Peter E. Fischer

A must read 📖 in English or German and excellent work by netzpolitik.org & Bayerischer Rundfunk on publicly available location data which impacts everyone working in sensitive domains of #defenseindustry, #intelligence #space #government #homelandsecurity and #military https://lnkd.in/d25bJqUP #infosec #cybersecurity

27

6 Kommentare

Very informative and well organized page, to shed some light in PIIs protection but hopefully just for newbies. Nothing new, this is OSINT and it’s been around for years now. There are many very good products on the market to do OSINT. The article limits to smartphone but i can quote the very well known case of US military bases being spotted by data shared on the cloud by soprt watches. And i may go on with smart rings, multimedia centers of cars, credit cards, NFC tags…. The reality is that it’s today extremely simple, also without special tools, to find a lot of PIIs on people. Add some analysis skills and some social engineering ones and what you may obtain can be really surprising. The most astonishing part is that these data are not leaked as result of a cyberattack but shared basically by the users with or without them being aware of it. The case is different when massive data leaks happen from corporate databases (such as the case of US NSA a couple of weeks ago or the snowden case quoted in the article): in that case there are the grounds for specific responsibilities of the subjects who should have protected the data. Technologies to do that are available to date. #OSINT #PII #cyber

3

The Argument For More Cybersecurity Startups Credits: CISO Series, David Spark #CyberSecurity #CyberResilience #DataProtection #SwissStartUp #InfoSec #CyberCrime #DigitalTransformation #CyberResilienz #Datenschutz #Cybersécurité #RésilienceCyber #Innovation #Switzerland #CyberSicurezza https://lnkd.in/eCFyA9ne

5

This paper reviews the #security #measures recommended by the selected #Standardization #Development #Organizations (#SDOs) for #critical #interfaces and #classifies them based on #security #goals. It also identifies vulnerabilities and threats to these interfaces in the absence of security measures and categorizes them based on #STRIDE model and impacted traffic types. ----Mohammed Mahyoub, AbdulAziz AbdulGhaffar, @Emmanuel Alalade, @Ezekiel Ndubisi, Ashraf Matrawy More details can be found at this link: https://lnkd.in/gFg99u5k

7

1 Kommentar

The KRITIS Umbrella Act – a rule that is not a limitation, but an opener of many possibilities in perimeter protection! According to Dr. Kai Nuernberger and Prof. Dr. Elmar Padilla from Fraunhofer FKIE this legislation drives the development of technologies that enhance the security of critical infrastructures. Thanks to KRITIS these three innovations could be implemented easily and efficiently: Drone detection systems that help to prevent spionage and sabotage. Advanced IT security measures protecting IT systems from criminal and state-sponsored threats. Real-Time data processing that integrates security data into control systems for quick and appropriate responses. Fraunhofer FKIE's research highlights how interdisciplinary collaboration and new technologies are pivotal for meeting these stringent requirements. A big thank you to Dr. Kai Nürnberger and Prof. Dr. Elmar Padilla for their invaluable insights and contributions. Fraunhofer FKIE's research highlights how interdisciplinary collaboration and new technologies are pivotal for meeting these stringent requirements. Dive deeper into the groundbreaking technologies and how they are shaping the future of perimeter protection on our website under the “knowledge” tab. 📅 Secure your booth at Perimeter Protection 2025 to be part of this innovative journey! #PerimeterProtection #PerimeterProtection2025

24

Marc Heuse, Code Assurance Lead at SRLabs will present at Cybersecurity Summit in Hamburg on June 19th! His Keynote "Secure Application Development of the Future,” covers 🔒 Secure software strategies in agile environments 🔍 Advances in static code analysis & fuzzing  🚀 Emerging trends and future directions 🤖 The impact of large language models Join us in Hamburg and be part of the conversation Let's shape the future of secure software together! 🛡️✨ #fuzzing #cybersecuritysummit #securesoftware

