Articles by "Audit Compliance"
Showing posts with label Audit Compliance. Show all posts

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

This set of tools allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products, while comparing them against other security configurations.  


The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects (GPOs).  Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them via a domain controller or inject them directly into testbed hosts to test their effects.



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Central Electricity Authority, Ministry of Power has prepared the guideline for the Cyber Security in Power Sector and it has been released.

CEA under the provision of Section 3(10) on Cyber Security in the “Central Electricity Authority (Technical Standards for Connectivity to the Grid) (Amendment) Regulations, 2019” has framed Guideline on Cyber Security in Power Sector to be adhered by all Power Sector utilities to create cyber secure eco system. This is the first time that a comprehensive guideline has been formulated on cyber security in power sector. The guideline lays down required actions for cyber security preparedness across various utilities in power sector so as to raise the level of cyber security preparedness for power sector.




The Guideline has been prepared after intensive deliberations with stakeholder and inputs from expert agencies in the field of cyber security, such as CERT-In, NCIIPC, NSCS, IIT Kanpur and subsequent deliberations in Ministry of Power as well.

Guideline are applicable to all Responsible Entities as well as System Integrators, Equipment Manufacturers, Suppliers/Vendors, Service Providers, IT Hardware and Software OEMs engaged in the Indian Power Supply System for protection of Control Systems for System Operation and Operation Management, Communication System and Secondary Automation and Tele control technologies.

These Guideline are mandatory requirements to be met by all stakeholders and lay emphasis on establishing cyber hygiene, training of all IT as well OT Personnel on Cyber Security, designating of Cyber Security Training Institutes as well as Cyber Testing labs in the Country. The Guideline mandates ICT based procurement from identified “Trusted Sources” and identified “Trusted Products” or else the product has to be tested for Malware/Hardware Trojan before deployment for use in power supply system network when system for trusted product and service is in place. It will promote research and development in cyber security and open up market for setting up Cyber Testing Infra in Public as well as Private Sector in the country.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Cloud Audit Academy (CAA) is an Amazon Web Services (AWS) Security Auditing Learning Path designed for those that are in auditing, risk, and compliance roles and are involved in assessing regulated workloads in the cloud.

The CAA curriculum forms a leveled learning path that starts with a wide scope (cloud and industry agnostic), and narrows as the learner progresses to focus on AWS and industry-specific content. It includes courses in eLearning and instructor-led training formats.

The curriculum dives into cloud-specific audit considerations and AWS best practices for security auditing aligned to global industry security and compliance frameworks.




Security and Compliance Domains

The CAA curriculum focus on the following globally recognized security and compliance domains:

1. Governance, Risk, and Compliance

2. Identity and Access Management

3. Data Security and Privacy

4. Network Management

5. Configuration Management

6. Vulnerability Management

7. User Device Management

8. Logging and Monitoring

9. Incident Response

10. Business Continuity and Contingency Planning

Free Digital Training

On-demand Cloud Audit Academy courses help you learn and refresh your cloud security auditing skills when and where it’s convenient for you.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
The European Commission’s Medical Device Coordination Group published guidance aimed at preparing manufacturers to meet both premarket and postmarket cybersecurity requirements under the EU’s new medical device regulations.

 New safety requirements for all devices that incorporate electronic programmable systems and software. The new rules also require device makers to follow state-of-the-art risk management principles and to establish minimum thresholds for internet technology security measures, including protection against unauthorized access.



The purpose of the new guidance document is to help manufacturers fulfill all essential cybersecurity requirements of the MDR and IVDR. The new regulations ask device makers to incorporate updated practices as they design, develop and upgrade products across their life cycle. They must take into account principles of risk management including information security, verification and validation.

 The two new Regulations on medical devices 745/2017 (MDR) and 746/2017 (IVDR) (hereaftercalled the Medical Devices Regulations) have been adopted and entered into force on 25 May 2017.The two Regulations, which are to replace three EU Directives1, apply progressively until May 2020 for medical devices and May 2022 for in vitro diagnostic medical devices.

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Many serverless applications begin as monolithic applications. This can occur either because a simple application has grown more complex over time, or because developers are following existing development practices. A monolithic application is represented by a single AWS Lambda function performing multiple tasks, and a mono-repo is a single repository containing the entire application logic.

