Roseman Labs’ Post

🌟 The National Vulnerability Database (NVD) has been a cornerstone in my journey towards mastering cybersecurity awareness. The detailed insights and timely updates have empowered me to stay ahead of security threats and enhance our protective measures. For anyone serious about cybersecurity, I highly recommend making NVD a part of your regular security checks. Dive into the wealth of knowledge it offers! ➡️ [NVD Website](https://nvd.nist.gov/) #Cybersecurity #InfoSec #NVD #VulnerabilityManagement

CyberLink Achieves ISO 27001:2022 Certification for FaceMe Platform - findBIOMETRICS: CyberLink Achieves ISO 27001:2022 Certification for FaceMe Platform  findBIOMETRICS #CyberSecurity #InfoSec #SecurityInsights

Confusion over what a VEX contains and what it is used for continues, based on discussions during a SBOM call today. The Cybersecurity and Infrastructure Security Agency provides clear guidance for VEX usage: https://lnkd.in/gQwuW3Vu 2.3 VEX statement A VEX statement is a declaration that MUST convey a single [status] that applies to a single [vul_id] for one or more [product_id]s. Figure 2 shows the high-level conceptual structure of the VEX statement. A VEX MUST contain a vulnerability, identified by a [vul_id] along with a status. A VEX is "vulnerability centric" used to report on the status of products with reference to a "single [vul_id] for one of more products. A VEX cannot be used as an attestation showing that a software producer has checked each SBOM component in a product for vulnerabilities to satisfy NIST SSDF attestation requirements for Executive Order 14028 per the CISA EO 14028 Common Form Attestation Appendix: https://lnkd.in/gkpC9u_X . Some products have no vulnerabilities; a VEX cannot report on "clean products" with no vulnerabilities - see clean product VDR attestation for example: https://lnkd.in/er2p7mge

Importance of Tokenisation - It's crucial to listen & react Tokenisation should be implemented as part of a comprehensive security strategy to mitigate the risks posed by OS command injection vulnerabilities and other critical CVEs. By replacing sensitive data with tokens that have no exploitable value, tokenisation ensures that even if a vulnerability is exploited, the attacker cannot access or misuse the sensitive data.

Learn best practices for API security in this hands-on workshop on March 11th. More info and registration https://lnkd.in/dHAKEREz #APIs #security #AustinAPISummit #tech #workshop

🔒 TinyMCE has achieved SOC 2 Type 2 compliance, affirming our dedication to data security in your rich text editor. Why does SOC 2 Type 2 matter? ✅ Enhanced Security: Your data is safeguarded with industry-leading standards. ✅ Demonstrated Controls: Our comprehensive measures are detailed in our SOC 2 Type 2 report. ✅ Simplified Compliance: We make it easy for you to meet strict regulations. ✅ Trusted Partner: Your trust in TinyMCE is fortified by our commitment to security. Learn more about our about our commitment to security. https://lnkd.in/dSDZfs95 #richtexteditor #TinyMCE #SOC2Type2 #compliance #SOC2

It's official: we now have our 27001:2022 certification after our recent external audit. I said it a couple of weeks ago, and I'll repeat it: I'm really proud of Orca and our team. We take security seriously and it isn't lip service at Orca. Security matters. We've taken the time and effort to quickly switch from the old standard to the latest one as soon as we possibly could. Very few of our competitors have 27001 accreditation and even fewer have pushed themselves to upgrade to the latest, most cloud-focused standards. Security isn't just words or spreadsheets. It's not just some software or quick fixes via third-party services. It's a mindset that has to be embedded from top to bottom. Don't short-change it; there's no substitute for thinking and acting securely.

API Security threats are becoming pervasive with each passing day. Organizations are learning the hard way "their perfectly written APIs can be abused". In this webinar earlier today, I spoke about why API Security is the key focus, the major challenges keeping the security executives up at night and how Akamai is partnering with our customers to solve these challenges.

Boost your #cybersecurity operations with #DifendaAIRO. ↠ Our #AIRO engine streamlines your incident responses, working seamlessly with your Microsoft Sentinel instance to enhance your capabilities. AIRO's automated system takes the pressure off your team, allowing them to focus on what truly matters. Learn more about Difenda AIRO here ➡️ https://hubs.ly/Q02cHvv90 #Automation

Maiky = Efficient and transparent information security management. Maiky offers an advanced AI-driven platform that seamlessly integrates all your existing tools and applications to provide a comprehensive overview of your information security. No more manual work but a fully automated workflow with immediate and transparent insights into all risks. Learn more at maiky.io.