Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a “POST” request that contains Read more

A vulnerability that could destroy the design of a web site has been reported by the FBI.

De FBI heeft een kwetsbaarheid gemeld die het ontwerp van een website kan vernietigen.

After this process the user crops and saves the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG.

Na dit proces kan de gebruiker het beeld bijsnijden en opslaan. Als resultaat van dit verzoek wordt de naam van de door de gebruiker verstrekte afbeelding veranderd met een MD5-waarde. Dit proces kan alleen worden uitgevoerd als de afbeelding van het type JPG of PNG is.

Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a “POST” request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.

Follow the instructions, as they will assist you in mitigating the WordPress vulnerability that been reported in CVE-2022-0377.
• Install the latest version of WordPress Navigate to the official WordPress website and download the latest version of WordPress. The latest version contains the CVE-2022-0377 fix.
• Perform a vulnerability assessment Perform a scan on your WordPress environment(s), and check for vulnerabilities. Verify if CVE-2022-0377 has been mitigated.
• Utilize the references The CVE-2022-0377 references have been provided for a reason. Utilize these references and make sure that you are correctly informed.

CVE-2022-0377: Wordpress plugin vulnerability

New CAPE platform delivers patented intelligent automation and enforcement of consumer data privacy mandates at lowest total cost of ownership.

In our series of letters from African journalists, academics and experts, the BBC’s weekly The Boss series profiles different business leaders from around the world. This week we speak to GhangorCloud.

In onze reeks brieven van Afrikaanse journalisten, academici en deskundigen, stelt de wekelijkse BBC-serie The Boss verschillende bedrijfsleiders van over de hele wereld voor. Deze week spreken we met GhangorCloud.

The CAPE platform automates tasks associated with data discovery, data classification, data mapping and consumer privacy compliance enforcement in real time across all regulatory compliance mandates including GDPR, CCPA, HIPPA, PCI, PDPB, PDPL and other data privacy laws across the globe.One of the biggest challenges that global organizations face is the pervasive risk of serious fines as mandated by consumer data privacy regulations. Under the GDPR, the EU's data protection authorities can impose fines of up to €20 million (roughly $20,372,000), or 4% of worldwide turnover for the preceding financial year – whichever is higher. Companies that fail to comply with data privacy mandates risk not only financial exposure, but also operational and reputational losses.GhangorCloud’s CAPE solution delivers a highly scalable architecture and can be quickly deployed across an enterprise as well as multi-cloud environments.

SAN JOSE, CA - (19 juli, 2022) - GhangorCloud, een toonaangevende leverancier van intelligente oplossingen voor de handhaving van informatiebeveiliging en dataprivacy, heeft vandaag zijn gepatenteerde productaanbod voor Compliance and Privacy Enforcement (CAPE) aangekondigd. De Algemene verordening gegevensbescherming (GDPR) van de EU is een van de strengste wetten op het gebied van gegevensbescherming. Op grond van de GDPR kunnen de gegevensbeschermingsautoriteiten van de EU boetes opleggen tot 20 miljoen euro (ruwweg 20.372.000 dollar), of 4% van de wereldwijde omzet over het voorgaande boekjaar - als dat bedrag hoger is.