Monoliths work well for the simplest serverless applications that perform single-purpose functions. These are small applications such as cron jobs, data processing tasks, and some asynchronous processes. As those applications evolve into workflows or develop new features, it becomes important to refactor the code into smaller services.



Using frameworks such as the AWS Serverless Application Model (SAM) or the Serverless Framework can make it easier to group common pieces of functionality into smaller services. Each of these can have a separate code repository. For SAM, the template.yaml file contains all the resources and function definitions needed for an application. Consequently, breaking an application into microservices with separate templates is a simple way to split repos and resource groups.
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
ISO (International Organization for Standardization) has compiled 28 standards in freely available read-only format to support global efforts in dealing with the COVID-19 crisis. You can make use of them.

 In response to the recent COVID-19 outbreak, the International Organization for Standardization (ISO) has provided free access to some of its key standards supporting business continuity management, resilience, and risk management.

  • The standards are available for FREE in read-only format. 
  • These standards are NOT pirated COPY.



  • ISO 374-5:2016, Protective gloves against dangerous chemicals and micro-organisms - Part 5: Terminology and performance requirements for micro-organisms risk
  • ISO 10651-3:1997, Lung ventilators for medical use — Part 3: Particular requirements for emergency and transport ventilators
  • ISO 10651-4:2002, Lung ventilators — Part 4: Particular requirements for operator-powered resuscitators
  • ISO 10651-5:2006, Lung ventilators for medical use — Particular requirements for basic safety and essential performance — Part 5: Gas-powered emergency resuscitators
  • ISO 10993-1:2018, Biological evaluation of medical devices – Part 1: Evaluation and testing within a risk management process
  • ISO 13485:2016, Medical devices — Quality management systems - Requirements for regulatory purposes
  • ISO 13688:2013, Protective clothing – General requirements
  • ISO 17510:2015, Medical devices — Sleep apnoea breathing therapy — Masks and application accessories
  • ISO 18082:2014, Anaesthetic and respiratory equipment — Dimensions of non-interchangeable screw-threaded (NIST) low-pressure connectors for medical gases [Including ISO 18082:2014/AMD 1:2017, AMENDMENT 1]
  • ISO 18562-1:2017, Biocompatibility evaluation of breathing gas pathways in healthcare applications — Part 1: Evaluation and testing within a risk management process
  • ISO 18562-2:2017, Biocompatibility evaluation of breathing gas pathways in healthcare applications — Part 2: Tests for emissions of particulate matter
  • ISO 18562-3:2017, Biocompatibility evaluation of breathing gas pathways in healthcare applications — Part 3: Tests for emissions of volatile organic compounds (VOCs)
  • ISO 18562-4:2017, Biocompatibility evaluation of breathing gas pathways in healthcare applications — Part 4: Tests for leachables in condensate
  • ISO 19223:2019, Lung ventilators and related equipment — Vocabulary and semantics
  • ISO 20395:2019, Biotechnology — Requirements for evaluating the performance of quantification methods for nucleic acid target sequences — qPCR and dPCR
  • ISO 22301:2019, Security and resilience – Business continuity management systems –Requirements
  • ISO 22395:2018, Security and resilience – Community resilience – Guidelines for supporting vulnerable persons in an emergency
  • ISO 22320:2018, Security and resilience – Emergency management – Guidelines for incident management
  • ISO 22316:2017, Security and resilience – Organizational resilience – Principles and attributes
  • ISO 31000:2018, Risk management – Guidelines
  • ISO 5356-1:2015, Anaesthetic and respiratory equipment — Conical connectors — Part 1: Cones and sockets
  • ISO 80601-2-12:2020, Medical electrical equipment — Part 2-12: Particular requirements for basic safety and essential performance of critical care ventilators
  • ISO 80601-2-13:2011, Medical electrical equipment — Part 2-13: Particular requirements for basic safety and essential performance of an anaesthetic workstation [Including: ISO 80601-2-13:2011/Amd.1:2015, AMENDMENT 1 and ISO 80601-2-13:2011/Amd.2:2018, AMENDMENT 2]
  • ISO 80601-2-70:2015, Medical electrical equipment — Part 2-70: Particular requirements for basic safety and essential performance of sleep apnoea breathing therapy equipment
  • ISO 80601-2-74:2017, Medical electrical equipment — Part 2-74: Particular requirements for basic safety and essential performance of respiratory humidifying equipment
  • ISO 80601-2-79:2018, Medical electrical equipment — Part 2-79: Particular requirements for basic safety and essential performance of ventilatory support equipment for ventilatory impairment
  • ISO 80601-2-80:2018, Medical electrical equipment — Part 2-80: Particular requirements for basic safety and essential performance of ventilatory support equipment for ventilatory insufficiency
  • ISO/TS 16976-8:2013, Respiratory protective devices — Human factors — Part 8: Ergonomic factors
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

