Endpoint Cybersecurity GmbH offers cybersecurity consulting, services, and training, focusing on securing companies by leveraging expertise in cybersecurity, software development, and compliance certifications.

Endpoint Cybersecurity GmbH

Endpoint Cybersecurity GmbH provides cybersecurity consulting, services, and training. The company emphasizes the priority of cybersecurity for businesses by leveraging expertise in various certifications and security management systems.

Endpoint Cybersecurity GmbH | 96 followers on LinkedIn. Consulting services for building better security products and services. | Consulting services for building better security products and services.

CEO and Owner @ EndPoint Cybersecurity | IT & Automotive Cyber Security Expert, creating security products

Sorin Mustaca

In the previous article, we explored how Scrum enables teams to add security to the backlog and prioritize it based on risk. Incorporating security into the SDLC ensures that security is not an afterthought but an integral part of the development process. Security User Stories are specific, actionable items that articulate the security needs of the software in the same way functional requirements are handled. Writing Security User Stories complements this process by providing clear, actionable security requirements that can be integrated into each sprint. By treating security stories with the same importance as functional stories, developers can ensure that the software they build is not only feature-complete but also secure. &nbsp; What are Security User Stories? Security User Stories are descriptions of security requirements written from the perspective of the user or the system. They focus on specific security needs, ensuring that the software not only meets functional requirements but also protects against potential vulnerabilities. Just like traditional user stories that describe a feature or function, security stories express how the system should behave securely. A typical Security User Story follows the same format as a regular user story: As a , I want , so that . For example, a Security User Story for web development might look like this: &#8220;As a user, I want my session to expire after 15 minutes of inactivity, so that my account is protected from unauthorized access.&#8221; Why are Security User Stories Needed? Security is often treated as an afterthought, addressed late in the development process or after an incident occurs. This reactive approach leads to vulnerabilities, increased technical debt, and costly security fixes post-release. Security User Stories shift this paradigm by making security an integral part of the development process from the outset. They are necessary for several reasons: Proactive Security Integration: By incorporating security needs into the backlog from the start, you ensure that security considerations are addressed in each sprint, reducing the risk of vulnerabilities later on. Clear Requirements for Developers: Security User Stories provide clear, actionable security requirements, helping developers understand exactly what is expected to make the software secure. Accountability: Writing security stories holds the development team accountable for implementing security features and allows for better tracking of security tasks within the development cycle. Risk Mitigation: When security is considered early in the SDLC, potential security issues are identified and addressed before they become significant risks. This aligns with the concept of “Shift Left” security, where security is integrated into earlier stages of the development process. How to Use Security User Stories Security User Stories should be written as part of the Product Backlog and prioritized based on the level of risk or impact.

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we end the series with ISO 27001:2022 Annex A.18, &#8220;Compliance&#8221;, which addresses the importance of ensuring that organizations comply with relevant laws, regulations, contractual agreements, and other requirements related to information security. This annex focuses on ensuring that the organization identifies and adheres to all applicable legal, statutory, regulatory, and contractual requirements regarding information security and the requirements of the ISMS itself. Contents Toggle Understanding the Importance of ComplianceKey Controls in Annex A.18:Practical Implementation of Annex A.18Legal and Regulatory Compliance AssessmentContractual Compliance ManagementRisk Management and Compliance MonitoringMore examplesAuditing Annex A.18 ImplementationConclusion Understanding the Importance of Compliance Annex A.18 is divided into several controls designed to help organizations manage and demonstrate compliance with various information security requirements. These controls aim to prevent breaches of legal, statutory, regulatory, or contractual obligations related to information security and the security requirements of the organization. Compliance with legal, regulatory, and contractual requirements is essential for organizations to maintain the confidentiality, integrity, and availability of information assets and mitigate legal and regulatory risks. Annex A.18 emphasizes several key aspects: Legal and Regulatory Requirements: Identifying and understanding applicable laws, regulations, and industry standards related to information security. Contractual Obligations: Ensuring compliance with contractual agreements, service level agreements (SLAs), and data protection agreements with customers, partners, and suppliers. Risk Management: Assessing and mitigating legal and regulatory risks associated with non-compliance, including financial penalties, legal liabilities, and damage to reputation. Key Controls in Annex A.18: A.18.1.1 Identification of Applicable Legislation and Contractual Requirements: Identify all relevant requirements that the organization must comply with. A.18.1.2 Intellectual Property Rights (IPR): Ensure protection of IPR, covering software, information content, and patents. A.18.1.3 Protection of Records: Securely manage records in accordance with legal, regulatory, and contractual requirements. A.18.1.4 Privacy and Protection of Personally Identifiable Information: Ensure the protection of personal information as per privacy laws and other requirements. A.18.1.5 Regulation of Cryptographic Controls: Use cryptographic controls as required by legislation, regulations, and agreements. Practical Implementation of Annex A.18 Legal and Regulatory Compliance Assessment Practical Examples Regulatory Mapping: Identify and map relevant legal and regulatory requirements, such as data protect

