Daan Goumans

#CyCatz #cybersecurity How I Hacked the Dutch Government: Exploiting an Innocent Image for Remote Code Execution   More... https://shorturl.at/se04C   #cyberawareness #cyberattack #breaches #databreaches #cybercrime #darkwebmonitoring #SurfaceWebMonitoring #mobilesecurity #emailsecurity #vendorriskmanagement #BrandMonitoring #security #information #bugbounty #rce

10

[CVE-2024-12322: HIGH] WordPress plugin ThePerfectWedding.nl Widget has a serious security vulnerability to Cross-Site Request Forgery in versions up to 2.8. Attackers can manipulate 'tpwKey' option via cross-site scripting. Be cautious of clicking unknown links to prevent unauthorized access. https://lnkd.in/e7VQx5W8

2

Volt Typhoon, a cyber espionage group, is exploiting a zero-day vulnerability in Versa Director, a software product used by many Internet and IT service providers. ​ ​This specific zero-day allows attackers to upload a file to vulnerable systems and infiltrate networks, having the potential to wreak havoc on the software supply chain. ​ ​ProcessUnity's Threat & Vulnerability Response enables TPRM teams to assess potential exposure to emerging threats, such as the Versa Director zero-day, in hours or days. ​ ​Check out more on Threat & Vulnerability Response: https://ow.ly/AZJv50Tezco ​ Read more on the attack, how hackers can control network infrastructure and affect supply chains: https://ow.ly/RpjU50Tezcp ​ #CyberSecurity #ITSecurity #SupplyChain

20

3 Comments

BioPhorum is hosting a webinar on cybersecurity vulnerability management on Thursday 6 June - see details below. Securing your manufacturing assets is becoming harder as cyber threats evolve and bad actors seek to exploit vulnerabilities.  Come and hear how BioPhorum members think about these topics and what they do to manage risks appropriately. You can read the published paper here: https://lnkd.in/e4aRyj7A And you can register for the webinar here 👉🏻 https://obi41.nl/5d33f6dw #cybersecurity #manufacturing #biophorum #webinar

3

🚀 Only 3 days left until Pentra goes live! We’re almost there! Pentra is just around the corner, ready to change the way you approach pentesting. Built specifically for freelancers and bug bounty hunters, Pentra automates the entire reporting process and keeps all your pentest data organized in one easy-to-access platform. No more manual tracking or scattered files—just pure efficiency. 💡 Why Pentra? Pentra captures everything you do during an assessment, logs it, and aggregates it into a report in just minutes. Spend less time documenting and more time hacking! ✨ Want early access? Sign up for our beta and enjoy FREE access for an entire year! Get in now and streamline your pentesting workflow: https://pentra.ai/#beta 💬 Join the conversation and be a part of our community on Discord, connect with other pentesters, and help shape Pentra’s future: https://lnkd.in/dCyV8wVU #PentraLaunch #Cybersecurity #Automation #AI #Pentesting #BetaAccess #InfosecCommunity #BugBounty

3

DO YOU WANT TO KNOW WHY YOUR SECURITY PRGORAMME ISN'T WORKING It’s might not be because you lack technology or policies... it could be because people are missing the connection! Building a robust security culture is more than a set of rules; it’s about engaging everyone in your organization and ensuring they care. If your teams aren't fully on board or aware of the importance of security, no firewall or policy will protect your business. Not explaining the 'WHY', means they won't understand the 'WHAT' and the 'HOW'. It's time to take a hard look at how you're connecting with your team, educating them, and fostering an environment where security is a shared responsibility. Training and awareness are the building blocks of a successful ISO 27001 program, and when these are overlooked, your security programme crumbles.  ____ I'm Gary, and I'm an ISO27001 and GRC specialist, and if you need help identifying these gaps, it may be time for a gap analysis to ensure your ISO 27001 implementation is set for success. Get in touch for a FREE consultation to see what we can do for you.

11

Do you have a cyber incident that you must report according to the NIS2 rules? ⚠ You can now obtain a special incident form on our website! (also in Dutch/French) ➡ https://lnkd.in/eQA5RfSb ⬅ This form is designed to help you comply with reporting requirements quickly and accurately. 🔝 This way you ensure that your organization complies with legislation and remains protected against possible risks. Go to our website to request the form and be prepared! 👍 #nis2 #networksecurity #informationsecurity #nis #ciso #cybersecurity

3

[BLOG POST] Automatically inform your users on outdated Windows devices Your (Windows) devices need to be kept up to date, but sometimes this fails for whatever reason. In this post, I'll show an example of how we can automatically inform our end users who are running an outdated Windows device. A Logic Apps workflow is used to query Microsoft Graph and a HTML mail is send to the user. #Windows #WUfB #Automation #MsIntune https://lnkd.in/g4pSRdJU

20

2 Comments

Did you know that ISO27001 doesn't require you to do annual pentesting? 👀 The compliance people amongst you are probably thinking "of course it doesn't, it just requires you to consider the control" but in fact it doesn't even do that... To my knowledge 27001 makes no mention at all of pentesting... All it says is that "Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken" - ISO 27001:2022 Annex A objective 8.8 Of course we can discuss what ISO27002 says or what a framework really is… But the point I'm trying to make here is that you are probably free to be a lot more creative and sophisticated with your security testing approach than you might realise.

55

53 Comments

The checklist doesn't lie! If your current cybersecurity is lacking a "layered" approach, we're the technology experts who can help you give it an upgrade. #RedDiamondiS #RedDiamondInformationServices

2

If you are in the Netherlands and thinking about implementing CoPilot, think again! According to official government documents of the dutch government the tool was evaluated as not compliant. This is why I always say (especially in highly regulated industries like healthcare, energy law etc.): clarify with your CISO first when, where and under which circumstances to use such tools.