SAN JOSE, CA – (July 19, 2022) – GhangorCloud, a leading provider of intelligent information security and data privacy compliance enforcement solutions, today announced its patented Compliance and Privacy Enforcement (CAPE) product offering. The CAPE platform automates tasks associated with data discovery, data classification, data mapping and consumer privacy compliance enforcement in real time across all regulatory compliance mandates including GDPR, CCPA, HIPPA, PCI, PDPB, PDPL and other data privacy laws across the globe.One of the biggest challenges that global organizations face is the pervasive risk of serious fines as mandated by consumer data privacy regulations. The EU General Data Protection Regulation (GDPR) is among the toughest data protection laws. Under the GDPR, the EU's data protection authorities can impose fines of up to €20 million (roughly $20,372,000), or 4% of worldwide turnover for the preceding financial year – whichever is higher. Companies that fail to comply with data privacy mandates risk not only financial exposure, but also operational and reputational losses.GhangorCloud’s CAPE solution delivers a highly scalable architecture and can be quickly deployed across an enterprise as well as multi-cloud environments. Its’ AI powered eDiscovery Engine identifies and classifies content automatically, generates privacy enforcement policies without requiring tedious manual intervention, and provides real-time enforcement of privacy mandates to minimize risk and exposure while significantly reducing total cost of ownership.“Data compliance and privacy enforcement is a daunting task that involves multiple, complex processes and requires the ability to sieve through large volumes of data corpuses at a very high rate both on-premises and across multi-cloud environments,” said Tarique Mustafa, CEO/CTO, GhangorCloud. “Leveraging our patented Intelligent Automation Engine, the CAPE platform addresses these issues with a modern-day data compliance and privacy system for expeditious and error-free performance of complex tasks, while significantly minimizing the cost of enforcement of regulatory compliance and privacy mandates.”Compliance and Privacy Enforcement (CAPETM) Solution Features Include:AI Powered Data eDiscovery:GhangorCloud’s AI powered Data Discovery Engine was architected from the ground up to address the deficiencies and constraints of previous generation data discovery solutions.
• Complex Data Object Definition: CAPE embodies unique AI based patented technologies that greatly facilitate the definition and discovery process for complex data/information objects that can represent any type of concrete and abstract data or information objects of interest. Virtually any kind of data/information such as structured, unstructured, semi-structured, ordered/unordered sets of data and data sequences can all be modelled and automatically identified and classified.
• Auto Identification: Incorporates sophisticated patented technology for auto-identification of high granularity canonical as well as complex data objects that involve components with cross modality, cross type, composite structured and unstructured, embedded, or independent canonical data types.
• Auto Classification: CAPE incorporates a unique Auto-Classification Engine that works with sophisticated data object ontologies to auto-classify sensitive information. The Auto-Classification engine examines every data/information object in the corpuses and using GhangorCloud’s patented algorithms automatically classifies it into one of the classification types defined in the data object ontology. It can classify sensitive information as granular as specific words and phrases. The Auto-Classification Engine completely replaces the requirement for manual tagging or fingerprinting of sensitive information. It can readily work out-of- the-box and does not require any pre-processing of data or a laborious training / learning process.Data MappingCAPE incorporates a sophisticated Data Mapping Engine that automatically creates a persistent Universal Data Map (UDM) for the data/information objects that exist in the enterprise corpuses. This is a crucial capability that greatly facilitates efficient navigation through large storage systems and corpuses following the lineage of any given data/information object of interest. The UDM created by the Data Mapping Engine is used effectively by the CAPE’s Privacy Enforcement Workflow Engine to automatically generate the Data Subject Request (DSR) and Data Subject Access Request (DSAR) service workflow.Privacy Request EnforcementThe Privacy Request Enforcement Engine utilizes its Universal Data Map (UDM) and Actor Repository Map (ARM) to correlate Actors (i.e., custodians of data repositories), specific set of repositories over which a given Actor has jurisdiction/authorization and the corresponding operations that they are authorized to perform on the specific data repositories. Using patented AI Algorithms, the engine can automatically discretize the incoming DSAR or DSR jobs into corresponding sets of ‘primitive’ (or atomic) tasks. The ‘primitive’ tasks are then automatically ‘serialized’ into a task sequence using the logical and precedence dependencies between these tasks. The Workflow Engine is equipped with a built-in mechanism to monitor and report the status of the DSAR or DSR fulfillment process, and raise alerts, alarms, or other notifications as appropriate during the fulfillment process.GhangorCloud’s Compliance and Privacy Enforcement solution is available now. For more information and pricing details, email About GhangorCloudHeadquartered in Silicon Valley, GhangorCloud is a leading provider of intelligent information security and data privacy compliance enforcement solutions. GhangorCloud's Information Security and Consumer Compliance solutions protect data based on its contextual and conceptual significance, using a powerful policy engine and security algorithms to identify, classify, and protect large volumes of information in real-time with unprecedented accuracy. The company is founded by Silicon Valley security veteran Tarique Mustafa and Bhanu Panda, and is backed by a team, board and advisors that include leading authorities from companies like Symantec, McAfee, Trend Micro, Cisco, Juniper, Alteon and Array Networks. For more information, see http://www.ghangorcloud.com/

GhangorCloud Announces CAPE, a Next Generation Unified Compliance and Data Privacy Enforcement Solution

FLEDGE and Google Topics can now be blocked either individually or together in the DuckDuckGo Chrome extension. Together, FLEDGE and Topics are meant to replace the standard tracking cookie used for ad targeting.