We described here the process needed to perform a gap analysis for NIS2, but we did not add the details on how to approach this. This article references on the ISO27001:2022 series, especially on the description of the Annex A controls. Make sure you are familiar with the ISO 27oo1:2022 requirements and the with the Annex A. Contents Toggle IntroductionUnderstand NIS2 RequirementsOverview of ISO 27001:2022SimilaritiesMapping NIS2 to ISO27001:2022 requirementsStep 1: Identify NIS2 requirementsStep 2: Map requirements to the ISO 27001:2022 chaptersConclusion Introduction The NIS2 Directive, aimed at strengthening network and information system security across the European Union, necessitates a thorough alignment with the latest iteration of the ISO 27001 standard, which was updated in 2022. This article explores a comprehensive methodology for conducting a gap analysis to ensure compliance with NIS2 using the framework provided by ISO 27001:2022. Understand NIS2 Requirements The NIS2 Directive expands upon its predecessor by setting stringent cybersecurity and resilience measures for essential and important entities across various sectors. Its key focus areas include incident response, supply chain security, and the security of network and information systems. These areas are critical in maintaining the integrity and availability of services that are vital to the internal market and public welfare. &nbsp; The NIS2 Directive does not prescribe a specific set of controls for the affected companies. Rather, it states that they should adopt measures that are appropriate to their specific risk profile, considering factors such as: The state of the art in cybersecurity The potential impact of incidents on their services The costs of implementing the measures The proportionality between the measures and the risks The directive also refers to existing standards, guidelines, and best practices that can help entities to choose suitable controls. For example, it mentions: The NIST Cybersecurity Framework The ENISA Good Practices for Security of Internet of Things The ETSI Technical Specification on Critical Security Controls for Effective Cyber Defense &nbsp; Read here our collection of articles about the NIS2 directive. Overview of ISO 27001:2022 ISO 27001:2022 establishes requirements for an Information Security Management System (ISMS), providing a systematic approach to managing sensitive company information so that it remains secure. It includes people, processes, and IT systems by applying a risk management process and clearly defines information security control requirements in its Annex A . &nbsp; Similarities Despite the differences in scope, objectives, requirements and controls, there are some similarities between the NIS2 Directive and the ISO 27001:2022 standard. Here are the most evident similarities : Risk management: Both frameworks are based on the concept of risk management, which inv

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.17, &#8220;Information Security Aspects of Business Continuity Management&#8221; is crucial for organizations to ensure the resilience of their information security management systems (ISMS) in the face of disruptive events. This annex provides guidelines for integrating information security into business continuity management processes to minimize the impact of disruptions and ensure the continuity of critical business operations. Contents Toggle Understanding the Importance of Business Continuity ManagementKey Controls in Annex A.17:Practical Implementation of Annex A.17Auditing Annex A.17 Implementation Understanding the Importance of Business Continuity Management Annex A.17 of ISO 27001:2022 outlines the controls necessary to ensure that information security is an integral part of the organization’s business continuity management. The annex emphasizes the need to prepare for, respond to, and recover from incidents that can impact the availability of critical information assets. Business continuity management (BCM) is essential for organizations to prepare for and respond to disruptions that could affect their ability to deliver products and services. Annex A.17 emphasizes several key aspects: Risk Assessment: Identifying and assessing risks that could disrupt business operations and impact information security. Business Impact Analysis: Evaluating the potential consequences of disruptions on critical business processes and information assets. Business Continuity Planning: Developing and implementing strategies and procedures to maintain essential functions during and after disruptive events. Testing and Exercise: Conducting regular testing and exercises to validate the effectiveness of business continuity plans and improve response capabilities. &nbsp; Key Controls in Annex A.17: A.17.1 Information Security Continuity: Ensure that information security continuity is embedded within the organization’s overall business continuity management systems. A.17.2 Redundancies: Implement redundancy measures to ensure availability of information processing facilities. Practical Implementation of Annex A.17 Risk Assessment and Business Impact Analysis (BIA): Example: An e-commerce company assesses the impact of a server downtime on its operations. The BIA shows significant revenue loss for each hour of downtime. Implementation: Develop and implement continuity strategies based on the results of BIA. This includes identifying critical systems and processes and the extent of their protection. Establishing Redundancy and Resilience: Example: A financial institution uses multiple data centers in geographically diverse locations to ensure data availability even in the case of a natural disaster. Implementation: Invest in redundant hardware, failover systems, and data mirroring