40

2 Comments

🎯Threat modeling in Dutch organizations involves systematically identifying and assessing potential threats to an organization’s assets and operations, with the goal of improving overall security posture. Dutch organizations employ threat modeling to understand potential vulnerabilities in their systems and processes, considering specific national and industry-related risks. By analyzing various threat vectors, such as cyber-attacks, insider threats, and physical security breaches, organizations can prioritize their security measures and implement targeted defenses. This proactive approach helps in designing resilient systems that align with Dutch regulations and standards, ensuring robust protection against evolving threats and enhancing overall risk management strategies. 🔔 Stay connected for industry’s latest content – Follow Dr. Anil Lamba, CISSP 💥VP - Global Tech Audits, JPMorgan Chase Co.💥, CISSP - Mentoring H🥇B VISA Holders for "EB🥇A Green Card" 💯🆓 #linkedin #teamamex #JPMorganChase #cybersecurity, #technologycontrols, #infosec, #informationsecurity, #GenAi #linkedintopvoices, #cybersecurityawareness #innovation #techindustry #cyber #birminghamtech #cybersecurity #fintech #careerintech #handsworth #communitysupport #womenintech #technology #security #cloud #infosec #riskassessment #informationsecurity #auditmanagement #informationprotection #securityaudit #cyberrisks #cybersecurity #security #cloudsecurity #trends #grc #leadership #socialmedia #digitization #cyberrisk #education #Hacking #privacy #datasecurity #passwordmanagement #identitytheft #phishingemails #holidayseason #bankfraud #personalinformation #creditfraud

2

🚨 Security Advisory: Important CVEs Disclosed 🚨 Hi Envoy Community, We would like to inform you about the following Common Vulnerabilities and Exposures (CVEs) identified in Envoy: 🔒 CVE-2024-45807: oghttp2 crash on OnBeginHeadersForStream 🔒 CVE-2024-45808: Malicious log injection via access logs 🔒 CVE-2024-45806: Potential manipulation of x-envoy headers from external sources 🔒 CVE-2024-45809: JWT filter crash in the clear route cache with remote JWKs 🔒 CVE-2024-45810: Envoy crashes for LocalReply in HTTP async client 🔧 Resolutions Coming Soon: These issues will be addressed in the following Envoy releases: - v1.31.2 - v1.30.6 - v1.29.9 - v1.28.7 🔗 Release Information: The updates will be available on our Releases Page starting today. 📖 Documentation: For detailed guidance, please refer to our Envoy Documentation. 🔄 Upgrade Recommendation: We strongly encourage all users to update to the latest versions of Envoy to ensure security and stability. 🔍 Ongoing Improvements: A pull request addressing these vulnerabilities has been initiated on the main branch. Thank you for your attention and continued support. ♻ REPOST this to help other Envoy users stay on top of Envoy News. #EnvoyProxy #Kubernetes #Security #CVE #DevOps #CloudNative #OpenSource #CyberSecurity

6

I successfully completed the 'Pickle Rick' CTF on TryHackMe, solving challenges to help Rick with his pickle predicament! #CTF #Cybersecurity #PickleRick #TryHackMe #ChallengeCompleted

3

1 Comment

Willem Westerhof just might be the Cinderella of cybersecurity interns. The Dutchman had worked as a physiotherapist, made pies in a bakery, and toiled in overnight shifts at food and beverage stands in Amsterdam’s Schiphol airport before embarking upon a cyber internship at university in 2016. Internships might be generally considered the lowest form of drudgery in any industry, stereotypically reducing young rookies eager to get experience to poorly compensated or unpaid coffee fetchers, dashing their hopes and dreams. But Westerhof’s was touched by a magical discovery that transformed his life and career — he detected a critical vulnerability in solar panel technology that threatened to put the entire power grid of the Netherlands at risk. Westerhof made global headlines, spoke at several conferences, and appeared in two documentary films — and landed a full-time job at ITsec, the Dutch firm at which he had interned. That seven-month internship helped ITsec make a critical discovery of its own: a talented newcomer to add to its permanent team. A rising number of employers are similarly tapping into internships as part of their cyber talent pipeline. Almost one-quarter of new cyber workers were interns. According to ISC2’s “2023 Cybersecurity Workforce Report”, 24% of new cyber workers (those in the industry for one year or less) completed a cyber internship or apprenticeship before getting their first job in the sector. By contrast, just 9% of more seasoned workers (those with 10 or more years in the industry) had done an internship. “Internships not only help [employers] complete projects and work that they need to get done, they really expand the pool of eligible people to draw from as you need more people within an organization,” says Matthew Prager, associate chief learning officer at the Cybersecurity and Infrastructure Security Agency (CISA). The US government body offers paid internships to high school, undergrad and graduate degree students. Are cyber internships really worth it for employers? What’s the best way to offer one? Should they be paid or unpaid? https://lnkd.in/gMkmMGaQ

6

EMPIST Cybersecurity Update: Microsoft has released an essential update for Windows 11 and 10 to address a severe Wi-Fi vulnerability. This security flaw could enable hackers to remotely control your PC via public Wi-Fi networks. We strongly advise all users to update their systems without delay to mitigate this risk. For more insights and a comprehensive understanding of the vulnerability, read the full article: https://hubs.la/Q02DvjjS0 #Microsoft #WindowsUpdate #WiFiVulnerability #Cybersecurity #EMPIST

10