Google’s new Privacy Sandbox system has been criticised by privacy advocates.

Het nieuwe Privacy Sandbox-systeem van Google is bekritiseerd door voorstanders van privacy.

The system attempts to make personalized advertising more private by placing users in client-side interest groups, but it has been criticized by a number of privacy advocates. DuckDuckGo Chrome extension allows users to duck out of the privacy sandboxA blog post from DuckDuckGo announced that two central components of Google’s Privacy Sandbox, FLEDGE and Google Topics, could now be blocked either individually or together in its recently-updated Chrome extension. DuckDuckGo’s concerns about the privacy sandbox echo those already raised by both digital privacy groups and national regulators around the world.

Het systeem probeert gepersonaliseerde reclame meer privé te maken door gebruikers in belangengroepen aan de client-zijde te plaatsen, maar het is bekritiseerd door een aantal voorstanders van privacy. DuckDuckGo Chrome-extensie laat gebruikers wegduiken uit de privacyzandbakIn een blogpost van DuckDuckGo werd aangekondigd dat twee centrale onderdelen van Google's Privacy Sandbox, FLEDGE en Google Topics, nu afzonderlijk of samen kunnen worden geblokkeerd in zijn onlangs bijgewerkte Chrome-extensie. De bezorgdheid van DuckDuckGo over de privacy sandbox is een echo van de bezorgdheid die reeds werd geuit door zowel digitale privacy groepen als nationale regelgevers over de hele wereld.

DuckDuckGo has been engaged in a back-and-forth battle with Google over user privacy as of late, and the company has fired another shot by enabling its Chrome extension to block Google’s new “privacy focused” ad targeting system.

Google has been wheeling out its new “Privacy Sandbox” ad targeting approach in stages, focusing on making changes to its Chrome browser as the first steps. The system attempts to make personalized advertising more private by placing users in client-side interest groups, but it has been criticized by a number of privacy advocates.

DuckDuckGo Chrome extension allows users to duck out of the privacy sandbox

A blog post from DuckDuckGo announced that two central components of Google’s Privacy Sandbox, FLEDGE and Google Topics, could now be blocked either individually or together in its recently-updated Chrome extension. Together, FLEDGE and Topics are meant to replace the standard tracking cookie used for ad targeting (which Google intends to put an end to in Chrome by the end of 2022). The system is supposed to enhance privacy by putting users in “interest buckets” instead of building individual profiles on them, with the processing of those buckets handled browser-side so that third parties have very limited access to it.

DuckDuckGo’s concerns about the privacy sandbox echo those already raised by both digital privacy groups and national regulators around the world. Regulators have tended to be more concerned with the antitrust end of the proposal, speculating that Google will force the digital advertising market to route itself through this technology. Privacy advocates point out that Google will also still have access to information about potentially sensitive demographic categories, and that it is not impossible for third party advertisers to use this system to identify and track individuals. DuckDuckGo’s Chrome extension thus already has an interested market in spite of Google’s new systems not yet being finalized.

The criticism is not particularly well-timed for the DuckDuckGo Chrome extension given the recent revelation that its web browser, which is touted as blocking all third-party user tracking, has been quietly allowing Microsoft-owned services (such as Bing and LinkedIn) to track and profile users. DuckDuckGo did not disclose this to the public, and it only came to light when a security researcher tracked traffic from the browser and found it feeding information to Microsoft ad targeting services. This forced the CEO of DuckDuckGo to disclose that its contractual search partnership with Microsoft requires them to allow this sort of user tracking.

When Google first announced the Privacy Sandbox concept about two years ago, the original plan was to use a system called “Federated Learning of Cohorts” (FLoC) to replace tracking cookies. The FLoC plan was scrapped in early 2022 due to criticism of its use of “cohorts” of users with similar interests as the mechanism used to deliver ads. Topics was designed to replace the cohort system with about 300 standard categories; the user will be assigned to the top three categories they are interested in based on their browsing activity over the prior three weeks, with the categories rotating at least once a month. Google has promised that Chrome users will be able to see the categories they are currently assigned to and to temporarily disable or entirely remove Topics categories they do not want to be associated with. Depending on the level of privacy controls it settles on, this could ultimately make the DuckDuckGo Chrome extension redundant.

