Fernando Salgado Leal

the roadmap for ISO27k certification - this is a bit old (2022 ver) and probably needs a small update, but overall it is the same process. a webp image can be downloaded from here: https://lnkd.in/dxpqk7dx the same roadmap in PDF: https://lnkd.in/dA3kxtFP explanatory slides can also be downloaded from here: https://lnkd.in/dsaYm9cd

270

6 Comments

Cybercrime used to require skill. Now, it just needs a subscription. With 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝘁𝗶𝗼𝗻-𝗮𝘀-𝗮-𝗦𝗲𝗿𝘃𝗶𝗰𝗲 (𝗘𝗮𝗮𝗦), threat actors no longer build complex exploits from scratch. They buy, rent, or subscribe to them, like software. And that’s a major shift in the threat landscape. What EaaS looks like in practice: • RCE kits sold with GUI interfaces • Initial access brokers selling entry into enterprise networks • Zero-day marketplaces with live chat support • Full attack infrastructure-as-a-service—payloads, obfuscation, hosting, even helpdesk The barriers to launching an advanced campaign are shrinking. The speed and scale of exploitation are growing. Why CISOs should care: - Defenders face industrialised attack patterns—automated, parallel, and tested - Exploits emerge faster than patch cycles can keep up - Even low-skill actors can now execute multi-stage attacks with precision - Attribution becomes harder—when infrastructure is shared, who’s behind the breach? EaaS isn't the future. It's already operational. The question is whether our defences are modular enough to respond.

90

8 Comments

💠Database Security💠Aligned with #ISO27001:2022 This Roadmap organizes essential database security practices within the Plan-Do-Check-Act (#PDCA) cycle of an ISMS and maps them to specific controls in ISO 27001:2022 Annex A and Clauses. ✅#Plan: Establishing the ISMS Context & Leadership ✅#Do: Implementing & Operating Controls ✅#Check:Monitoring & Reviewing Performance ✅#Act:Maintaining and Improving the ISMS Key Annex A Controls for Database Security: 👉🏻A.8.2 Information Classification: The foundation. You cannot protect data if you don't know its sensitivity. 👉🏻A.8.3 Acceptable Use of Information & Assets: Policies governing how databases are accessed and used. 👉🏻A.8.4 Access Control: The core of database security (user accounts, privileges, roles). 👉🏻A.8.24 #Cryptography: Essential for protecting data at rest and in transit. 👉🏻A.8.15 Logging: Critical for detective controls and forensic analysis. 👉🏻A.8.6 Technical #Vulnerability Management: The process for patching database software. 👉🏻A.8.16 Monitoring Activities: The proactive review of logs and use of monitoring tools. 👉🏻A.8.23 Secure Authentication: Enforcing strong passwords and #MFA for database access. 👉🏻A.8.31 Separation of Development, Test, and Production Environments: Prevents accidental data leaks or changes. #isms #iso27000 #iso27001 #iso27002 #informationsecurity #database #sql #oracle #standard

75

3 Comments

“(2) Security requirement re-evaluation. A security requirement that is NOT MET (as defined in § 170.24) may be re-evaluated during the course of the Level 2 certification assessment and for 10 business days following the active assessment period if all of the following conditions exist: (i) Additional evidence is available to demonstrate the security requirement has been MET; (ii) Cannot change or limit the effectiveness of other requirements that have been scored MET; and (iii) The CMMC Assessment Findings Report has not been delivered. #cmmc #dod #cybersecurity”

56

🚨 NEW STANDARD ALERT 🚨 ISO - International Organization for Standardization 📘 “ISO/IEC 27031:2025” is officially published! The newly released Edition 2 (2025) of ISO/IEC 27031 provides updated guidance for ICT readiness to support business continuity — a critical topic in today’s digital and cloud-driven world. 🔍 What is it about? ISO/IEC 27031:2025 helps organizations ensure that their information and communication technologies (ICT) are resilient enough to support operations during and after disruptions — from cyberattacks and outages to third-party failures. 🔗 Why does it matter? Modern business continuity depends on the reliability and recoverability of ICT systems. This standard bridges the gap between information security (ISO/IEC 27001) and business continuity (ISO 22301) by offering a structured framework for: ✔️ ICT risk preparedness ✔️ Recovery planning ✔️ Resilience engineering ✔️ Integration with cloud and third-party services ✨ Key Benefits: ✅ Maintain business operations during ICT disruptions ✅ Align ICT, cybersecurity, and continuity strategies ✅ Reduce downtime and data loss ✅ Strengthen resilience and stakeholder trust ✅ Seamlessly integrate with ISO/IEC 27001 & ISO 22301 🌐 Whether you’re managing IT infrastructure, building disaster recovery strategies, or leading enterprise resilience programs — ISO/IEC 27031:2025 is an essential reference for your toolkit. 🔄 How ISO/IEC 27031:2025 Supports DRP: • Focus on ICT Readiness → It ensures that all critical ICT systems (on-prem, cloud, hybrid) are assessed, prioritized, and prepared for restoration after a disruption. • Recovery Objectives → It helps define and validate RTOs (Recovery Time Objectives) and RPOs (Recovery Point Objectives) as part of your disaster recovery strategy. • Technology-Specific Measures → Unlike general BCM guidance, 27031 zooms in on technical capabilities such as: • Backup strategies • Failover mechanisms • Alternate site readiness • Cloud recovery procedures • Alignment with ISO 22301 → It provides the ICT-specific layer that feeds into the broader business continuity plan (BCP) and DRP. • Testing and Exercising → It mandates testing of recovery mechanisms (e.g., DR drills), ensuring that your DRP is not just a document, but a validated operational capability. 🗓️ This new version replaces the 2011 edition and is now officially Stage 60.60 – Published. 📥 If you’re building cyber-resilient organizations, it’s time to review and align with the latest edition. #ISO27031 #BusinessContinuity #CyberResilience #ISOStandards #ICT #ISO22301 #ISO27001 #DisasterRecovery #CloudSecurity #Cybersecurity #InformationSecurity #GRC #RiskManagement #Resilience #Continuity #ISO #BCM #BCMS #DRP #IRP #InfoSec #InformationSecurity

31

1 Comment

CISA Unveils Eviction Strategies Tool to Aid Incident Response. A new tool aimed at streamlining cyber incident response and helping organizations evict adversaries from compromised systems has been released by the US Cybersecurity and Infrastructure Security Agency (CISA). The Eviction Strategies Tool is a free resource developed in collaboration with MITRE to support defenders in building rapid, tailored response plans. Designed with ease of use and speed in mind, the Eviction Strategies Tool allows cyber defenders to craft detailed playbooks for containing and removing threat actors. Users can develop plans in minutes using either structured frameworks, such as MITRE ATT&CK, or free-text descriptions of threat behavior. CISA emphasized the importance of the tool in addressing long-standing challenges faced by incident responders. CISA is inviting public and private sector organizations to incorporate the tool into their incident response workflows and provide feedback via an anonymous survey... [Source in the comments section]

36

12 Comments