🔒 To protect customer data, we proactively seek ways to scrutinize, test and validate Roseman Labs' software security and data handling practices. Security assessments are necessary for our customers to evaluate our privacy standards and platform security. In this article we give background to the assessments that our company and platform have been tested against, including our information security management system (ISMS), code reviews, and penetration tests. 🔗 Read it here 👉 https://hubs.li/Q02DPttb0 [3 minute read] One important new milestone: We passed the Baseline Security Product Assessment, a certification scheme supervised by the General Intelligence and Security Service, AIVD! DigiTrust | ISO - International Organization for Standardization | NEN | Algemene Inlichtingen- en Veiligheidsdienst - AIVD | Software Improvement Group
Roseman Labs’ Post
More Relevant Posts
-
🌟 The National Vulnerability Database (NVD) has been a cornerstone in my journey towards mastering cybersecurity awareness. The detailed insights and timely updates have empowered me to stay ahead of security threats and enhance our protective measures. For anyone serious about cybersecurity, I highly recommend making NVD a part of your regular security checks. Dive into the wealth of knowledge it offers! ➡️ [NVD Website](https://nvd.nist.gov/) #Cybersecurity #InfoSec #NVD #VulnerabilityManagement
You are viewing this page in an unauthorized frame window.
nvd.nist.gov
To view or add a comment, sign in
-
CyberLink Achieves ISO 27001:2022 Certification for FaceMe Platform - findBIOMETRICS: CyberLink Achieves ISO 27001:2022 Certification for FaceMe Platform findBIOMETRICS #CyberSecurity #InfoSec #SecurityInsights
Google News
https://findbiometrics.com
To view or add a comment, sign in
-
Confusion over what a VEX contains and what it is used for continues, based on discussions during a SBOM call today. The Cybersecurity and Infrastructure Security Agency provides clear guidance for VEX usage: https://lnkd.in/gQwuW3Vu 2.3 VEX statement A VEX statement is a declaration that MUST convey a single [status] that applies to a single [vul_id] for one or more [product_id]s. Figure 2 shows the high-level conceptual structure of the VEX statement. A VEX MUST contain a vulnerability, identified by a [vul_id] along with a status. A VEX is "vulnerability centric" used to report on the status of products with reference to a "single [vul_id] for one of more products. A VEX cannot be used as an attestation showing that a software producer has checked each SBOM component in a product for vulnerabilities to satisfy NIST SSDF attestation requirements for Executive Order 14028 per the CISA EO 14028 Common Form Attestation Appendix: https://lnkd.in/gkpC9u_X . Some products have no vulnerabilities; a VEX cannot report on "clean products" with no vulnerabilities - see clean product VDR attestation for example: https://lnkd.in/er2p7mge
Minimum Requirements for Vulnerability Exploitability eXchange (VEX)
cisa.gov
To view or add a comment, sign in
-
CEO at Zortrex - Leading Data Security Innovator | Championing Advanced Tokenisation Solutions at Zortrex Protecting Cloud Data with Cutting-Edge AI Technology
Importance of Tokenisation - It's crucial to listen & react Tokenisation should be implemented as part of a comprehensive security strategy to mitigate the risks posed by OS command injection vulnerabilities and other critical CVEs. By replacing sensitive data with tokens that have no exploitable value, tokenisation ensures that even if a vulnerability is exploited, the attacker cannot access or misuse the sensitive data.
