In May 2018, Europe will be switching to the updated regulations for the processing of personal data set by the General Data Protection Regulation (GDPR). This regulation, which directly applies in all 28 EU countries, replaces the Framework Directive on Personal Data Protection 95/46/EC from October 24, 1995. An important aspect of the GDPR is…
Category: Security
CYBERSECURITY INCIDENT RESPONSE PLAN “A”
Hello everyone, since I do consultations for my friends from time to time, I suggest you do a review of CYBERSECURITY INCIDENT RESPONSE PLAN. So, I sincerely hope it will be interesting. Standards: NIST Special Publication 800-61 NIST Cybersecurity Framework (CSF) Compliance: ISO 27001 – A.16 PCI DSS 3 – 10, 12.9 Regulation: EU GDPR…
How to prevent lateral movement to Entra ID when your Active Directory has fallen
Hey Hey, such a long read, but please take a time for review. At the moment, the biggest threat to an Entra ID tenant in the vast majority of environments comes from the connected Active Directory. Attackers are (currently) focusing heavily on on-prem environments, as these are generally much more difficult to protect and are…
Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters
Attackers are constantly looking for new vulnerabilities to exploit in Kubernetes environments. Recently, Microsoft uncovered an attack that takes advantage of new critical vulnerabilities in OpenMetadata to access Kubernetes workloads and use them for cryptocurrency mining. OpenMetadata is an open-source platform that helps manage metadata across different data sources. It acts as a central repository…
Microsoft has fixed two zero-day vulnerabilities
Microsoft has addressed two zero-day security vulnerabilities in Windows that have been used in real-world attacks. Microsoft has fixed two actively exploited zero-day vulnerabilities as part of the Patch Tuesday release on April 9th, 2024. Although the company did not initially recognize these vulnerabilities as such, they were identified and addressed in the latest update….
Security updates for Windows 10
Microsoft has published information about the cost of subscribing to security updates for Windows 10, which will be available as part of the Extended Support Update (ESU) program starting in October 2025. Subscriptions will be available for three years. The Windows 10 ESU program is available to all users, not just corporate customers, and subscription…
Use Azure Bastion to protect Azure virtual machines
Azure Bastion is a managed PaaS service that allows you securely connect to your virtual machines over a TLS connection. This connectivity can be established from the Azure portal or through a native client to the private IP address on the virtual machine. Advantages of using Bastion include: Azure virtual machines don’t need a public IP…