Weekly #cybersecurity digest to your inbox

Subscribe for our weekly digest and get each Friday the most important cyber security news, list of upcoming free webinars and a summary of Cyberday development to your inbox.
Thanks! See you in your inbox on Fridays. :)
Unfortunately something went wrong. You can contact us at team@cyberdayai.

Information Security Risk Management: A Step-by-step Guide to a Clear Process

This post offers a comprehensive guide on managing information security risks, from pre-steps like asset identification to evaluation, treatment and monitoring. A crucial aspect given the surge of cyber vulnerabilities amid increasing tech advances.

article

21.3.2024

Ransomware, AI Act 101, NIST CSF 2.0: Cyberday product and news round up 3/2024 🛡️

In the March digest, development themes include new frameworks, risk management improvements and a new visual view for documentation cards. The news features Information Security Trailblazers, data breaches and AI Act 101.

article

21.3.2024

Empowering Employees: The Keystone in Incident Detection and Reporting

Employees are vital for detecting and reporting cyber threats and bolstering security. Proper training fosters a resilient culture, ensuring timely responses and safeguarding against breaches.

article

15.3.2024

NIS2 Incident Reporting Requirements and related ISO 27001 Best Practices

This post outlines NIS2 incident reporting and further describes ISO 27001 best practices, and their application in crafting successful incident reporting processes for your organization.

article

8.3.2024

Top 7 information security standards, frameworks and laws explained

Many information security frameworks are available to help organizations build their own security plans. This article provides key information about some of the most popular information security frameworks.

article

4.3.2024

ISO 27001 and NIS2: Understanding their Connection

Learn how the ISO 27001 and the NIS2 are "connected" and why they are brought up together pretty often. Understand their differences and synergy with the help of this blog post.

article

1.3.2024

Guide to Incident Detection and Reporting: Prepared for the Worst

In this guide you'll learn to navigate the incident detection and reporting process, explore various mechanisms, understand reporting, documentation, and derive crucial lessons. We also glance at other ingredients for successful incident management.

article

22.2.2024

NIS2 Overview: History, key contents and significance for top management

Get an overview of NIS2's main contents and understand how it makes top management clearly responsible for organization's information security efforts.

article

16.2.2024

MITRE ATT&CK: Endpoint denial of service

Introduction Denial-of-Service (DoS) attacks have been around since the 1970s, and they can be downright paralyzing to an organization. Not only does it shut down the ability to use a targeted... Go on to the site to read the full article The post MITRE ATT&CK: Endpoint denial of service appeared first on Security Boulevard.

Go to article at
15.5.2020
Denial-of-Service Attacks

Faking fingerprints — doable, but hard

Researchers found a way to create fake fingerprints to fool many devices, although it took a lot of effort.

Go to article at
15.5.2020
Outdated Access Rights

Cloud-based collaboration tools are a major driver of data exfiltration

Cloud-based collaboration technologies and workforce turnover have become major drivers of data exfiltration as insider threat programs fail to keep pace with today’s digital workplace, a Code42 survey reveals. Nearly 5,000 knowledge workers at companies with more than 1,000 employees in the U.S., U.K. and Germany were surveyed. “When it comes to data loss, leak and theft, for too many companies, the inside is their blindside,” said Joe Payne, Code42’s president and CEO. “Insider threat … More → The post Cloud-based collaboration tools are a major driver of data exfiltration appeared first on Help Net Security.

Go to article at
15.5.2020
Insider Attacks

Netflix warned to step up after dormant credentials were hijacked by hackers

NETFLIX cordcutter-cutters are demanding answers after it emerged that some former users' accounts were being reactivated by criminals. An investigation by Auntie Beeb's You and Yours programme found that if someone finds a dormant Netflix account and is able to get into it, the provided bank details from the subscription are still listed, meaning that all the hacker has to do is start watching, whilst the original customer pays. Plus, of course, if the criminal then changes the password, then that's it, the account is locked out for the legitimate account holder. In order to give leavers an easy way of rejoining the service, accounts that are deactivated have all their details, including bank account info, stored for ten months from the date of leaving, unless the customer specifically asks Netflix to delete them sooner. For its part, Netflix has made a number of appropriate purring noises and advises anyone who notices unusual or unauthorised use of their account, or erroneous charges, to contact customer service immediately.

Go to article at
15.5.2020
Password Attacks

Hackers Using APTs To Exploit Covid-19 Fears

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency and the U.K. National Cyber Security Centre recently released a rare joint statement warning of the rise of APT groups using phishing campaigns exploiting the world’s fears about COVID-19. “Their goals and targets are consistent with long-standing priorities such as espionage and ‘hack-and-leak’ operations,”.. The post Hackers Using APTs To Exploit Covid-19 Fears appeared first on Security Boulevard.

Go to article at
15.5.2020
Malware

Fake Tech Support Company Dupes 40K Victims Out of $8 Million

A college drop-out has admitted using malware and a fake tech support company to con 40,000 victims out of millions of dollars.

Go to article at
15.5.2020
Phishing

RDP and VPN use skyrocketed since coronavirus onset

The use of remote access technologies like RDP (Remote Desktop Protocol) and VPN (Virtual Private Network) has skyrocketed 41% and 33%, respectively, since the onset of the COVID-19 outbreak.

Go to article at
15.5.2020
Man-in-the-Middle Attacks

Severe Auth Bypass and Priv-Esc Vulnerabilities Disclosed in OpenBSD

OpenBSD, an open-source operating system built with security in mind, has been found vulnerable to four new high-severity security vulnerabilities, one of which is an old-school type authentication bypass vulnerability in BSD Auth framework. Here's a brief explanation of all four security vulnerabilities in OpenBSD—a free and open-source BSD-based Unix-like operating system—along with their assigned CVE identifiers The authentication bypass vulnerability resides in the way OpenBSD's authentication framework parses the username supplied by a user while logging in through smtpd, ldapd, radiusd, su, or sshd services. Using this flaw, a remote attacker can successfully access vulnerable services with any password just by entering the username as "-schallenge" or "-schallenge: passwd," and it works because a hyphen (-) before username tricks OpenBSD into interpreting the value as a command-line option and not as a username.

Go to article at
15.5.2020
Unpatched Vulnerabilities

TrickBot Now Steals Windows Active Directory Credentials

A new module for the TrickBot trojan has been discovered that targets the Active Directory database stored on compromised Windows domain controllers. [...]

Go to article at
15.5.2020
Insider Attacks