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.16, &#8220;Information Security Incident Management&#8221; is crucial for organizations to effectively detect, respond to, and recover from security incidents. This annex provides guidelines for establishing an incident management process to minimize the impact of security breaches and ensure the continuity of business operations. Contents Toggle Understanding the Importance of Information Security Incident ManagementImplementing Annex A.16 in PracticeEstablishing Incident Management ProceduresPractical Examples:Incident Response and ContainmentPractical ExamplesIncident Analysis and RecoveryPractical ExamplesAudit of Compliance with Annex A.16Conclusion Understanding the Importance of Information Security Incident Management Incident management is a fundamental aspect of information security, helping organizations mitigate the impact of security incidents and protect sensitive information assets. Annex A.16 emphasizes several key aspects: Timely Response: Promptly detecting and responding to security incidents minimizes their impact on operations and prevents further damage. Containment and Recovery: Implementing effective containment and recovery measures helps restore affected systems and data to normal operations. Continuous Improvement: Regularly reviewing and updating incident management procedures ensures their effectiveness and alignment with evolving threats and technologies. Implementing Annex A.16 in Practice Establishing Incident Management Procedures Practical Examples: Incident Identification: Implement mechanisms to detect and identify security incidents, such as intrusion detection systems (IDS), security information and event management (SIEM) systems, and user reporting mechanisms. Incident Classification: Define criteria for classifying incidents based on severity, impact, and urgency to prioritize response efforts effectively. Incident Response Team: Establish an incident response team comprising key personnel responsible for coordinating and executing incident response activities. Incident Response and Containment Practical Examples Response Plan: Develop incident response plans outlining roles, responsibilities, and actions to be taken during security incidents, including containment, eradication, recovery, and communication procedures. Containment Measures: Implement measures to contain and mitigate the impact of security incidents, such as isolating affected systems, disabling compromised accounts, or blocking malicious traffic. Evidence Preservation: Preserve evidence related to security incidents for forensic analysis and investigation purposes, ensuring the integrity and admissibility of evidence. Incident Analysis and Recovery Practical Examples Root Cause Analysis: Conduct root cause analysis to identify the underlying causes of security inci

The NIS 2 Directive is a set of cybersecurity guidelines and requirements established by the European Union (EU) . It replaces and repeals the NIS Directive (Directive 2016/1148/EC) . The full name of the directive is “Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)” . The NIS 2 Directive aims to improve cybersecurity risk management and introduce reporting obligations across sectors such as energy, transport, health, and digital infrastructure . It provides legal measures to boost the overall level of cybersecurity in the EU . The directive covers a larger share of the economy and society by including more sectors, which means that more entities are obliged to take measures to increase their level of cybersecurity . The management bodies of essential and important entities must approve the cybersecurity risk-management measures taken by those entities, oversee its implementation, and can be held liable for infringements . Contents Toggle Who is affected?DeadlinesHow does the NIS 2 Directive differ from the previous directive?ConsequencesWhat&#8217;s next, if you are in a hurry1. Scope of Application2. Risk Management Measures3. Incident Response and Reporting4. Supply Chain Security5. Interoperability and Cooperation6. Security and Network Systems7. Regulatory Oversight and Compliance8. Financial Penalties9. Cybersecurity Measures Specificity &nbsp; Who is affected? The NIS 2 Directive significantly expands the sectors and type of critical entities falling under its scope. As a ground rule, companies from certain areas that meet these conditions are affected: Essential Entities (EE): at least 250 employees and 50 Mil € revenue Important Entities (IE): at least 50 employees and 10 Mil € revenue &nbsp; NIS 2 covers areas such as Essential Entities: energy (electricity, district heating and cooling, oil, gas and hydrogen); transport (air, rail, water and road); banking; financial market infrastructures; health including manufacture of pharmaceutical products including vaccines; drinking water; waste water; digital infrastructure (internet exchange points; DNS service providers; TLD name registries; cloud computing service providers; data centre service providers; content delivery networks; trust service providers; providers of public electronic communications networks and publicly available electronic communications services); ICT service management (managed service providers and managed security service providers), public administration and space. Important Entities: postal and courier services; waste management; chemicals; food; manufacturing of medical devices, computers and electronics, machinery and equipment, motor vehicles, trailers and semi-trailers a