43

Web applications are the workhorses of the digital age, powering everything from online shopping to managing our daily tasks. To ensure they perform seamlessly and securely, they need comprehensive testing. 🌐 Ensuring Excellence in Web Application Testing! 🌐🔍 In today's digital landscape, web applications are crucial for business success. Comprehensive testing is essential to deliver smooth, secure, and efficient web experiences. Here's why it's so important: - Functionality Testing: Verifies that all features work as intended, ensuring reliable operations. ✔️ - Usability Testing: Enhances user experience by making sure the application is user-friendly and intuitive.🧑‍💻 - Performance Testing: Ensures the app performs well under various conditions, handling high traffic and stress effectively. 🚀 - Compatibility Testing: Confirms seamless operation across different browsers, devices, and operating systems. 🌍 - Security Testing: Identifies and fixes vulnerabilities, protecting user data and privacy. 🔒 - Database Testing: Maintains data integrity and security, ensuring reliable data interactions. 🗂️ - Interface Testing: Verifies smooth communication between different systems and interfaces. 🔗 You are partnering with TESTRIQ QA Lab, LLP. means ensuring that your Web applications function flawlessly and provide a smooth and secure user experience. Let's work together to elevate your Web applications and ensure they meet the needs of today's digital world! 🚀✨ 📧 Interested? Connect with Us! 📩 Email: [email protected] 🤝 Contact: Heena Pathan (Business Development Executive) 🤝 VP of Sales: Ameya Pingaley #webapplicationtesting #softwaretesting #qualityassurance #userexperience #securitytesting #technology #softwaredevelopment #performance #digitalworld #testriq

9

#OWASP Top 10 #Mobile #Security #Threats: Our colleague Steffen Lortz is one of the 5 authors of the list. Our heartfelt congratulations! The OWASP® Foundation Top 10 lists (Download: https://lnkd.in/d-FmM4NW) are globally popular and recognised standards in developer and security circles for the most important security problems that need to be addressed in software development. Steffen, who works for us as a Principal IT Architect, was invited by the OWASP project manager to work with us at the end of 2022. Steffen: "It was a really cool experience to work with international security experts like Milan Singh Thakur, Alaedinne Mesbahi, Kunwar Atul, Mohamed Benchikh and Mohammed Junaid Tariq." Their investigations were based on security information provided by Google and data from companies about IT security problems they had identified. The group met every Wednesday morning to exchange information across the different time zones. Steffen also incorporated feedback from his colleagues in the mobile and cybersecurity departments. Steffen analysed and described 2 threats: ◾ Threat M6: Inadequate Privacy Controls   Privacy controls are concerned with protecting Personally Identifiable Information (PII), such as names, addresses, credit card data, information about health and sexuality. Almost all mobile apps process PII.   This information is valuable to hackers. They could use it to - impersonate the victim to commit a fraud, - misuse the victim's payment data or - blackmail the victim.   Privacy violations can have severe impact on the provider of a hacked app, like - sanctions from legal regulations (e.g., EU-GDPR), - financial damage due to lawsuits or - reputational damage due to media coverage.   Adequate privacy controls are achieved by minimizing the processed PII, only storing or transferring it when absolutely necessary and only with proper protection mechanisms. ◾ Threat M7: Insufficient Binary Protection   A mobile app's binary is its executable package, as downloaded from an app store. Binaries are subject to two types of attacks:   Reverse engineering: The binary is analyzed for valuable information, like secrets, algorithms or vulnerabilities.   Code tampering: The binary is manipulated to remove license checks, paywalls or to obtain other benefits. Alternatively, malicious code is injected.   Binary attacks can have severe impact on the app's provider, e.g., - follow-up attacks due to leaked secrets or vulnerabilities, - business damage due to copied intellectual property or - reputational damage due to distribution of malicious copies.   To achieve sufficient binary protection, countermeasures like obfuscation, encryption, integrity checks and penetration tests can be employed. Yet, what is sufficient highly depends on the particular app. Thanks to Emily Searle-White and Chrissie Gericke for the linguistic cross-check.

