Ahmad Ghafouri

Now, the Part 2 of the Technical Guidline for Space Systems is published. It delivers a framework to take care about and implement information security for the ground segment. Just in time at the Cysat 2025 in Paris! https://lnkd.in/eabVAbxs

28

Progress isn't always linear, but your offensive security strategy should be. Our 7th annual State of Pentesting Report uncovers why critical vulnerabilities are slipping through the cracks—especially with new #genAI risks emerging. Build your action plan. Learn why knowledge from expert-led pentesting is power. Download the report and transform assumptions into actionable clarity. 🔗: https://hubs.la/Q03vrqqM0

18

First AI Driven Bundesamt für Sicherheit in der Informationstechnik (BSI) #Grundschutz #Audit Tool Release in MVP-2! https://lnkd.in/eTBmbf4J This project, bsi-audit-automator, automates the ISO 27001 certification audit process on the basis of BSI IT-Grundschutz. It uses AI-driven and deterministic logic to evaluate documentation from organizations seeking certification. The system operates in modular, resumable stages, and performs the following key functions: 🧠 1. Preprocessing (Ground Truth Mapping) Extracts an authoritative system structure ("Zielobjekte" and their mappings to BSI controls) from documents (e.g., A.1, A.3). Uses AI to interpret and structure this system map. Saves this as system_structure_map.json for downstream stages. 📄 2. Grundschutz-Check Data Extraction Uses Document AI to parse large PDF documents (e.g., A.4). Splits the document, runs layout parsing, groups content by Zielobjekt. Applies Gemini AI to extract security control implementation details. Produces a validated, deduplicated list of all control requirements with their implementation status. 📋 3. Audit Execution Stages Each chapter corresponds to a phase in the audit: Chapter 1: General metadata extraction (e.g., scope, institution info). Chapter 3: Document review – verifies completeness and quality of key IT-Grundschutz documents using AI prompts and rules. Chapter 4: Generates the audit plan – selects which controls and locations to audit based on risk and audit type. Chapter 5: Constructs a manual audit checklist with all relevant BSI controls, linked to Zielobjekte. Chapter 7: Adds appendices such as a list of submitted documents and all findings. 📦 Central Findings Management All deviations (AG, AS, E) from all stages are collected into a central all_findings.json. IDs are assigned, duplicates filtered, and findings are carried forward into the final report. 📤 Final Output A fully populated, structured JSON report that mirrors the BSI audit template (master_report_template.json). Designed to be loaded into a browser-based report_editor.html for review and finalization. 🛠️ Core Components AuditController: Orchestrates stage execution, state management, and finding aggregation. RagClient: Classifies source documents into BSI categories and provides context to AI prompts. AiClient: Interfaces with Gemini models and enforces JSON schema-based output validation. DocumentAiClient: Uses Google Document AI to extract structured text from PDFs. ReportGenerator: Assembles the final audit report.

23

Most Cloud and Cyber Security investments don’t fail because of technology. They fail because of poor planning, late security decisions, and unclear ownership. Over-engineering without clarity, scaling without a roadmap, and treating security as an afterthought creates systems that look good on paper - but break under real-world pressure. When Cloud, Data, and AI solutions are designed with strategy, scalability, and security built in from day one, technology stops being a cost center and starts becoming a competitive advantage. The real shift happens when systems are built as solutions, not setups. 👉 If you’re planning or rethinking a Cloud Computing, Data Analytics, or Cyber Security initiative, start with the right foundation. Let’s talk. https://bminfotrade.com ANSHUL GOYAL Gaurav Solanki Lokesh Sharma Rahul Sharma Pankaj Gupta #CloudComputing #CyberSecurity #CloudSecurity #DataEngineering #AIInfrastructure CXO ( CEO / CIO / CFO / CMO / CTO) #DigitalTransformation Microsoft #EnterpriseIT #ITStrategy #ScalableSystems Amazon Web Services (AWS) #SecureByDesign

16

The NCSC outlines the transformative potential of SCION The Swiss National Cyber Security Centre has published its report on SCION.  And I personally think it's great. Here are their main takeaways: - SCION provides significant security and control advantages over BGP, BGPsec, and RPKI.  - Isolation domains provide sovereignty by eliminating reliance on global trust infrastructures.  - Real-world deployments (e.g., SSFN and SSHN) confirm SCION’s technical maturity.  - Adoption challenges remain, and SCION needs to be combined with other security layers to offer a comprehensive cybersecurity defense solution. I'm incredibly proud of our team and everyone who has been at the forefront of bringing SCION from academic innovation to real-world deployment. The NCSC's endorsement is a clear signal that SCION is a critical component of the future of digital infrastructure.  Their message, and ours, is clear: the time to adopt SCION is now.  The foundational changes SCION brings are not just an upgrade; they are essential for building a resilient and trustworthy digital future. Let’s act together to secure our networks.    You can find the German and English versions of the document in the comments.  

