Zeina Zakhour

🔓 IDOR is Everywhere — You Just Need Patience 🧠 In the world of bug hunting and cybersecurity, some of the most critical vulnerabilities are often hidden in plain sight. Insecure Direct Object Reference (IDOR) is one such vulnerability — simple, yet incredibly powerful. It's not about complex payloads or flashy exploits. It's about observation, logic, and above all, patience. 💡 Whether it’s a user ID in a URL or a file reference in an API, IDOR flaws can exist in the most unexpected places — waiting for someone patient enough to spot the difference. If you're into ethical hacking or just starting out in bug hunting: 👉 Never ignore the basics. 👉 Test like a user, think like an attacker. 👉 Stay persistent. Remember: “IDOR isn’t rare — the mindset to find it is.” #CyberSecurity #BugBounty #EthicalHacking #IDOR #AppSec #InfoSec #BugHunter #HackingMindset #WebSecurity #ThinkLikeAnAttacker

358

27 commentaires

⏳ Time is crucial in Incident Response ⏳ In one incident, the victim engaged Talos IR immediately after discovering malicious activity alerts. Talos IR worked swiftly to combat additional malicious activity and prevented the execution of any encryption in the environment. Conversely, in a second incident, the victim ignored alerts of malicious activity and did not contact Talos IR until after the ransomware binary began to execute. Talos IR was then not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption. Full article here: https://lnkd.in/enpX5CuB

98

7 commentaires

I’m excited to share the "Domain 1 – Information Security Governance" of my new CISM preparation series. Inside, you’ll find: --> Practical explanations of governance concepts (policies, procedures, standards) --> Real-world examples of aligning security with business objectives --> Best practices for risk management, compliance, and IT strategy --> Step-by-step guidance designed to bridge theory with real-world application. Whether you’re preparing for the CISM exam or looking to strengthen your role as an IT security manager, this guide will help you master Domain 1 with clarity and confidence. This is just the beginning. In the coming weeks, I’ll be releasing the remaining CISM domains, each with the same practical, hands-on approach.

167

9 commentaires

Most graphs of the #DigitalIdentity focuses on wallets, authentic sources, and Relying Parties — but often overlooks a crucial piece of the puzzle: Trust Service Providers (#TSP). #TSPs, listed on trusted lists across the EU, are the heart of the #eIDAS ecosystem. They ensure the security model, enable trust, and guarantee that Electronic Attestations of Attributes (#EAAs) are reliable. Their role doesn’t stop at #EAA issuance. #TrustServices also manage the entire lifecycle of each EAA: issuance, suspension, and revocation. #ElectronicAttestation issuers will come in different forms — qualified, public sector, or non-qualified. Yet all of them will operate with the status of a #TrustService, subject to strict security supervision under #eIDAS2. The future of digital identity in Europe rests on this foundation of trust. Without it, the #EUDIWallet cannot work.

98

12 commentaires

📌 DORA in Assurance: With the recent publication of the Guide on DORA Oversight of Critical Third-Party Providers’ activities, the importance of independent assurance is increasing for ICT providers to the financial sector — whether designated as Critical Third-Party Providers (CTPPs) or not. 💡 Financial sector clients will expect clear evidence of digital operational resilience from their ICT service providers. This applies across the EU, and in Luxembourg it includes the #SupportPFS, given their role in delivering ICT services. 📊 Read our latest blog to understand how independent reports such as ISAE 3000 or SOC 2 help: ✔ Meet regulatory expectations ✔ Strengthen trust ✔ Preserve market access …turning compliance into a #competitive advantage. #dora, #oversight, #assurance, #thirdpartyrisk, #ISAE, #SOC, #resilience, #outsourcing Ashish B, Alexander Holsten, Jean-Baptiste D., Jean-Daniel Canova, Baturay ÖNBAŞ, Arthur Nyetam, Shafiq Ramjanally, Pedro Prata, Ali Alam RE CISA, Brigitte Beugelaar, Vaike Metzger, Antonia Schreiber

88

1 commentaire

I recently spoke at the 20th IT Director’s Forum in Athens, Greece, emphasizing the necessary expansion from cyber security to cyber resilience. While cyber security aims at protecting networks, devices, and data, cyber resilience goes further by anticipating, withstanding, recovering from, and adapting to disruptions. In essence, cyber resilience combines cyber security with business resilience. #itdirectorsforum