 This tool checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user.

 Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user.


Zeus has been written in bash script using AWS-CLI and it works in Linux/UNIX and OSX.

 Zeus has capability to review;
  • Identity and Access Management
  • Logging
  • Networking
  • Monitoring

Continue reading
no image

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

 The European Court of Auditors performs its audits in accordance with the international auditing standards and code of ethics, which it applies to the specific EU context. 

 These standards help ensure the quality and professionalism of the ECA’s work, as well as its efficiency. The ECA contributes to the development of the standards through its international cooperation.

 The ECA conducts its audits in accordance with ISSAIs, the international standards on auditing issued by INTOSAI, the international organisation of supreme audit institutions worldwide. 

 The principles and details of the ECA's audit approach are described in a set of manuals, standards and guidelines, which apply the international standards to the specific EU audit context. They help our auditors to provide high quality professional work, and to operate efficiently and effectively.

 The ECA’s audit manuals contain the detailed instructions for carrying out its audits, in line with the appropriate standards and expected quality. 

 The ECA has developed two audit manuals covering the three main audit types

  • Financial and Compliance Audit Manual (FCAM)
  • Performance Audit Manual (PAM)

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
An open source tool to audit wireless networks. It allows the user to deploy advanced attacks by directly using the web interface or by sending messages to it. Initially the application was created to be used with the Raspberry-Pi, but it can be installed on any Debian based system. 

 FruityWifi v2.0 has many upgrades. A new interface, new modules, Realtek chipsets support, Mobile Broadband (3G/4G) support, a new control panel, and more.It is possible customize each one of the network interfaces which allows the user to keep the current setup or change it completely.

 FruityWifi is based on modules making it more flexible. These modules can be installed from the control panel to provide FruityWifi with new functionalities.




Within the available modules you can find URLsnarf, DNSspoof, Kismet, mdk3, ngrep, nmap, Squid3 y SSLstrip (code injection functionality), Captive Portal, AutoSSH, Meterpreter, Tcpdump and more. AutoSSH allows the user to create a reverse ssh connection, restarting it in case that the connection has been closed or dropped. It is useful to keep a permanent connection with FruityWifi.

 FruityWifi now supports Mobile Broadband (3G/4G). We can use this module to connect a 3G/4G dongle and give internet access to FruityWifi without the need of Wifi or Ethernet.
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Lynis is an open source security auditing tool. Used by system administrators, security professionals, and auditors, to evaluate the security defenses of their Linux and Unix-based systems. It runs on the host itself, so it performs more extensive security scans than vulnerability scanners. It is also the client in our Lynis Enterprise offering.



Supported operating systems
Lynis runs on almost all UNIX-based systems and versions, including:

    AIX
    FreeBSD
    HP-UX
    Linux
    macOS
    NetBSD
    OpenBSD
    Solaris
    and others

It even runs on systems like the Raspberry Pi, or QNAP storage devices.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
JBrute is an open source tool written in Java to audit security and stronghold of stored password for several open source and commercial apps. It is focused to provide multi-platform support and flexible parameters to cover most of the possible password-auditing scenarios.
Java Runtime version 1.7 or higher is required for running JBrute.

Supported algorithms:
MD5
MD4
SHA-256
SHA-512
MD5CRYPT
SHA1
ORACLE-10G
ORACLE-11G
NTLM
LM
MSSQL-2000
MSSQL-2005
MSSQL-2012
MYSQL-322
MYSQL-411
POSTGRESQL
SYBASE-ASE1502
INFORMIX-1170



Download JBrute
Continue reading
no image

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Continue reading
Subscribe to: Posts (Atom)