Where facts are few, experts are many.
Europe's Most Influencial CISOs of the year 2024 Below is a re-print of the interview I gave to CIO-World that cover featured me in the " Europe's Most Influential CISOs of the year 2024 ". The Original can be found here . TLDR - I talk about Essential Skills for a CISO, how regulation can achieve bolstering resiliency and security, essential Skills for Effective CISO Leadership, Advice to Navigate…
The responsibilities of vendors, suppliers, and service providers have grown increasingly important in the dynamic digital economy. The growing digitalisation and reliance on third-party entities significantly enhances business operations while concurrently introducing a spectrum of security risk s. Recognising these challenges, regulatory supervisors have been actively creating frameworks over…
I recently completed my studies at the Luxembourg School of Business and began exploring how to incorporate my newfound knowledge into my field of work. Specifically, I've been considering the application of Psychological Safety principles in the realm of Cyber/Information Security. What is Psychological Safety ? Psychological safety is a concept that refers to an individual's perception of the…
Cybersecurity in M&A A Growing Priority for Decision Makers In the dynamic landscape of mergers and acquisitions (M&A), decision-makers are increasingly prioritizing cybersecurity risks. A detailed survey by Forescout provides key insights into the current state of cybersecurity in mergers and acquisitions, the survey that involved nearly 3,000 IT and business decision makers reveals a growing…
Introduction As many of you know the Schengen Agreement (Named after the Luxemburg City "Schengen" where the initial contract was signed) introduced the free flow of goods and people across the European Union. Many claim it to be on of the core backbone agreements of the European Union. Synopsis Germany decided to introduce border controls following the SARS-CoV-2 epidemic during March-Mai 2020.…
This blog post will be updated periodically as I come across new practical information and experiences. You can subscribe to my blog if you wish to be kept updated. Updates : 24.07.2020: Added number of reported data breaches to Statistics 25.07.2020: Added the Role of the DPA as captured within the GDPR and added references 25.07.2020: Added the section "Parliamentary Oversight" capturing…
RTL published [1] an Interview (8th of July 2020)with Paul Wilmes a Full professor in "Systems Ecology" at Uni Luxembourg. Paul Wilmes [2] is quoted as saying: LU: "Et hätten ni Deeg ginn zu Lëtzebuerg, an deene keng Nei-Infektiounen derbäi sinn." EN: "There has not been a single day in Luxembourg that we did not have new infections" Ed. : Unfortunately, that's just a basic fact of life (and…
"The amount of cases in the last 3 weeks has increased 10 fold!" That's what I read in the article [1] published by RTL today on the 7th of July 2020. There is no indication or thoughts as to what could be the reasons for that increase and the conclusion is left to the reader. Hoping to see press coverage that went a bit further than just relaying official statements I had a read and also opened…
How to effectively evade the GDPR and the reach of the DPA (PART 1) This is a post in a series of posts : How to deal with the DPA of Luxembourg as a Data Subject <-- Interesting in the context of this post. As my regular readers know I reluctantly trust anything that isn't tested and battle proof. In the last 2 years, I applied the same logic that I apply to vulnerability research to the Data…
This post has not much "added value" for Security Professionals, it is intended for local broader audiences. This is a quick post to clarify some ambiguity that I have seen in the reporting and associated discussions. In the recent weeks it came to light that a Ransomware Group dubbed REvil has been publishing a note that they compromised and extracted information from the Luxembourgish…
This is a Twitter Thread turned blog post This may be interesting for native english speakers, especially those working in international environments. For my Luxemburgish/German readers this may be interesting to know as well. Among the many things I dislike about languages with Germanic roots (like Luxemburgish) is that our language allows for no differenciation between "Safety" and "Security",…
The Luxemburgish Constitution is not for its people? Updates: 29/04/2020 - Added section entitled "About the non-deterministic nature" Bold Statement? Let me take a moment and explain why I came to this rather confrontational conclusion. Since the measures against the SARS-CoV-2 Pandemic were introduced my interest in our constitutional rights grew, I was curious to understand under which legal…