223

7 commentaires

🌟 2025-2028: An era of transformation for #CISOs Based on discussions with numerous cyber professionals in the #US 🇺🇸 and #Europe 🇪🇺, I believe the next three years will be defining for my #CISO friends and clients. The role of Chief Information Security Officers will undergo profound changes. Let's delve into four pivotal shifts: 1️⃣ Skyrocketing salaries 💵: The ongoing talent shortage and the still-less-than-glamorous appeal of the #cybersecurity sector will drive salaries through the roof. The job's immense pressure and the need to prepare for personal cyber-liability insurance coverage (when not covered by D&O insurance policies) will further fuel this trend. Additionally, expect increased scrutiny by regulators around CISO equity and bonuses💰 to ensure CISOs remain motivated to report incidents transparently. 2️⃣ Splitting the #CISO Role 👥: The system of lines of defense is gaining popularity across all sectors, not just finance. Many CISOs are shifting to a second-line role focused on strategy, risk management, and assurance/testing 🔎. Consequently, we're seeing the emergence of technology-focused CISOs under the #CIO, responsible for execution. For years, we've debated whether the CISO should report to the risk officer or the CIO. Now, it's both... with two distinct individuals 📈 3️⃣ #CISO Stratification 🧭: Companies are increasingly choosing their CISOs based on their current cybersecurity posture. Post-incident? They call in crisis CISOs to manage the fallout🔥 Facing regulatory pressure? They hire remediation CISOs to build large-scale cybersecurity plans. In stable times, BaU CISOs keep things running smoothly. This shift is creating clear tiers within the profession, with distinct profiles emerging 👥 - and driving faster turnover as organizations switch leaders to fit the moment. It’s especially true in U.S. banks, where the average CISO tenure is now just 30 months! 4️⃣ Evolution to #CSO: Cybersecurity functions are increasingly overlapping with other security domains like product security, e-fraud, IT risk, and operational resilience 🌐. Businesses are demanding more coherence in security practices, and some areas like #InsiderThreat are managed inconsistently. In the next three years, we'll likely see key services extending beyond cybersecurity, such as Fusion Centers (an evolution of SOCs🔎) and Business Intelligence (an extension of #ThreatIntelligence). The good news is that the CSO is now perfectly positioned to integrate #IAM, which has been neglected for years in the organization ;-) These predictions are not just about salary or minor changes but signal a paradigm shift in how we perceive and value the role of cybersecurity leaders 📈. #CISOs are not just tech guardians; they are strategic business enablers and risk managers! Let's watch these predictions unfold in the next three years and prepare to support our CISO community! 🎯 #GetReady #Transformation

114

7 commentaires

Our article titled “Perceptions of Digitalisation and Cyber Security: Impacts on Organisational Practices through the NIST Cybersecurity Framework” has been published in the Journal of Decision Systems (Taylor & Francis Group)! In this study, we examined cybersecurity perceptions and organizational practices during the digital transformation process, using the NIST Cybersecurity Framework v2, which was released in 2024, as our foundation. Insights from 124 professionals across various sectors reveal a significant gap between perceived awareness and actual readiness. The cyclical structure of the updated NIST CSF also highlights how it can enhance organizational cybersecurity maturity. As digitalization accelerates with AI and IoT, the need for proactive and adaptive strategies becomes increasingly important. Full article: https://lnkd.in/dRURbJmX Many thanks to my co-authors Assoc. Prof. Burcu Kör and Assoc. Prof. Nazim Taskin for their valuable collaboration. I believe the cyclical nature of the NIST Cybersecurity Framework v2 should be seriously considered as a foundational element for effectively implementing organizational cybersecurity. #Cybersecurity #DigitalTransformation #NISTCSF #Research #JournalPublication

80

3 commentaires

"Explained: GPAI Code of Practice - Safety & Security Chapter 1", co-prepared by Matthias Samwald, Marta Ziosi, Alexander Zacherl, Yoshua Bengio, Daniel Privitera, Nitarshan R., Marietje Schaake, Anka Reuel, & Markus Anderljung, and published now in July 2025 by AI & Partners. 👇 This report outlines the safety and security practices set out in the #GPAI Code of Practice. The document details commitments and measures for systemic risk assessment, mitigation, and reporting. It outlines evaluation protocols, defines responsibilities, and promotes a strong risk culture. It also includes appendices on model evaluations, risk scenarios, and robust security mitigation #strategies. Link: https://lnkd.in/d8zUpErq #artificialera #web3 #web4 #web5 #fintech #digitalera #digitaltransformation #ailaw #machinelearning #deeplearning #generativeAI #trustworthyAI #explainableAI #aiethics #artificialintelligence #explainableAI #responsibleAI #foundationmodels #GPAI #GAI #LLMs #NLPs #GenAI #frontierAI #narrowAI #AGI #ethicalAI #adversarialAI #RAG #agenticAI #AIagents

93