We wrote here about NIS2 and we will continue to add more content about it. Because we are getting closer to October 17th, many people are getting more and more nervous about NIS2. Despite its significance, there are numerous misconceptions and misinterpretations circulating about the scope and implications of this regulation. This article aims to clarify some of the misconceptions, which I collected mostly from LinkedIn and articles about NIS-2. &nbsp; Note: &#8220;NIS2&#8221; and &#8220;NIS-2&#8221; are exactly the same thing. I am using both in this article only because of SEO. &nbsp; Contents Toggle 1. NIS2 starts being applied in the EU starting 17.10.20242. Limited scope of application3. NIS-2 Is Just About Cybersecurity4. NIS-2 compliance is the same across all EU countries5. Heavy penalties are the main compliance driver6. NIS-2 does not affect third-party suppliers7. NIS-2 contains rules for AI, IoT, Industry 4.0.8. Any company with activity in the domains marked as Important and Essential is affected by NIS-29. All affected companies must certify for NIS-210. Companies can buy software/hardware products to become conform with NIS-2 &nbsp; 1. NIS2 starts being applied in the EU starting 17.10.2024 Truth is that the regulation is already applicable in the EU since it was approved. This deadline applies to the individual countries of the EU to convert and apply the NIS2 requirements in local laws. If national authorities fail to properly implement EU laws, the Commission may launch a formal infringement procedure against the country in question. If the issue is still not settled, the Commission may eventually refer the case to the Court of Justice of the European Union. &nbsp; 2. Limited scope of application Contrary to the belief that NIS-2 only applies to large tech companies, the directive significantly broadens its scope compared to its predecessor, NIS. NIS-2 extends beyond just critical infrastructure sectors like energy and transport, encompassing a wide array of sectors such as digital services, public administration, and healthcare. It mandates a security and incident reporting framework that applies to both Essential and Important Entities, significantly expanding the list of sectors and services affected. 3. NIS-2 Is Just About Cybersecurity While cybersecurity is a core component, NIS-2 is not merely about preventing cyberattacks. The directive emphasizes a comprehensive approach to security, which includes resilience against a wide range of threats. This includes but it is not limited to: supply chain security, incident response, and crisis management. It establishes a baseline for security measures and incident notifications that entities must adhere to, ensuring a uniform level of security across member states. 4. NIS-2 compliance is the same across all EU countries Although NIS-2 sets a framework for cybersecurity across the EU, member states have some flexibility in implementation. This means that there can be v

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.15, &#8220;Supplier Relationships&#8221;, which is crucial for organizations in order to ensure the security of information assets shared with external suppliers. This annex provides guidelines for managing supplier relationships effectively to mitigate risks and maintain information security. From an IT security perspective, suppliers are external entities or third-party organizations that provide goods, services, or resources to support an organization&#8217;s operations. These suppliers often play a critical role in the organization&#8217;s IT infrastructure, providing hardware, software, cloud services, and other technology solutions. Suppliers may also have access to sensitive information, systems, or networks of the organization, making them potential security risks. Therefore, managing supplier relationships is essential for ensuring the security of information assets and mitigating risks associated with third-party access. &nbsp; Contents Toggle Understanding the Importance of Supplier RelationshipsImplementing Annex A.15 in PracticeSupplier Selection and EvaluationPractical Examples:Contractual AgreementsPractical Examples:Monitoring and ReviewPractical Examples:Audit of Compliance with Annex A.15Conclusion Understanding the Importance of Supplier Relationships Supplier relationships play a vital role in the overall information security posture of organizations. Annex A.15 emphasizes several key aspects: Risk Management: Assessing and managing risks associated with suppliers who have access to sensitive information. Contractual Agreements: Establishing clear contractual agreements that define security responsibilities and obligations. Monitoring and Review: Continuously monitoring supplier performance and adherence to security requirements. Implementing Annex A.15 in Practice Supplier Selection and Evaluation Practical Examples: Risk Assessment: Conduct thorough risk assessments of potential suppliers to evaluate their security controls, practices, and potential risks to information assets. Due Diligence: Perform due diligence checks, such as reviewing security certifications, conducting site visits, and requesting security documentation from suppliers. Security Requirements: Clearly communicate security requirements to suppliers during the selection process, including data protection measures, access controls, and incident response capabilities. Contractual Agreements Practical Examples: Security Clauses: Include specific security clauses in contracts that outline security requirements, confidentiality obligations, data protection measures, and compliance with relevant regulations. Data Protection: Address data protection requirements, including data handling procedures, data encryption, and secure transmission methods. Service Level Agreements (SLAs): Define SLAs