🚨 Addressing OS Command Injection Vulnerabilities: CISA & FBI Advisory 🚨 The latest advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) illuminates the persistent issue of OS command injection vulnerabilities. This alert underscores the urgent need for software manufacturers to adopt a Secure by Design approach. Key Takeaways: 🔹 Despite extensive documentation and effective mitigations, OS command injection vulnerabilities continue to surface, putting customers at significant risk. "Despite widespread knowledge and documentation of the OS command injection vulnerabilities over the past two decades, along with the availability of effective mitigations, software manufacturers have continued to develop products with this defect, which puts customers at risk" (Page 5). 🔹 The advisory calls for decisive action from CEOs and business leaders: "CISA and FBI urge CEOs and other business leaders at technology manufacturers to request their technical leaders to analyze past occurrences of this class of defect and develop a plan to eliminate them in the future" (Page 6). 🔹 Preventative Measures: CISA and FBI urge software manufacturers to: 💥💥Use functions that preserve command syntax and arguments safely. 💥💥Conduct thorough code reviews and adversarial product testing. 💥💥Implement modern component libraries and secure coding practices. 💥💥Aggressively adopt input validation and sanitization techniques. This advisory underscores the importance of incorporating security from the design phase through development, release, and updates to protect against the most common and dangerous product defects. #CyberSecurity #SecureByDesign #CISA #Technology #InformationSecurity
To view or add a comment, sign in
-
Learn best practices for API security in this hands-on workshop on March 11th. More info and registration https://lnkd.in/dHAKEREz #APIs #security #AustinAPISummit #tech #workshop
API Security Done Right – Understanding the Threat and Best Practices for Secure API Development | Nordic APIs
https://nordicapis.com
To view or add a comment, sign in
-
🔒 TinyMCE has achieved SOC 2 Type 2 compliance, affirming our dedication to data security in your rich text editor. Why does SOC 2 Type 2 matter? ✅ Enhanced Security: Your data is safeguarded with industry-leading standards. ✅ Demonstrated Controls: Our comprehensive measures are detailed in our SOC 2 Type 2 report. ✅ Simplified Compliance: We make it easy for you to meet strict regulations. ✅ Trusted Partner: Your trust in TinyMCE is fortified by our commitment to security. Learn more about our about our commitment to security. https://lnkd.in/dSDZfs95 #richtexteditor #TinyMCE #SOC2Type2 #compliance #SOC2
Security SOC2 announcement for TinyMCE | TinyMCE
tiny.cloud
To view or add a comment, sign in
-
Director at Orca, UK's leading MSP, enjoys provoking thought and driving success for SMEs including Accountants and Law Firms.
It's official: we now have our 27001:2022 certification after our recent external audit. I said it a couple of weeks ago, and I'll repeat it: I'm really proud of Orca and our team. We take security seriously and it isn't lip service at Orca. Security matters. We've taken the time and effort to quickly switch from the old standard to the latest one as soon as we possibly could. Very few of our competitors have 27001 accreditation and even fewer have pushed themselves to upgrade to the latest, most cloud-focused standards. Security isn't just words or spreadsheets. It's not just some software or quick fixes via third-party services. It's a mindset that has to be embedded from top to bottom. Don't short-change it; there's no substitute for thinking and acting securely.
To view or add a comment, sign in
-
-
API Security threats are becoming pervasive with each passing day. Organizations are learning the hard way "their perfectly written APIs can be abused". In this webinar earlier today, I spoke about why API Security is the key focus, the major challenges keeping the security executives up at night and how Akamai is partnering with our customers to solve these challenges.
Live APAC workshop: Mastering API Security
brighttalk.com
To view or add a comment, sign in
-
Boost your #cybersecurity operations with #DifendaAIRO. ↠ Our #AIRO engine streamlines your incident responses, working seamlessly with your Microsoft Sentinel instance to enhance your capabilities. AIRO's automated system takes the pressure off your team, allowing them to focus on what truly matters. Learn more about Difenda AIRO here ➡️ https://hubs.ly/Q02cHvv90 #Automation
AIRO - Difenda
https://www.difenda.com
To view or add a comment, sign in
-
Maiky = Efficient and transparent information security management. Maiky offers an advanced AI-driven platform that seamlessly integrates all your existing tools and applications to provide a comprehensive overview of your information security. No more manual work but a fully automated workflow with immediate and transparent insights into all risks. Learn more at maiky.io.
To view or add a comment, sign in
-
Executive Director, Top Sector LSH; Professor at Erasmus MC
2moTopsector ICT Health~Holland Ministerie van Volksgezondheid, Welzijn en Sport