Chrome is the only web browser that Google can force implementation of this concept into, but it appears to be hoping that other browsers will buy in to the system due to its heavyweight digital advertising program. This is the part that has raised the antennae of national antitrust regulators, who fear that Google’s dominance of the digital marketing space could essentially force everyone to use whatever ad targeting system it settles on.

Google’s Topics has alarmed privacy advocates as it does not preclude the possibility of third parties using browser fingerprinting techniques to track individuals, and could even inadvertently assist them in the process. Google has proposed to counter this with something called the “Privacy Budget,” a system that would allot websites only a certain amount of access to user information before they are cut off. Some research indicates that the system may leak information, the tracking mechanism itself could be used by wily websites as an identifier, and it could potentially break the function of websites that exceed the information limit.

The DuckDuckGo Chrome extension is available via the Google Play Store, and does not appear to allow ad targeting by Microsoft products in the way that the company’s “Privacy Browser” does. Google’s schedule for the Privacy Sandbox project has Topics and FLEDGE fully implemented in Chrome by the end of 2022, but the privacy budget is still listed as being in the “early stages” and will not be ready prior to 2024.

DuckDuckGo Escalates Showdown With Google; Chrome Extension Now Blocks Google Topics and FLEDGE Ad Targeting System

As President of Global Affairs, former UK Deputy Prime Minister Nick Clegg will craft policy and deal with political issues so Zuckerberg doesn't have to.

Deputy Prime Minister Nick Clegg has been promoted as the new president of Facebook.

Vice-premier Nick Clegg is gepromoveerd tot de nieuwe president van Facebook.

Honestly, all that sounds pretty similar to Clegg’s mandate under his previous role as Vice President of Global Affairs and Communication. As Zuckerberg explains, President of Global Affairs Clegg, who once answered to Chief Operating Officer Sheryl Sandberg, will now report directly to Zuckerberg. Presumably, the change will also come with several hefty bucket fulls of cash for Clegg.

Sinds zijn aanstelling heeft Clegg zich soms gedragen als Meta's gehoorzame aanvalshond, door opiniestukken te schrijven waarin hij grote critici van Facebook van repliek dient en waarin hij de vermeende deugden van het bedrijf uitbundig aanprijst. Toch zag Facebook naar verluidt potentieel in Clegg als een nuttig bolwerk tegen dreigende EU-regelgeving dankzij zijn connecties in het Europees Parlement. Oh, en het bedrijf is ook nog steeds herstellende van een van de ergste koersdalingen in zijn geschiedenis en wordt geconfronteerd met teruglopende nieuwe gebruikers voor zijn vlaggenschipproducten.

Mark Zuckerberg has named a new sucker to take his punches. In a blog post, Meta’s founder and CEO said Nick Clegg would now “lead our company on all policy matters,” and decide how the company interacts with governments under the new, glitzy title, “President, Global Affairs.”

The promotion will see Clegg act as the point man for all things Facebook-speak and will have him “make the case publicly for [Meta’s] products and [Meta’s] work.” Presumably, this will mean continuing the company’s deep-pocketed assault against brewing antitrust legislation and convincing lawmakers to let Meta literally co-write new privacy laws to benefit themselves.

Honestly, all that sounds pretty similar to Clegg’s mandate under his previous role as Vice President of Global Affairs and Communication. The core difference with the position change, it seems, is one of scope. As Zuckerberg explains, President of Global Affairs Clegg, who once answered to Chief Operating Officer Sheryl Sandberg, will now report directly to Zuckerberg. Presumably, the change will also come with several hefty bucket fulls of cash for Clegg. How much would it cost for you to take on a role as the policy and political face of one of the tech least trusted companies?

Towards the end of his post, Zuckerberg let readers in on more of the real reasons for Clegg’s promotion.

“As Nick takes on this new leadership role, it will enable me to focus more of my energy on leading the company as we build new products for the future,” Zuckerberg said. “And it will support Sheryl as she continues to focus on the success of our business.”

In other words, Clegg’s new role will require him to bear the responsibility for Meta’s actions and clean up years’ worth of political, social, and moral morass concocted under the founder’s watch. But hey, it’s mai tais and metaverses for Mark!

