Entries by Mark Hofman

Stay Protected from Sophisticated Cyber-Attacks

When the Prime Minister fronted the media on 19 June and announced that Australia is facing sustained sophisticated cyber-attacks, it was a timely reminder that all organisations need to take cyber-security seriously. According to the Australian Cyber Security Centre, the main attack vector involves ‘copy-paste’ attacks. Such attacks are relatively simple. Unlike a zero-day, where the attacker […]

Business Email Compromise – Advisory

Business Email Compromise (BEC) attacks are increasingly prevalent. While there are several varieties of BEC attacks, the majority manifest themselves as follows: A phishing email is sent to an intended target. The target is prompted to enter their credentials on a website, after which the attacker gains access to their mailbox.  Typically, a forwarding rule […]

PCI DSS Update: Version 3.2.1

SAQ-A 6.2 – This one inclusion has changed the way we need to look at web servers. PCI DSS version 3.2.1 was introduced earlier this year. Until the end of the year you can still assess against the previous version, but time is soon running out.  One of the changes introduced isn’t in the standard […]

How to set up the right Vulnerability Management processes

Managing your network vulnerabilities and identifying the right vulnerability management processes can be complex. Whilst finding and prioritising vulnerabilities are the responsibility of the security leader, the speed at which these vulnerabilities are remediated is dependent on other people in your organisation. System architects and administrators, IT managers and system owners all play a part […]

PCI DSS v3.2 Changes

As you may be aware the security issues relating to SSL and early TLS prompted the Payment Card Industry Security Standards Council (PCI SSC) to issue a new version of the Payment Card Industry Data Security Standard (PCI DSS) and supporting documents.  This release v3.1 (April 2015) included a deadline for moving away from SSL […]

PCI-DSS & PA-DSS Changes to REQ 4.1

1- Background The Payment Card Industry Security Standards Council (PCI SSC) has issued a bulletin flagging a change in the Payment Card Industry Data Security Standard (PCI DSS) and the Payment Application Data Security Standard (PA DSS). This change will affect all those that are required to implement either standard. As you may be aware […]