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.14, &#8220;System Acquisition, Development, and Maintenance&#8221;, which addresses the importance of ensuring the security of information systems throughout their lifecycle, from acquisition and development to maintenance and disposal. This annex provides guidelines for implementing controls to manage the security of information systems and software applications. &nbsp; Contents Toggle Importance of System Acquisition, Development, and MaintenanceImplementing Annex A.14 in PracticeAudit of Compliance with Annex A.14Conclusion &nbsp; Importance of System Acquisition, Development, and Maintenance System acquisition, development, and maintenance are critical stages in the lifecycle of information systems and software applications. Annex A.14 underscores this importance by: Security by Design: Integrating security considerations into the acquisition, development, and maintenance processes helps identify and mitigate security risks early in the lifecycle, reducing the likelihood of vulnerabilities and security incidents. Secure Development Practices: Implementing secure coding practices, testing methodologies, and vulnerability management processes helps ensure the integrity, confidentiality, and availability of software applications and systems. Change Management: Managing changes to information systems and software in a controlled manner helps prevent unauthorized modifications, configuration errors, and disruptions to services. Implementing Annex A.14 in Practice To effectively implement Annex A.14, organizations can follow these practical steps: Security Requirements Analysis: Conduct a security requirements analysis during the system acquisition phase to identify security requirements and considerations for information systems and software applications. Example: Include security requirements such as authentication mechanisms, access controls, encryption, and audit logging in the procurement specifications for new information systems or software applications. Secure Development Practices: Adopt secure coding guidelines, frameworks, and best practices during the development phase to minimize the risk of security vulnerabilities and weaknesses in software applications. Example: Implement input validation, output encoding, and proper error handling to mitigate common vulnerabilities such as cross-site scripting (XSS), SQL injection, and buffer overflows in web applications. Vulnerability Management: Implement vulnerability scanning, penetration testing, and code reviews to identify and remediate security vulnerabilities and weaknesses in information systems and software applications. Example: Conduct regular vulnerability scans and penetration tests of network infrastructure, web applications, and databases to identify security vulnerabilities and prioritize remediation efforts. C

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.13, &#8220;Communications Security&#8221;, which addresses the importance of securing information during its transmission over communication networks. This annex provides guidelines for implementing controls to protect the confidentiality, integrity, and availability of information exchanged between parties. &nbsp; Contents Toggle Importance of Communications SecurityImplementing Annex A.13 in PracticeAudit of Compliance with Annex A.13Conclusion &nbsp; Importance of Communications Security Communications security is crucial for safeguarding sensitive information transmitted over communication channels, such as networks, internet connections, and wireless technologies. Annex A.13 underscores this importance by: Confidentiality: Encrypting communications prevents unauthorized parties from intercepting and eavesdropping on sensitive information transmitted over unsecured networks. Integrity: Implementing integrity checks and digital signatures ensures that transmitted data remains intact and unaltered during transit, protecting against tampering and unauthorized modifications. Availability: Securing communication channels helps maintain the availability of information services and prevents disruptions caused by network attacks, denial-of-service (DoS) attacks, or transmission errors. Implementing Annex A.13 in Practice To effectively implement Annex A.13, organizations can follow these practical steps: Encryption: Encrypt data transmitted over insecure communication channels using encryption protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), or Virtual Private Network (VPN) tunnels.Example: Configure email servers to use TLS encryption for encrypting emails in transit between email clients and servers, preventing eavesdropping on email communications. Digital Signatures: Use digital signatures to verify the authenticity and integrity of transmitted data and messages. Implement digital signature algorithms and certificate authorities to ensure the validity of signatures.Example: Digitally sign electronic documents, such as contracts or reports, using a digital signature certificate issued by a trusted certificate authority to verify the authenticity and integrity of the documents. Secure Protocols: Use secure communication protocols and standards, such as Secure Shell (SSH), Hypertext Transfer Protocol Secure (HTTPS), and Internet Protocol Security (IPsec), to protect data transmitted over networks.Example: Configure web servers to use HTTPS protocol for secure transmission of sensitive information, such as login credentials or financial transactions, over the internet. Access Controls: Implement access controls to restrict access to communication channels and network resources to authorized users only. Use strong authentication mechanisms to

ENDP

COM:ENDPOINT-CYBERSECURITY

Endpoint Cybersecurity GmbH