For those unaware, Clegg joined Meta (then Facebook) back in 2018 following a lengthy career in UK politics. Clegg served as a member of the Liberal Democrats after spending five years in the European parliament, eventually working his way up to Deputy Prime Minister. Under his tenure, the party went from holding 57 seats to just eight. We’ll let you be the judge of his political effectiveness.

Still, Facebook reportedly saw potential in Clegg as a useful bulwark against impending EU regulations thanks to his connections in the European parliament. The context for his arrival is important as well. Clegg hopped onboard months after Europe’s General Data Protection Regulation (GDPR) went into effect and less than one full year after Facebook’s Cambridge Analytica debacle.

Since he was hired, Clegg has at times acted like Meta’s obedient attack dog, authoring op-eds pushing back against major Facebook critics and presenting full-throated praise of the company’s supposed virtues. Recently, Clegg was at the forefront of Meta’s skirmish with news outlets and whistleblower Frances Haugen over the myriad salacious accusations of wrongdoing included in what’s come to be known as “The Facebook Papers.”

Clegg was also instrumental in convincing Zuckerberg and Sandberg to take a more tactical approach to government regulation, according to the recent book An Ugly Truth, opting to convince lawmakers to craft soft, favorable regulation rather than oppose new rules outright.

“He [C legg] said regulations were inevitable, so Facebook needed to lead tech companies in a public campaign to create light-touch, rules instead of more stringent laws,” the book’s authors Sheera Frenkel and Cecilia Kang write. Clegg also reportedly advised Meta’s top leadership to increasingly invoke the “what about China” argument to sidestep criticism around Meta’s outsized economic impact and political power within the U.S.

Still, it’s hard to say whether Clegg’s efforts have left the company in a better position than it would’ve been without him.

One thing’s for sure, Clegg will certainly have his work cut out for him in his new gig. President Biden’s regulation-hungry FTC and DOJ appear poised to take a far more aggressive stance in coming years. Meanwhile, antitrust legislation with wide bipartisan support is clawing its way through Congress and could present serious threats to Meta’s business model. Oh, and the company is also still recovering from one of the worst stock-free falls in its history and faces dwindling new users across its flagship products. Even Peter Thiel, Facebook’s original money-man, has decided to jump ship.

Rather than address those issues though, the company’s founder appears more interested in drifting off into a lame virtual reality play place with his recently ascribed “Metamates.”

Facebook Has a New Metascapegoat

Network segmentation is a best practice and when done correctly it improves network security and

The SolarWinds breach has been linked to a massive cyber-attack that has left more than 100 people dead.

De inbreuk bij SolarWinds is in verband gebracht met een grootschalige cyberaanval waarbij meer dan 100 mensen om het leven zijn gekomen.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured.

Elke organisatie loopt het risico op cyberaanvallen, en het is verontrustend dat de aanvallers zo goed zijn in het maximaliseren van de schade aan hun slachtoffers. Aanvallers die de bedrijfsverdediging omzeilen, zullen zich zo lang mogelijk in het netwerk verbergen, zelfs als ze van plan zijn een ransomware-aanval uit te voeren. Lange verblijftijden verhogen de schade van een aanval, vaak op een manier die niet kan worden gemeten.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. Their tactics are increasingly sophisticated and often involve some type of email attack, bot attack, or even just old-school social engineering. Attackers who bypass company defenses will hide inside the network as long as possible, even if they’re planning to launch a ransomware attack. They use this time to explore the network, steal data and user credentials, destroy backups, and do anything else they can do to set themselves up for future attacks.

The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured. The SolarWinds breach is the perfect example of this. The intruders entered the network in early 2019 and were not discovered until December 2020. The exact number of victims and costs associated with the attack remain unknown.

Network segmentation is one of the easiest and most effective ways to reduce dwell time. For those of you not familiar with this practice, it’s just like it sounds: You divide your network into different sections (segments) and you ‘lock the doors’ between them.

You’ve seen this concept at work in high-security buildings that restrict access to certain parts of the facility to people who have been granted permission to enter that restricted section. This keeps people from wandering around and exploring areas that are critical to operations or contain sensitive information. Segmentation does something similar for your network.

