Tahir Saleem

Understanding 42001 AS ISO/IEC 42001:2023, Information Technology – Artificial Intelligence – Management System This document serves as a comprehensive guide for Australian businesses, focusing on ISO/IEC 42001:2023, a management system standard designed to facilitate the responsible and ethical deployment of artificial intelligence.

92

4 Comments

💠Database Security💠Aligned with #ISO27001:2022 This Roadmap organizes essential database security practices within the Plan-Do-Check-Act (#PDCA) cycle of an ISMS and maps them to specific controls in ISO 27001:2022 Annex A and Clauses. ✅#Plan: Establishing the ISMS Context & Leadership ✅#Do: Implementing & Operating Controls ✅#Check:Monitoring & Reviewing Performance ✅#Act:Maintaining and Improving the ISMS Key Annex A Controls for Database Security: 👉🏻A.8.2 Information Classification: The foundation. You cannot protect data if you don't know its sensitivity. 👉🏻A.8.3 Acceptable Use of Information & Assets: Policies governing how databases are accessed and used. 👉🏻A.8.4 Access Control: The core of database security (user accounts, privileges, roles). 👉🏻A.8.24 #Cryptography: Essential for protecting data at rest and in transit. 👉🏻A.8.15 Logging: Critical for detective controls and forensic analysis. 👉🏻A.8.6 Technical #Vulnerability Management: The process for patching database software. 👉🏻A.8.16 Monitoring Activities: The proactive review of logs and use of monitoring tools. 👉🏻A.8.23 Secure Authentication: Enforcing strong passwords and #MFA for database access. 👉🏻A.8.31 Separation of Development, Test, and Production Environments: Prevents accidental data leaks or changes. #isms #iso27000 #iso27001 #iso27002 #informationsecurity #database #sql #oracle #standard

74

3 Comments

🚀 Exciting times for audit and security professionals exploring AI! For a long time, I was searching for solid AI certifications—not just theoretical, but deeply practical. While AIGP was available,a gap existed in AI-specific audit and security management certifications. 📢 ISACA has now filled that gap with two powerful certifications: ✅ AAIA – Advanced in AI Audit (Launched) ✅ AAISM – Advanced in AI Security Management (Currently in beta) I reviewed the content—and it’s far from shallow. It covers not only core AI concepts but also their real-world application in audit and security management. A complete package for professionals wanting to integrate AI into their domain. 🔍 AAIA – Advanced in AI Audit 📌 Covers AI risk, governance, assurance, and audit techniques 📌 Designed for CISA, CIA, CPA holders and audit professionals 📌 Great for those assessing AI systems and ensuring compliance 🔐 AAISM – Advanced in AI Security Management (Beta) 📌 Covers AI security, threat modelling, and governance 📌 Meant for CISM, CISSP, and security/GRC professionals 📌 Ideal for those managing AI-related risks and controls 💡 If you're in IT audit or security leadership, these certs are worth exploring. AI is reshaping the future—and so should we. #AI #ISACA #AAIA #AAISM #CyberSecurity #ITAudit #AIinAudit #AIinSecurity #CISA #CISM #CISSP #AIcertification #GRC #AIGovernance #AIassurance

58

1 Comment

“(2) Security requirement re-evaluation. A security requirement that is NOT MET (as defined in § 170.24) may be re-evaluated during the course of the Level 2 certification assessment and for 10 business days following the active assessment period if all of the following conditions exist: (i) Additional evidence is available to demonstrate the security requirement has been MET; (ii) Cannot change or limit the effectiveness of other requirements that have been scored MET; and (iii) The CMMC Assessment Findings Report has not been delivered. #cmmc #dod #cybersecurity”

56

Japanese character "ん" used to imitate forward slash in URLs [AWARENESS] JAMESWT on X.com has written about a new masquerading technique in URLs. He discovered a phishing URL impersonating booking.com that uses the Japanese character "ん" to trick the user into thinking it is a regular forward slash ("/") and the legitimate booking.com domain.   [RECOMMENDATIONS] * Block URLs that contain "xn--": Non-ASCII Unicode characters are translated into ASCII-only characters before being sent to DNS servers. This is done by encoding those characters into their punycode representation which includes a four-character prefix (xn--). * Show punycode in Firefox: When using Firefox, you can take the following steps to show punycode. "about:config -> network.IDN_show_punycode = true" Source: https://lnkd.in/ebuM5522  

1,520

53 Comments

The IETF OAuth Working Group has adopted the Identity Assertion Authorization Grant specification! > This specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API by coordinating through a common enterprise identity provider This is the basis of Cross App Access (XAA), providing IT admins better visibility and control of app-to-app connections by configuring the connections in their enterprise IdP. While it will still be a while before it is an RFC, this is an important step in the standards process, as this is the first time the document is "official"! This signifies that the working group agrees that the problem is worth solving, and agrees on the general direction of the spec. Thanks to everyone for your contributions and feedback so far! And thanks to my co-authors Karl McGuinness and Brian Campbell!

507

15 Comments