29

2 Kommentare

🆕 blog post by Leo Eigner Shearmur, Senior Researcher Center for Security Studies (CSS) at ETH Zurich on the pressing topic "Knowledge Security"👇 "International collaboration in science, technology, and innovation can raise security and ethical risks. Knowledge security is a new policy concept in scientifically leading, democratic countries that seek to safeguard scientific values as well as national security and interests by addressing these risks." 🔗 https://lnkd.in/dZBNmyGf

10

Updated Study of German Federal Information Security Agency Bundesamt für Sicherheit in der Informationstechnik (BSI) on Quantum Computer Development published in the advent of upcoming #Omnisecure - makes a good reading not only for all those planning to join the conference in Berlin starting January 20, 2025 The report assesses the current state of quantum computers and cryptographically relevant quantum algorithms, focusing on their potential impact on cybersecurity. Key findings from the latest update suggest that a cryptographically relevant quantum computer could be realized within the next 16 years, marking a four-year acceleration compared to the previous year’s estimates. This reduced timeline is largely driven by advances in error correction, mitigation techniques, and hardware development, which could potentially bring the realization of such computers even closer—though these advancements are not yet fully verified. Quantum computing is considered one of the most important future technologies. However, its advancement poses a significant threat to current cybersecurity measures, particularly in the field of public-key cryptography. Today’s encryption systems rely heavily on classical hardware, which is not currently susceptible to attacks. However, once sufficiently powerful universal quantum computers are available, these systems will no longer be secure. The ability of quantum computers to potentially break existing encryption methods raises the risk of the “store now, decrypt later” scenario—where sensitive data could be intercepted, stored, and decrypted in the future. In light of these developments, the Bundesamt für Sicherheit in der Informationstechnik (BSI) stresses the urgent need for organizations to adopt quantum-safe cryptography to safeguard the confidentiality, authenticity, and integrity of data. Full study https://lnkd.in/e_dhqFps #QuantumComputing

30

1 Kommentar

We are very proud to introduce our #BSidesMunich2024 closing keynote speaker, Bettina Haas! She coordinates cybersecurity assessments and cybersecurity projects in a global organization, driving red teaming, penetration testing and process assessments at strategic and operational levels. In her closing keynote, she will explore the following questions: How to keep penetration testers motivated in a fast-changing environment, continuously increasing technological complexity and high pressure due to limited time and budget? How to cultivate trust, collaboration and professional growth within pentesting teams? How to foster appropriate communication of findings in a “top secret world”? Learn more under: https://lnkd.in/dNDMx_CH BSidesMunich 8-Bit :: Forged by HI

12

#NAEPerspective: "Cyber-physical systems are becoming prevalent in a range of sectors, such as power, water, waste, transportation, healthcare, agriculture, and manufacturing. We have entered the cyber-physical age. However, we stand unprepared for this moment due to systemic under-allocation in the physical sciences and the lack of a truly multidisciplinary engineering curriculum." Read more on 'The Rise of Cyber-Physical Systems' in a recent NAE Perspective: https://ow.ly/S1bG50Sioum

6

Strengthen your organization's cybersecurity with comprehensive documentation and management of IT infrastructure. Matthias Gromann of FNT Software discusses key insights on The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and strategies for enhancing resilience. Learn more on Data Center POST: https://lnkd.in/giuD_UM8 #Cybersecurity #NISTFramework #ITSecurity