There are immediate security benefits to separating your network into multiple contained segments:
• Segmentation creates a smaller attack surface within the network. An intruder will be limited to the segment that was breached. The attacker can go no further unless they successfully breach another segment. Isolating your mission-critical servers and data can prevent an intruder from gaining access to your resources through a neglected printer or rogue smart device.
• Segmentation makes it easier to detect and isolate security incidents. The division between the segments helps contain the spread of malware and viruses. It limits the areas where the intruder can hide, and it can improve the efficiency of security monitoring.

There are non-security benefits as well. For example, POS devices fall under strict compliance rules. Assigning POS devices their own segment helps companies by limiting the cardholder data environment (CDE) and reducing the scope of PCI DSS compliance.

Segmentation also improves network performance by separating traffic. A good example of improving both security and performance is the separation of a public network from private resources. A shopping center or school campus that offers free wireless access to guests would want that traffic separated from the line-of-business applications. This keeps the potential traffic congestion of public wireless access isolated to assigned segments.

Gartner analysts have warned against over-segmentation, which can complicate the management and use of the network. One Gartner study found that over 70% of segmentation projects had to be re-architected because the segmentation made it too difficult for authorized users to access what they needed to perform their work.

“A principle of network segmentation is to group like resources together, to minimize security overhead: Build a fence around the car park, not a fence and gate around every car. ~Gartner”

Barracuda can help you secure your network while making it easier to manage. Visit our website for more information on Barracuda CloudGen Firewall, secure SD-WAN, and other network security solutions.

How network segmentation can help secure your business

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

NFTS Are Cool but Dangerous

By Randy Reiter CEO of Don’t Be Breached April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers' databases after bypassing authentication. "By exploiting

Hackers could have exploited a vulnerability in Microsoft’s databases, according to researchers.

Hackers hebben volgens onderzoekers misbruik kunnen maken van een kwetsbaarheid in de databases van Microsoft.

By Randy Reiter CEO of Don’t Be BreachedApril, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

Door Randy Reiter CEO van Don't Be BreachedIn april 2022 meldde Microsoft dat kwetsbaarheden in zijn Azure Database voor PostgreSQL hackers toegang konden verschaffen tot de databases van andere klanten nadat ze de authenticatie hadden omzeild. Volgens Microsoft heeft zijn analyse geen aanwijzingen opgeleverd dat aanvallers de kwetsbaarheden hebben misbruikt om toegang te krijgen tot klantengegevens. Wiz zei dat Microsoft zijn onderzoekers een bounty van 40.000 dollar heeft toegekend - het bedrag kan worden gezien als een bevestiging van de ernst van de kwetsbaarheid.

By Randy Reiter CEO of Don’t Be Breached

April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. “By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases” the Microsoft Security Response Center reported.

The cloud security firm Wiz’s research team discovered the security vulnerabilities. An attacker could create a full copy of a target database in Azure PostgreSQL [Flexible Server], essentially exfiltrating all the information stored in the database, says Ami Luttwak, co-founder and CTO at Wiz.

Microsoft said it mitigated the issue on Jan. 13, 2022, less than 48 hours after Wiz had notified it of the issue. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

How to Have Exploited the Database Vulnerability

As explained by Microsoft, the Wiz researchers went through the following steps to gain elevated privileges and remote code execution, which allowed them to bypass cross-account authentication using a forged certificate and access other customers’ databases:
• Retrieve the target’s common name from the Certificate Transparency feed.
• Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.
• Create an attacker-controlled database in the target’s Azure region.
• Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.
• Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

How to Prevent Data Exfiltration and Data Breaches in Todays Complex Environment

Multiple layers of data protection are required today to prevent Data Exfiltration and Data Breaches. In 2020 the DHS, Department of State, U.S. Marine Corps and the Missile Defense Agency recognized this and all issued requests for proposals (RFP) for network full packet data capture for Deep Packet Inspection analysis (DPI) of network traffic. This is an important step forward protecting confidential database data and organization information.

Zero-day vulnerabilities that allow hackers to gain system privileges are a major threat to all organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax ID, medical, social media, corporate, manufacturing, trade secrets, law enforcement, defense, homeland security, power grid and public utility data. This confidential data is almost always stored in DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.