Disclaimer : I am not a medical professional, laymen terms. I collect information for personal consumption below and will keep it updated. Too much noise currently. Updates 26.03.2020 : Added Spread and Containment Simulator 27.03.2020 : Added tested and proven 3D Prints; Added further national dashboards. Fixed the estimated percentages of asymptomatic infections. Clarified terminology…
A package from Lithuania arrived today that may be interesting for the Infosec Community at large. Arsenijs has finally implemented a theoretical approach to program SD Cards to be temporarily or permanently protected from write operations. Having reliable read-only media can be very usefully in many situations - ranging from offensive to defensive. Implants will no longer suffer from premature SD…
This is a living post, that will be updated as I release Advisories. Updates: 02.01.2020 - Added Initial List of Advisories 09.01.2020 - Added Bitdefender and Kaspersky Advisories 12.01.2020 - Added Bitdefender Advisories 13.02.2020 - Added TZO-011/012 ESET and AVIRA Advisories 14.02.2020 - Added TZO-015 F-Secure Advisory 17.02.2020 - Released TZO-017 Kaspersky 18.02.2020 - Released TZO-018…
TLS/SSL Audit 09 release Getting my hands on code again feels good. I updated TLS/SSL Audit to version 0.9. I improved the custom rudimentary core TLS engine, it remains independent of any open-source or commercial TLS Stack (like openssl) and hence allows it to support any cipher-suite or protocol. Changes Added CHACHA20 ciphersuites and modes [ RFC7905 ] Updated a range of TLS1.2 ECDHE and PSK…
Yahoo! - "Wish list" Yahoo! announced that it will open up email accounts that are inactive since over a year for registration to anyone that applies. Yahoo! is explaining this as a service to give everyone the chance to an Yahoo ID of their choice. As a lot of organisations and in particular web applications use e-mail addresses as part of authentication and identity management there are a lot of…
I uploaded a new version of "Harden SSL/TLS" Changes Added Windows 8 support Added Windows Server 2012 support Resolved an issue around P521 additions About Harden SSL/TLS Harden SSL/TLS” allows to configure and harden the SSL/TLS settings of Windows System, ranging from Windows XP to Windows 8 and from Windows 2003 to Windows Server 2012. Harden TLS allows to remotely set SSL policies allowing or…
Interesting Reads - Week 12 / 2013 Binary Instrumentation for Exploit Analysis Purposes (part 1) Binary Instrumentation for Exploit Analysis Purposes (part 2) Using the PIN instrumentalisation framework to analyse exploits Randomly failed! Weaknesses in Java Pseudo Random Number Generators (PRNGs) FBI Secretly Spying on Cloud Computer Users FISMA/PATRIOTACT - "National Security Letters" New…
I have updated my little TLS/SSL Scanner called "SSL Audit" to version 0.8. I tweaked it slightly but the tool is still based on it's own rudimentary SSL Engine and hence is not limited by the number of ciphersuites and protocols available to OpenSSL or NSS. By the way I am still a little bit proud of the SSL Stack fingerprinting feature. I haven't updated it recently but it still seems to work…
I would like to invite you to this years OWASP BeNeLux Event, I won't give a talk this year but I happily invite you as part of OWASP BeNeLux Program Committee: Quick Facts Date : 29-30 Novembre Location: Leuven (Belgium) Price : Free Places : Limited (First registered, First serve) Register here Conference Schedule Training Schedule Agenda The agenda is a sound mix between Application Security,…
[ Updated : Added "10 Common Mistakes of Incident Responders" at the bottom] The following post will brake one major rule I adhere to when blogging, a post shall have not more than 10% of content that is not authored by myself. The content of this post resonated so well with me however that I decided to make an exception. The following is attributed to Alit-Reza Anghaie a.k.a Packetknife.com . For…
A post within the "straight to the meat" category : There was a talk at Defcon 20 entitled " Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2 ", by Moxie and David Hulton - the talk announced the implementation of a tool that reduced the security of MS-CHAPv2 to the strength of a single DES encryption . This post gives a quick rundown with references on what you need to know, enjoy - Thierry…
I updated BTCrack Open Source Edition (BTCrack OSS) to version 1.01 by patching 2 bugs that were reported by Michael Ossmann and Carl Dunhamm. Description The primary goal of BTcrack is to crack/recover the PIN and reconstruct the link-key from a previously captured Bluetooth pairing exchange. Together with Eric Sesterhen I released an open-source version of BTcrack in 2006 which since then is…
Publications In a blink of an eye - there goes your AES Key Advances in extracting keying material from Hardware (FPGA) Visualising Botnets Why allowing active ipv6 stacks on your network is a bad idea (but we don't route ipv6) A bad couple of years for the cryptographic token industry - must read Ouch, the biggest names included. TLDR; Don't use PKCS#1v1.5 padding for RSA and use authenticated…