December

The latest in information security (in English and Dutch)

13-12-17

• Jaap-Henk Hoepman: Wat is forward secrecy?
• NCSC: Certificaten met 1024-bit RSA worden uitgefaseerd - Controleer de sleutellengte van uw certificaten [PDF] | Via

2013-12-14

• EH-Net: Using cold boot attacks and other forensic techniques in penetration tests

Earlier / undated

• Elizabeth Clarke (Dell SecureWorks): The underground hacking economy is alive and well | Related BBC News article | Via
• Christina Höfer: Privacy-preserving charging for eMobility [PDF linked from this Dutch-language page] | Full text, PDF
• Hugo A.W. Ideler: Cryptography as a service in a cloud computing environment [PDF linked from this Dutch-language page] | Full text, PDF
• PwC (Department for Business Innovation & Skills): 2013 Information security breaches survey - Technical report [PDF] | Via

[Permalink]

The latest in information security (in English and Dutch)

2013-12-12

• Andrea Dufkova (ENISA): CERT community - Recognition mechanisms and schemes [PDF linked from this page] | Full text, PDF | Via
• Lincoln Mattos (When IT Meets Politics): Is there a bigger threat to your cyber safety than those who run awareness campaigns and enforce compliance regimes which assume [...]
• Arnoud Engelfriet (Ius Mentis): De nieuwe veiligheidsregels van de banken

2013-12-11

• Ken Baylor (NSS Labs): View from the precipice - Mobile financial malware [PDF linked from this page] | Via
• Louis Marinos (ENISA): ENISA threat landscape 2013 - Overview of current and emerging cyber-threats [PDF linked from this page] | Press release | Via

2013-12-10

• Eleni Kosta, Vincent Rijmen, Danny De Cock, Jos Dumortier, Hans Graux and Nigel P. Smart (ENISA): Securing personal data in the context of data retention - Analysis and recommendations [PDF linked from this page] | Press release

2013-12-09

• Paul Ducklin (Naked Security): Serious security - Google finds fake but trusted SSL certificates for its domains, made in France
• Igal Zeifman (Incapsula): Report - Bot traffic is up to 61.5% of all website traffic | Via
• Forum Standaardisatie: College Standaardisatie stimuleert normen voor informatiebeveiliging

2013-12-06

• Adrian Pauna and Konstantinos Moulinos (ENISA): Window of exposure... a real problem for SCADA systems? [PDF linked from this page] | Press release | Via

2013-12-04

• Andrea Dufkova, Joshua Budd, Jachym Homola and Matthew Marden (ENISA): Good practice guide for CERTs in the area of Industrial Control Systems [PDF linked from this page] | Full text, PDF

Earlier / undated

• Peter Sommer (IAAC): Digital evidence, digital investigations and e-disclosure - A guide to forensic readiness for organisations, security advisers and lawyers [PDF linked from this page] | Full text, PDF | Via
• Sophos: Security threat report 2014 - Smarter, shadier, stealthier malware [PDF and additional information linked from this page] | Via
• Agentschap NL (Ministerie van Economische Zaken): SBIR Cyber security II | Via

[Permalink]

The latest in information security (in English and Dutch)

2013-12-04

• Arnoud Engelfriet (Security.nl): Juridische vraag - wie is aansprakelijk voor fraude met internetbankieren?

2013/12/02

• John Hawes (Naked Security): Dutch banks set common rules for online banking. But have they gone far enough?

Earlier / undated

• ETSI: Cloud standards coordination - Final report [PDF] | Via
• Ponemon Institute LLC (Sophos): The risk of an uncertain security strategy - Study of global IT practitioners in SMB organizations [PDF] | Press release
• PwC (Department for Business, Innovation and Skills): UK cyber security standards - Research report [PDF linked from this page] | Full text (PDF) | Via

[Permalink]

The latest in information security (in English and Dutch)

2013-11-27

• Rijksoverheid.nl: 100 miljoen keer DigiD in 2013 | Via

2013-11-26

• Out-law.com: Tribunal confirms self-reporting does not provide immunity from fines but expert urges firms to self-report data breaches
• David Talbot (MIT Technology Review): Group thinks anonymity should be baked into the Internet itself - Following NSA surveillance revelations, talks advance on making the privacy-protecting tool Tor an Internet standard | Via
• Rijksoverheid.nl: Beantwoording Eerste Kamervragen betreffende cyberbeveiliging [link naar PDF op pagina]

2013-11-22

• Arnoud Engelfriet (Ius Mentis): Mag ik mensen met openstaande netwerken of schijven helpen?
• Brenno de Winter (Bigwobber): DDoS-aanvallen in Nederland [link naar PDF op pagina] | Overzicht DDoS-aanvallen (PDF)

2013-11-20

• Paul Ducklin (Naked Security): Serious security - how to store your users' passwords safely
• Shaun McConnon (Risk Management Monitor): Looking beyond compliance when assessing security | Via

2013-11-19

• Jim Cowie (Renesys): The new threat - targeted internet traffic misdirection | Via
• Martin Lee (Cisco Blogs): Don't click tired | Via
• Kurt Opsahl and Nate Cardozo (EFF): Encrypt the web report - who's doing what
• Panagiotis Trimintzios and Razvan Gavrila (ENISA): National-level risk assessments - An analysis report [PDF linked from this page] | Press release | Via

2013-11-15

• Thomas Haeberlen, Dimitra Liveri and Matina Lakka (ENISA): Good practice guide for securely deploying governmental clouds [PDF linked from this page] | Press release

2013-11-13

• Mark Nottingham (W3C): Moving forward on improving HTTP's security | Via

Earlier / undated

• Cosmin Ciobanu (ENISA) et al: Alerts, warnings and announcements - Best practices guide [PDF linked from this page] | Full text (PDF) | Via
• European Commission: Special Eurobarometer 404 - Cyber security - Report [PDF] | Press release | Via
• ICAEW: Audit insights - cyber security [PDF] | Via
• Eleni Kosta, Jos Dumortier and Hans Graux (ENISA): Security certification practice in the EU - Information Security Management Systems - A case study [PDF linked from this page] | Via
• Raplph Langner: To kill a centrifuge - A technical analysis of what Stuxnet's creators tried to achieveTYPEWARNING | Via
• Jo De Muynck, Hans Graux and Neil Robinson (ENISA): The Directive on attacks against information systems - A good practice collection for CERTs [...] [PDF linked from this page] | Full text of the Directive (PDF) | Via
• NVB: Uniforme veiligheidsregels particulieren [PDF] | Persbericht | Via
• President's Council fo Advisors on Science and Technology: Immediate opportunities for strengthening the nation's cybersecurity [PDF] | Via
• Payment Card Industry (PCI) Data Security Standard: Requirements and security assessment procedures, version 3.0 [PDF] | Version 3.0 change highlights (PDF) | Via

[Permalink]