29

The 35th edition of the Digital Society Institute (DSI) Cyber Policy Digest features an in-depth analysis of Germany's operational #security deficiencies at the heart of the recent #intelligence failures, and looks at Bundeskriminalamt BKA's Bundeslagebericht Cybercrime 2023, showing both a significant rise in #cybercrime activities but also successes in dismantling criminal networks with the support of international partners.   Furthermore, we highlight the publication "Collaborating for Digital Transformation" by Koen Verhoest et al., which presents a roadmap for #digital transformation by the integrated collaboration between government and the private sector required for effective public sector #digitalization, and showcase a white paper analyzing the conditions for tapping the transformative potential of AI in local #government.   Emerging technologies also take center stage in the latest edition, including a journal article by Huw Roberts et al., proposing to enhance international AI #governance by strengthening coordination among existing institutions and positioning the OECD.AI as a central hub to foster policy #harmonization on #AI. In addition, we feature a RAND report on the impact of AI on #information warfare in the Indo-Pacific, which discusses China's use of AI in sophisticated #disinformation campaigns and stresses the necessity for multinational cooperation to counter these threats effectively. On the topic of disinformation, we also highlight Kaja Ciglic's blog post on the threat AI-generated #deepfakes pose to democratic elections and recent efforts to introduce essential safeguards against such manipulation.   The latest edition also features another Binding Hook blog post by Myriam Dunn Cavelty et al. on the Europeanization of #cyber conflict studies, highlighting the growing contributions from European scholars which are shifting the focus from #cyberwarfare to issues of cyber governance, #intelligence operations and international #law.   We are also excited to announce the upcoming Shaping Cybersecurity conference on June 17, 2024, at ESMT Berlin, focusing on "China's Cyber Challenge." The event, co-organized by Auswärtiges Amt (Federal Foreign Office) Germany, IFSH and the #DSI, will address #China's impact on global #cyber governance and the urgency for improved cyber defence in the face of #geopolitical tensions. We are also happy to share the summary of last month's event "The Future of European Digital States", which highlighted the importance of #digitalidentities and #trust mechanisms in advancing digitalization across Europe: https://bit.ly/1431401   As always, we look forward to your feedback and hope you enjoy our content! Stay tuned for more updates.   🔗 https://lnkd.in/ew7Q9PQt   Thank you to Heli Tiirmaa-Klaar, Lilly Schmidt, Konstantin Schaarschmidt, and Helene Pleil for your excellent contributions!   #DigitalSocietyInstitute #Cybersecurity #AI #CyberPolicy #ElectionSecurity ESMT Berlin

42

1 Kommentar

📢 Less than a week to go to the #SSCC #webinar on #CyberResilience, which will take place online on Tuesday, June 11th, from 13:00 until 15:00 (CET). The event is organized by the Swiss Support Center for Cybersecurity (SSCC). 👉 To register (free): https://lnkd.in/e77AWwrw 💡 The goal of this webinar is to shed light on various aspects of cyber resilience from different perspectives. It will explore #technical #measures aimed at #improving the #resilience of #systems themselves, as well as #organizational measures designed to #absorb #impacts even when attackers have successfully circumvented technical security measures. 🗣 Its speakers cover the federal, cantonal, communal, NGOs, and academic sectors: Nicolas Frey (cyber-safe.ch), Melanie Knieps (University of Zurich), Fabien Leimgruber (CyberPeace Institute), Prof. Mathias Payer (EPFL) and Monica Ratte (National Cyber Security Centre NCSC (NCSC_CH)). ☝ Find more information here: https://lnkd.in/ebcbAEk6 #stability #cyberattacks #informationsecurity #zerotrust #architectures

