Netöryggisfundur Defend Iceland
Netöryggisfyrirtækið Defend Iceland, ásamt Rannís, Háskólanum í Reykjavík og Miðstöð stafrænnar nýsköpunar (EDIH-IS), hélt á dögunum hádegisfund í Grósku þar sem sjónum verður beint að forvirkum netöryggisráðstöfunum.
Á fundinum fjallaði Jacky Mallett, dósent við tölvunarfræðideild HR, um netglæpahópinn Akira, sem ber ábyrgð á fjölda alvarlegra árása á Íslandi undanfarið og nú síðast árásinni á Háskólann í Reykjavík.
Í erindinu fór Jacky meðal annars yfir skipulagða glæpastarfsemi netárásarhópa, hvaðan þeir koma og til hvaða aðgerða fyrirtæki geti gripið svo þau lendi ekki í klóm árásarhópa.
Þá ræddi Gunnar Jakobsson, varaseðlabankastjóri fjármálastöðugleika, aðgerðir Seðlabanka Íslands til að tryggja fjármálastöðugleika í umhverfi þar sem netárásum fjölgar hratt.
Guðmundur Karl Karlsson hjá Íslandsbanka deildi reynslu bankans af notkun forvirkra öryggisráðstafana, ásamt því fjallaði hann um örugga forritun og mikilvægi þess að stjórnendur fyrirtækja taki netöryggi alvarlega.
Fundarstjóri var Jóhanna Vigdís Guðmundsdóttir, stjórnandi viðskiptaþróunar, sölu- og markaðsmála hjá Defend Iceland.
Eldri fréttir
Is Your CTO Vibe-Coding?
Most of the conversation about AI and security runs in one direction: the barrier to entry for attackers is collapsing. A teenager with a chatbot can now scan, probe, and exploit at a level that used to require years of practice. That's a real problem, and it deserves the attention it gets.
Lesa meiraScraping GitHub for Secrets in Icelandic Bug Bounty - Community Blog
The idea for this project came during bug bounty work on Icelandic companies. One of the first things I always do in recon is search for the target on GitHub and Gists, looking for leaked credentials, API keys, internal URLs, anything useful. But the reality is, interesting stuff almost never comes from just searching the company name.
Lesa meiraMultiple Landspitali Employee Domain Accounts at Risk of Compromise
This report details a critical security vulnerability discovered within Landspitalinn's systems through the Defend Iceland bounty program. A series of chained vulnerabilities and misconfigurations were identified, allowing attackers to compromise multiple employee credentials and register multi-factor authentication (MFA) to themselves.
Lesa meiraPublic disclosure for a healthier cybersecurity culture
Landspitali is the leading hospital in Iceland and the largest workplace for employees in health care. It is funded by the Ministry of Welfare, supervised by the Directorate of Health and provides specialised and general care and has the capacity of approx. 700 beds. To say that it is an important organisation in Iceland is an understatement and almost every Icelander relies on their services in some way.
Lesa meiraÖryggisráð
Er lykilorðið þitt "Sumar2024!"?
Ef þú ert með lykilorð eins og „Sumar2024!“, þá gæti verið kominn tími til að íhuga breytingu. Fyrirtæki og tölvuöryggisstjórar ættu að endurskoða lykilorðastefnur sem krefjast breytinga á þriggja mánaða fresti. Rannsóknir hafa sýnt að slíkar kröfur geta leitt til fyrirsjáanlegra og veikari lykilorða, sem eykur hættuna á öryggisbrotum. Í staðinn ætti að fylgja tilmælum Microsoft um að forðast óþarfa lykilorðaskipti, og tryggja að notendur geti ekki valið lykilorð sem innihalda algenga og fyrirsjáanlega þætti eins og árstíðir, ártöl eða nöfn fyrirtækja.
Lesa meiraAðrar fréttir
Sjá allar fréttirIs Your CTO Vibe-Coding?
Most of the conversation about AI and security runs in one direction: the barrier to entry for attackers is collapsing. A teenager with a chatbot can now scan, probe, and exploit at a level that used to require years of practice. That's a real problem, and it deserves the attention it gets.
Lesa meiraScraping GitHub for Secrets in Icelandic Bug Bounty - Community Blog
The idea for this project came during bug bounty work on Icelandic companies. One of the first things I always do in recon is search for the target on GitHub and Gists, looking for leaked credentials, API keys, internal URLs, anything useful. But the reality is, interesting stuff almost never comes from just searching the company name.
Lesa meiraMultiple Landspitali Employee Domain Accounts at Risk of Compromise
This report details a critical security vulnerability discovered within Landspitalinn's systems through the Defend Iceland bounty program. A series of chained vulnerabilities and misconfigurations were identified, allowing attackers to compromise multiple employee credentials and register multi-factor authentication (MFA) to themselves.
Lesa meiraPublic disclosure for a healthier cybersecurity culture
Landspitali is the leading hospital in Iceland and the largest workplace for employees in health care. It is funded by the Ministry of Welfare, supervised by the Directorate of Health and provides specialised and general care and has the capacity of approx. 700 beds. To say that it is an important organisation in Iceland is an understatement and almost every Icelander relies on their services in some way.
Lesa meiraHow I found all corporate usernames in Iceland
One of my favorite methods to gain initial access to companies is finding valid credentials. If your target is just one employee, this might be near impossible. But what if you have hundreds, or even thousands of targets? What if the target victim is anyone in Iceland? Then gaining valid credentials goes from near impossible to near certain.
Lesa meiraWhen Retired Domains Come Back to Haunt: The Hidden Risk of Legacy Corporate Assets
Organizations evolve through mergers, acquisitions, and rebranding. Old domains get retired, but what happens when those domains can still receive password resets or act as the login email for third-party services for the previous owner? This post reveals an overlooked vulnerability we've seen through Defend Iceland's bug bounty platform: expired corporate domains that remain deeply embedded in third-party SaaS accounts. When these domains become available for registration, attackers can inherit access to SaaS accounts that still use the retired email domain for login or recovery. We'll show you exactly how this happens and why "just let it expire" is a dangerous domain retirement strategy.
Lesa meira