Koen Van Impe

One of the questions Daniel Miessler ⚙️ and I got to ask at the @OpenAI Security Research Conference to @sama was: “You said years ago that you thought prompt injection was solvable, Do you still think that?” The event was not recorded but the answer was something akin to: Not completely but we may get to 95-99% of cases solved in the future.

63

9 Comments

While reversing the firmware of Dell RT (Radyum device) just found how secure they store their passwords! Hard-coded in the binary itself. We also got lucky and found a privilege escalation to (system) by abusing the way this firmware interacts with the .NET Framework (.NET Profiler technique/feature) this issue has been reported to Dell through Bug-Crowd. Exploit author: Juan Sacco <jsacco@exploitpack.com> https://exploitpack.com/ Description: RAD FT Firmware version: A00-00 Build (WP0000051154) and prior is vulnerable to a privilege escalation (system) because it fails to properly filter the user-supplied input through the .NET Profiler. Impact: This allows a malicious attacker to side-load a DLL, escalate to (SYSTEM) and control the application flow from the maliciously loaded .NET library.

104

7 Comments

The March 2025 release of the Information Security Manual (ISM) introduces 24 new control items, removes one, and changes 87. It brings the total number of control items to 1003. Of the changes, 43 are very minor, mainly removing the space between "cyber" and "security" to use the dictionary's "cybersecurity". The other changes are also fairly minor, such as: • "Web applications" and "applications" changed to "software" • The addition of a "staging" environment in the software development process • "HIPS" now extended to "HIPS or EDR". The new ISM starts with ten new control items related to the expectations of "board of directors or executive committee". Other new control items include: • Change management is back, in the form of a change management plan (but no formally defined processes and procedures, yet) • Inclusion of exceptions for "authorised medical devices" in SECRET and above environments • DNS encryption to be used where supported. As always, I recommend reading the ASD's own eight-page changes document at the link below. I have not posted the link to my OneDrive repository of useful ISM-related tools for a while. They are available here: https://lnkd.in/giWjwZfV. Comments and feedback welcome. #ASD #ACSC #ISM #cybersecurity #IRAP #infosec

93

6 Comments

Are #cybersecurity incidents growing more costly? Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years. The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears. The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly. That said, this picture looks a lot different among different types and sizes of organizations. How are cyber losses trending for orgs like yours? Download the full IRIS 2025 to find out! Link in the comments.

102

15 Comments

A paper strategy will not stop a cyberattack. The Dutch National Cyber Security Centre shares international publications on OT/IACS cybersecurity. Valuable? Absolutely. But the reality is harsh: 90% of these guidelines remain stuck on paper. And a paper strategy will not stop an attack. That is where OT-secure comes in. Our automated IT/OT maturity assessment turns guidelines into action: - Benchmark against IEC 62443 and NIST 800-53 - Identify the real gaps in your OT environment - Provide a roadmap that can actually be executed International guidelines set the direction. OT-secure shows you where you really stand today. Assess Today, Protect Tomorrow. Send me a message to request the free OT Security Assessment today. And know immediately where you stand.

20

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

Investigation Scenario 🔎 A file named netview_windows.exe was executed on a system on your network. What do you look for to investigate whether an incident occurred? Native data sources only -- no EDR or external tools. #InvestigationPath #DFIR #SOC

46

5 Comments

'Dark clouds are looming' - Dutch central government in the cloud: "The Dutch central government started using cloud services without thoroughly considering the implications and risks. The government has limited insight into the cloud. It has not made mandatory risk assessments of two-thirds of the main cloud services it uses. The Court of Audit is concerned that the public services it delivers to citizens and businesses are exposed to too much risk. This could potentially disrupt society." https://lnkd.in/eGeWQs6M Dutch Report here: https://lnkd.in/ev2JVAfb #cloud #risk #security

16

The AP is stepping up. 10,000 websites are now under review, and the first 50 warning letters have already been sent. For many organizations, enforcement by the Autoriteit Persoonsgegevens (Dutch DPA) felt like a distant issue. That time is over. A single warning can already cause reputational damage, internal stress, and time-consuming follow-ups. However, the good news is that checking your website for compliance is easier than ever. With our free Nixon Lite Privacy Audit Tool, you can scan your site today and instantly see how you score on cookie and consent compliance. Here’s what we keep seeing: → Banners that look compliant but set cookies before consent → No clear reject all button → Wording that misleads or creates confusion These issues are rarely intentional. They often come from assumptions or technical complexity. But the message from the AP is crystal clear: this needs to be addressed. We have the tools. We have the knowledge. And we have helped many organizations solve exactly this. Don't wait for a letter from the AP. Run a scan today and take control of your privacy setup. 👉 https://lnkd.in/e3UvhwSU

17

𝐘𝐨𝐮 𝐝𝐨 𝐧𝐨𝐭 “𝐦𝐚𝐤𝐞 𝐭𝐢𝐦𝐞” 𝐟𝐨𝐫 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲. 𝐘𝐨𝐮 𝐥𝐨𝐬𝐞 𝐭𝐢𝐦𝐞 𝐰𝐡𝐞𝐧 𝐲𝐨𝐮 𝐢𝐠𝐧𝐨𝐫𝐞 𝐢𝐭. A breached system does not wait for your Q4 strategy meeting. It waits for your silence. What's hurting is that most security policies are built: After the damage is done. After the employee clicks the malicious link. After your customer trust starts bleeding out. After someone asks, “How did this happen?” It happens because people are still the most overlooked attack vector. Not zero-days.  Not firewalls.  But people. I have worked with organisations that invested millions in tools but failed to teach their teams not to reuse passwords. One even had their CEO phished with an AI-deepfaked voice clone. He authorised a transfer. No alerts were triggered. No protocol stopped it. Because the protocol was never humane. Most businesses only care about cybersecurity after it becomes a PR disaster. Here is the fix, and it’s not another shiny platform: You need to embed security into every conversation, every decision, and every culture shift. Start with this: Do not just train. Rewire behaviour. Ditch the boring modules. Create simulations that feel real. Do not blame the user.  Build systems that assume mistakes will happen and catch them early. Reward secure habits like you reward KPIs. Put the human first. Always. Security is not a department. It’s a mindset. One that scales across teams, languages, and late nights. One that protects people, not just networks. 𝐀𝐬𝐤 𝐲𝐨𝐮𝐫𝐬𝐞𝐥𝐟: If your team got phished right now, would they know what to do? Not ideally.  Not theoretically.  Right now. If that answer is shaky, let’s talk. This is what I do. This is what I fix every day. What’s one human behaviour that should be part of your security strategy but isn’t yet? Let’s open the conversation before the breach does. 👥Share this post with someone who needs to see it. ---------------------------------------------------------- Hi, I am Nickson.  Your Award Winning Human-Centric Cybersecurity Expert. I Help Businesses Turn Their Teams into Cyber Defenders Through Custom Human-Centric Cybersecurity Awareness Training Programs. 👉Reach out for personalised advice and guidance. #cybersecurity #humancentric #securityawareness #securityculture

19

3 Comments