How to Stop Data Exfiltration and Data Breaches with Deep Packet Inspection

Protecting encrypted and unencrypted confidential database data is much more than securing databases, operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply Chain Attacks.

Non-intrusive network sniffing technology can perform a real-time Deep Packet Inspection (DPI) of 100% the database activity from a network tap or proxy server with no impact on the database servers. The database SQL activity is very predictable. Database servers servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day. Deep Packet Analysis does not require logging into the monitored networks, servers or databases. This approach can provide CISOs with what they can rarely achieve. Total visibility into the database activity 24×7 and 100% protection of confidential database data.

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the normal database activity is. Now the database query and SQL activity can be non-intrusively monitored in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive to setup and has a low cost of operation. Now non-normal database activity from Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The Security Team can be immediately notified and the Hacker session terminated so that confidential database data is not stolen, ransomed or sold on the Dark Web.

Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database Data Breach prevention product for DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and SAP Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at rreiter@DontBeBreached.com, www.DontBeBreached.com and www.SqlPower.com/Cyber-Attacks.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Azure PostgreSQL User Databases Were Exposed Due to Critical Vulnerabilities

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in

A Canadian manufacturing company says it has been forced to freeze its operations following a cyber attack.

Een Canadees productiebedrijf zegt dat het gedwongen is zijn activiteiten te bevriezen na een cyberaanval.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure. It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Woordvoerster Biliana Necheva zegt in een e-mail dat de operaties meer dan 48 uur nadat ze uit voorzorg waren stopgezet, nog niet zijn hervat. Dit komt op een moeilijk moment voor BRP, aangezien de problemen met de toeleveringsketen de verkoop in het eerste kwartaal hebben gedrukt. Voor de rest van het jaar worden nog meer invoerbelemmeringen verwacht voor de fabrikant van motorvoertuigen.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday.

Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure.

The Quebec-based company, which manufactures Ski-Doos and off-road vehicles, announced Monday morning it was the target of “malicious cybersecurity activity” and took “immediate measures to contain the situation.”

Deploying its own information technology staff, BRP also said it hired cybersecurity experts to help secure its systems and support an internal investigation.

The company said its freeze on operations could delay some transactions with customers and suppliers.

It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Spun off from Bombardier Inc. in 2003, BRP employs nearly 20,000 workers, mainly at manufacturing and distribution sites in Mexico, Canada, Austria, the United States, Finland and Australia. Its products are sold in more than 120 countries.

This report by The Canadian Press was first published Aug. 11, 2022.

BRP operations remain frozen more than two days after cyberattack

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder. Police were called to

Two men have been charged with murder after a fatal stabbing in Saskatoon.

Twee mannen zijn aangeklaagd voor moord na een dodelijke steekpartij in Saskatoon.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed. The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital. Police did not identify the two men in the case.

De politie werd in juni opgeroepen naar het Royal University Hospital in Saskatoon nadat een 55-jarige man was neergestoken. De verdachte werd aanvankelijk poging tot moord ten laste gelegd, maar de politie zegt dat de aanklacht werd opgewaardeerd nadat de man onlangs in het ziekenhuis aan zijn verwondingen was bezweken. De politie heeft de twee mannen in de zaak niet geïdentificeerd.

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed.

The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital.

Police did not identify the two men in the case.

They say the accused is in custody and scheduled to appear in court today.

It’s the seventh homicide in Saskatoon so far this year.

This report by The Canadian Press was first published Aug. 11, 2022.

CVE-2022-0377: Wordpress plugin kwetsbaarheid

Vergelijkbare publicaties

Hoe netwerksegmentatie uw bedrijf kan beveiligen

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Azure PostgreSQL gebruikersdatabases werden blootgesteld als gevolg van kritieke kwetsbaarheden

Verrichtingen BRP blijven meer dan twee dagen na cyberaanval bevroren

Aanklacht tegen man van steekpartij in ziekenhuis Saskatoon is verhoogd na overlijden slachtoffer

Gevonden topics

GhangorCloud kondigt CAPE aan, een volgende generatie oplossing voor uniforme naleving en handhaving van gegevensprivacy

DuckDuckGo escaleert strijd met Google; Chrome-extensie blokkeert nu Google Topics en FLEDGE Ad Targeting System

Facebook heeft een nieuwe zondebok