248

7 Kommentare

𝗜𝗦𝗢/𝗜𝗘𝗖 𝟮𝟳𝟳𝟬𝟭:𝟮𝟬𝟮𝟱 – 𝗘𝗹𝗲𝘃𝗮𝘁𝗶𝗻𝗴 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝘁𝗼 𝘁𝗵𝗲 𝗡𝗲𝘅𝘁 𝗟𝗲𝘃𝗲𝗹 The new ISO/IEC 27701:2025 has officially been published, a long-awaited update that reshapes how organizations manage and demonstrate trust in personal data handling. As someone who has implemented and audited multiple ISO frameworks as part of my work as a Security Advisor, I see this revision as a major milestone. It reflects the growing maturity of privacy as a discipline, not just an extension of information security, but a stand-alone governance framework in its own right. Key enhancements include the ability to adopt ISO 27701 as an independent 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗜𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺 (𝗣𝗜𝗠𝗦), clearer guidance for data controllers and processors, and stronger alignment with global privacy laws like GDPR, CCPA. This evolution moves privacy beyond compliance checklists, towards measurable, accountable, and trusted data protection. Now is the time for organizations to assess their current posture and start preparing for transition. https://lnkd.in/gMqhTzic #ISO27701 #Mariner #Privacy #CyberSecurity #Governance #Compliance

28

The opening panel discussion of the CS4CA & ManuSec: OT Security Summits by QG Media Europe conference today was on: Tackling IT-OT Cyber Risk: What Should We Prioritise in Our Cyber Strategies? We have touched the topic from several angles. I would call out the most important ones for me: - Continuously bring closer IT and OT to speak more a common language, and to understand eachother well - Human factor is always the No1 element, whatever you are looking at, from whatever angle. Make awareness, train, communicate...and again - HSE and it's compliance is in most cases part of the business strategy and well understood on the shopfloor. Make cyber security the same! Thank you Nish Sukumaran Malcolm Xavier, CISSP Phil Page Joshua Deakin #otsecurity #otriskmanagement #criticalassets #cyberrisk #cybersecurity #cyber

30

1 Kommentar

Working with professionals always leads to progress. One of the system masters told me to use #ISO20000-1 processes along with #ISO27001. I thought it was a suggestion. But I saw that it was a standard. #ISO27013:2021 Information security, cybersecurity and privacy protection standard. 🙏🏻 THANKS 🙏🏻 👉🏻ISO/IEC27001 Focus on Information Assets: Its primary focus is on protecting information assets. Key specific components include: ✅Classification of information ✅Information asset management 👉🏻ISO/IEC 20000-1 Focus on Services: Its primary focus is on managing and delivering services. Key specific components include: ✅Budgeting and accounting for services ✅Business relationship management ✅Design and transition of new or changed services ✅Service level management 👉🏻Shared parts: This includes processes that are found in both standards but might have different nuances or emphases. 👉🏻Common parts: This includes fundamental principles and requirements that are essentially the same in both standards. #iso27000 #iso27001 #iso #iso27002 #itsm #itil #itbusinessprocess #isms

40

2 Kommentare

No link. No malware. Just one phone call. 🇨🇭 The Swiss National Cyber Security Centre NCSC (NCSC_CH) reports a sharp rise in “callback scams”: instead of pushing victims to click, criminals ask them to call a number about a “suspicious transaction”. You do not reach support. You reach the fraudsters. This is the shift: defenders filter links, attackers route around filters by moving the attack to voice. Your firewall cannot block a conversation. Three controls to tighten before the weekend: 1️⃣ The "Right to Hang Up": Make it official policy that ending a call abruptly is never rude. It is secure. 2️⃣ Out-of-band verification: Call back using a trusted internal number, never the one provided on the phone. 3️⃣ Psychological safety: If someone gets tricked, reward the fast report. Silence is what kills you. What is your strongest control against voice-driven fraud: training, process, or verification? 👉 https://lnkd.in/gwCDa_q7 — First time here? I'm Romain Premaz, cybersecurity leader. Follow me for daily insights.

23

1 Kommentar