professionals at the intersection of international law and cyber operations. • Cyber Espionage Scenarios: Insights from Scenario 02, covering cyber espionage against government departments. • ‘Big Ideas Lab’ Podcast: LLNL examines strategic deterrence in national security. 2. Artificial Intelligence. • OECD–FSB Roundtable on AI in Finance: Key takeaways on the impacts and risks of AI in the financial sector. • Teaching AI Ethical Boundaries: A look into AI programming that encodes obligations and permissions into logical languages. 3. Cybersecurity Threats and Landscape. • ENISA Threat Landscape 2024: Comprehensive overview of emerging cybersecurity threats. • Operational Technology Cybersecurity Principles: Australian Cyber Security Centre’s guidelines for securing OT environments. • Cybersecurity in Railways: Key presentations from the 4th ERA-ENISA Conference. 4. Data Protection and Compliance. • Common European Data Spaces: EU’s strategy for creating shared data environments. • EFPIA Position on EHDS Regulation: The European pharmaceutical industry’s stance on opt-out clauses in health data spaces. 5. Cryptocurrency and Financial Integrity. • Fraud and Manipulation in Cryptocurrency: First-ever criminal charges for market manipulation in cryptocurrency. • Cryptocurrency Fraud in Maryland: FBI’s guidance on identifying and reporting crypto investment fraud. 6. Government Initiatives and International Collaboration. • Pact for the Future: Recent commitments from the United Nations to promote global cooperation. • Joint Cybercrime Operation: Europol and Ameripol’s collaborative efforts against cybercrime in Spain and Latin America. 7. Scientific and Technological Advances. • Quantum Entanglement at CERN: New discoveries from LHC experiments at the highest energy levels. • Generative AI in Content Creation: Meta Movie Gen and YouTube’s AI advancements for creators. 8. Awareness and Public Resources. • Cybersecurity Awareness Month: Deputy National Cyber Director celebrates opportunities in cybersecurity. • Wall of Spies Experience: A unique display of America’s espionage history and counterintelligence. Our newsletter: https://lnkd.in/dRQXY8aG

5

"𝗧𝗵𝗲 𝗰𝘆𝗯𝗲𝗿 𝘁𝗵𝗿𝗲𝗮𝘁 𝗶𝘀 𝗵𝗶𝗴𝗵𝗲𝗿 𝘁𝗵𝗮𝗻 𝗲𝘃𝗲𝗿 𝗯𝗲𝗳𝗼𝗿𝗲.“ ☠️💻️ 💡 According to the German Bundesamt für Sicherheit in der Informationstechnik (BSI) the cyber threat level in 2023 was higher than ever before. Cyber attacks do not only affect large companies - small and medium-sized organizations are also increasingly affected, as attacks are often widespread. Ransomware in particular can compromise critical business data and cause costly business interruptions. ✅ For this reason, 𝗕𝗦𝗜 has developed the "𝗖𝘆𝗯𝗲𝗿𝗥𝗶𝘀𝗶𝗸𝗼𝗖𝗵𝗲𝗰𝗸", tailor-made for SMEs. After a short interview with the key contacts, the result of the check is a standardized report that provides a quick overview of the status of information security in your company. 👉️ https://lnkd.in/dXR7PDHq 🏅 𝗔𝘀 𝗮 𝗾𝘂𝗮𝗹𝗶𝗳𝗶𝗲𝗱 𝘀𝗲𝗿𝘃𝗶𝗰𝗲 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿, ITK Engineering𝗼𝗳𝗳𝗲𝗿𝘀 𝘁𝗵𝗲 𝗕𝗦𝗜 𝗖𝘆𝗯𝗲𝗿𝗥𝗶𝘀𝗸𝗖𝗵𝗲𝗰𝗸 - 𝗰𝗼𝗻𝘁𝗮𝗰𝘁 𝘂𝘀 𝗻𝗼𝘄 𝗳𝗼𝗿 𝗺𝗼𝗿𝗲 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗮𝘁 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆@𝗶𝘁𝗸-𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴.𝗱𝗲 💬 Learn here more about our comprehensive #cybersecurity portfolio: https://lnkd.in/dn9ZJxC4 #ITKEngineering #ITKtech #cybersecurity #cyberrisikocheck #certified

29

1 Comment