20

ATTENTION STARTUPS & SCALEUPS IN DEFENCE & DUAL-USE Are you looking to revolutionize defence? Seeking funding, strategic partnerships, or visibility? Join us at the Munich Security Breakfast – the exclusive startup event within the framework of the Munich Security Conference 2025, hosted by BASED, the Digital Hub for Security and Defense. 🗓️ When and Where? 📍 February 13, 2025📍 Hofbräuhaus Munich Germany Invite-only Why Apply? ✅ Networking: Meet investors, NATO representatives, and leaders in the defence industry. ✅ Visibility: Showcase your startup in an exclusive Investment Booklet, distributed to key players in politics, investment and business. ✅ Acceleration: Be part of a selected group of 80 startups advancing European resilience with cutting-edge solutions. ✅ Opportunities: Gain feedback from industry experts and connect with decision-makers shaping the future of defence. Next Steps: 1️⃣ Apply Now: Submit your application and data by January 31, 2025. 2️⃣ Get Selected: If chosen, secure your ticket, it includes event participation and your profile in the booklet. 3️⃣ Prepare to Shine: Join the elite at the Munich Security Breakfast and make your mark. Seats are limited – don’t miss this chance to scale your vision to the next level. 🔗 Apply now: www.securitybreakfast.com Questions? Contact us at [email protected] Let's shape the future of defence innovation together. #DefenceInnovation #Startups #MunichSecurityConference2025 #BASED

57

2 Kommentare

Security gaps found in encrypted cloud storage services Researchers from ETH Zurich have discovered critical security vulnerabilities in five popular end-to-end encrypted (E2EE) cloud storage services: Sync, pCloud, Seafile, Icedrive, and Tresorit, which serve around 22 million users. These cryptographic flaws could allow attackers to bypass encryption, access confidential files, tamper with data, or even insert unauthorized files. While all five providers claim to offer robust encryption, four of them showed significant vulnerabilities, undermining their security promises. Tresorit emerged as the most secure among the group, with only minor metadata tampering and file-sharing risks, whereas Sync, pCloud, Seafile, and Icedrive had more severe flaws. Key vulnerabilities identified include unauthenticated key material in Sync and pCloud, public key substitution risks in Sync and Tresorit, and protocol downgrade attacks in Seafile. These issues can enable unauthorized data access, interception, or brute-force attacks. Although Sync is reportedly "fast-tracking fixes" for some issues, other providers have varied in their responses, with Icedrive declining to address the concerns. ETH Zurich researchers highlight that such flaws are common in E2EE cloud services, calling for further investigation and a standardized protocol to ensure reliable encryption across the industry. #E2EESecurity #CloudStorage #Cybersecurity #DataPrivacy #Encryption #ETHZurich #TechSecurity #DataProtection #EndToEndEncryption #Sync #pCloud #Seafile #Icedrive #Tresorit #CloudSecurity #TechResearch #CryptographicFlaws #DataIntegrity #VulnerabilityReport #SecureCloud #DataConfidentiality #TechIndustry #FileEncryption #SecurityFlaws #DigitalPrivacy #SecurityStandards #DataSafety #ProtocolSecurity #StandardizedEncryption #CloudComputing #DataProtectionRisks #DigitalSecurity #CloudSafety #AttackPrevention #ITSecurity #CloudTech #CyberThreats #TechNews #ACMConference #ResearchFindings #TechJournalism #SecurityResearch #FileSecurity #CloudEncryption #PrivacyRisks #EnterpriseSecurity #DataIntegrity #CloudSolutions #DisruptiveTech

New Release: Cyber Security Risk Handbook   ecoDa a.s.b.l - The European Confederation of Directors Associations and the Internet Security Alliance (ISA) have revised their manual on monitoring cyber risks, which was first published in 2020. The Swiss Institute of Directors is the Swiss representative of ecoDa a.s.b.l - The European Confederation of Directors Associations.   An update was necessary to reflect the current state of cybersecurity and cybersecurity legislation, as well as the new roles and responsibilities of boards of directors. The handbook was specifically developed to assist European company boards in analyzing cyber issues from an enterprise-wide perspective.   The handbook contains five principles, which are supplemented by toolkits to provide more detail. Both are useful to assist boards in fulfilling their responsibilities for cyber risk oversight. Explore to the handbook and toolkits: https://lnkd.in/e5H9pR6n Explore the Swiss Institute of Directors: https://lnkd.in/eRmW3tsY #empoweringboardleaders, #boardleaders

3