This post summarizes the steps to implement ISO/IEC 27001 in an organization. It pretends to be a high-level overview of the whole process and provide a holistic view. If you need further details on this, you may do some research…
ISO/IEC 27001 (sometimes shorted as ISO 27001) is an international standard on how to manage information security in an organization. The standard was originally published jointly by the International Organization for Standardization and the International Electrotechnical Commission in 2005, but…
This post lists some password manager applications. On premise Password Manager Applications On-premise password manager applications: KeePass Free and open source.Developed for Windows, and supports some portability for macOS and Linux using Mono. There are other unofficial ports. It was…
An endpoint, in the context of a computer network, is a remote computing device that communicates back and forth with a network to which it is connected. Examples of endpoints are: In a more extended definition of endpoint, it may include…
Application Security Testing (AST) is the process of checking an application in order to identify potencial vulnerabilities and set points for security improvements. They are different to code testing solutions, as AST focus on security, not other aspects like performance…
El Esquema Nacional de Seguridad (ENS) es un marco de trabajo promulgado por el Gobierno de España y que establece una serie de medidas relacionadas con la seguridad de la información. El ENS es de obligado cumplimiento para las administraciones…
This post summarizes the roles involved in managing data in IT systems. These roles are based on USA’s NIST SP 800-18 Rev. 1 “Guide for Developing Security Plans for Federal Information Systems” or European Union’s General Data Protection Regulation (GDPR).…
This post explains what is a DLL side-loading attack in the context of IT security. What is a DLL Side-loading Attack? A Dynamic Linked Library (DLL) is a file that is used on Windows systems to group functions. By…
This post features penetration testing methodologies. Take into account that penetration or IT security testing may be consider a subset of quality assurance. You can read about IT security testing frameworks on this post. You can read about secure software…
This post lists some anonymity networks: Tor / Onionland Freenet I2P ZeroNet Tor / Onionland Tor network is sometimes known colloquially as “onionland” because of the onion routing technology it uses. Official website Freenet Official website I2P Official website ZeroNet…