Pablo R.

Català Després del MWC26 em quedo amb una idea. La IA ja és a la infraestructura, als serveis, a les xarxes i, cada vegada més, al centre de moltes decisions. Ja no és una funcionalitat. És infraestructura. Per això el debat ja no és què pot fer la IA. El debat és com la governem quan passa a formar part del nucli del que fem. Perquè adoptar IA és fàcil. El que marcarà la diferència és fer-ho amb criteri, control i responsabilitat. Castellano Después del MWC26 me quedo con una idea. La IA ya está en la infraestructura, en los servicios, en las redes y, cada vez más, en el centro de muchas decisiones. Ya no es una funcionalidad. Es infraestructura. Por eso el debate ya no es qué puede hacer la IA. El debate es cómo la gobernamos cuando pasa a formar parte del núcleo de lo que hacemos. Porque adoptar IA es fácil. Lo que marcará la diferencia es hacerlo con criterio, control y responsabilidad. English After MWC26, one thought stays with me. AI is already in the infrastructure, in services, in networks and increasingly at the center of many decisions. It is no longer a feature. It is infrastructure. That’s why the debate is no longer what AI can do. The real debate is how we govern it when it becomes part of the core of what we do. Because adopting AI is easy. What will make the difference is doing it with judgment, control and responsibility.

98

No dejes de revisar esta lectura imperdible -------- Always cool to see solid vuln research land. Six issues identified in Arista NG Firewall 17.4, with clear remediation guidance by Senior Security Consultant Ronan Kervella: https://bfx.social/3MFZQPK

3

New Hacking Techniques Revealed in the Iberia Customer Data Leak The Iberia breach highlights how attackers are evolving their methods by exploiting weaknesses in third-party vendor systems. Key techniques observed include: Credential stuffing with targeted brute-force behavior Exploiting unpatched vendor-facing vulnerabilities (T1190) Leveraging valid accounts to stay hidden (T1078) Automated, low-noise data exfiltration pipelines Outbound communication to malicious domains disguised as vendor traffic This incident is a wake-up call for organizations to strengthen vendor security, enforce MFA, improve monitoring, and adopt continuous attack surface testing. Read more: https://lnkd.in/gWJ8rBEJ #CyberSecurity #DataBreach #Iberia #SupplyChainSecurity #ThreatIntelligence #HackingTechniques #FireCompass

1

The critical zero-day CVE-2025-62221 is under active exploitation, allowing attackers to achieve SYSTEM-level privileges via the Windows Cloud Files Mini Filter Driver. Microsoft's December 2025 Patch Tuesday addresses 57 vulnerabilities, including this actively exploited flaw and two other publicly disclosed zero-days. CVE-2025-62221 is an immediate patching priority; its use in post-compromise attack chains has led CISA to place it in the Known Exploited Vulnerabilities (KEV) catalog with a deadline of December 30. Security teams must also urgently address three Critical Remote Code Execution (RCE) vulnerabilities in Office and Outlook, which are common phishing entry points. Focus remediation on these high-risk flaws now. :shield: Read more at the link below. https://lnkd.in/dcdZuDzs #CyberSecurity #ThreatIntel #PatchTuesday #ZeroDay #VulnerabilityManagement

8

📰 "By providing a common language between security teams and system operators, Claroty brings technical work closer to the organization's strategic objectives, promoting operational resilience based on data and business context." | via IT Section https://hubs.li/Q03BQ-_X0

3

🎙️ Today I’ll be speaking at a webinar on Artificial Intelligence, the modern workplace, and cybersecurity. We’ll explore how AI is reshaping leadership, the risks we must not ignore, and how to prepare for what’s next. Technology won’t replace leaders… But leaders who use technology will replace those who don’t.

17

EN: At AWS Summit, HashiCorp introduced MCP servers for Terraform and Vault, enabling AI agents to interact securely with infrastructure workflows and secrets. ES: En el AWS Summit, HashiCorp presentó servidores MCP para Terraform y Vault, permitiendo que agentes de IA interactúen de forma segura con flujos de infraestructura y secretos. #AgenticAI #Terraform #Vault #DevOps #caffy

1

1 comentario

#LessonLearned: if your data flies beyond your perimeter, your security model has to fly with it. The recent #Iberia incident makes it obvious: The weakest link in cybersecurity is still the supply chain. There was no breach in the airline’s core systems— The exposure came from a communication repository managed by a third party. Personal data leaked, and an uncomfortable reminder: • Under GDPR and #NIS2, you can outsource services, but not responsibility. • Customer #data travels freely through marketing, loyalty, logistics, or support platforms—often outside your direct control. How do you reduce impact and stay compliant? • #ZeroTrust for suppliers too: least privilege, strong MFA, logical segmentation. • Unified #visibility & #XDR: who accesses, from where, and to which repositories. • #SSE/DLP controls: securing traffic to external services handling customer information. Security is no longer about protecting your house— But also every house that holds your keys. #ZeroTrust #CiscoXDR #CiscoSecureAccess #SSE #DLP #NIS2 #OneCisco #CyberSecurity #SupplyChainSecurity #DataProtection Cisco Splunk Cisco Security

2

A cybersecurity consultancy based in Spain is seeking advanced technological solutions to enhance its service offerings for SMEs and mid-size organizations. The company is looking to integrate or co-develop innovative tools that improve threat detection, security monitoring, and incident-response automation. The focus areas include: - Threat Detection & Monitoring: AI/behavior-based anomaly detection, EDR/NDR tools, threat intelligence platforms. - Incident Response & Automation: SOAR components, automated playbooks, forensics tools. - Cloud & Application Security: CSPM, WAF/RASP, identity and access control. - Training & Awareness: Interactive training platforms, phishing simulation tools. - AI-Driven Auditing: Automated security audits and policy generation. - Certification Services: Partners for ISO 27001, TISAX, and ENS certification. The company is open to various partnership models, including technical cooperation, co-development, commercial agreements with support, and licensing. Partner Profile: - The ideal partner is a technology developer, cybersecurity software company, research center, or innovative SME with expertise in scalable, interoperable security solutions and experience supporting SME environments. If your organization develops or provides advanced cybersecurity technologies and is interested in partnering with a Spanish consultancy to integrate, co-develop, or license your solutions, please contact the ICONIC Cluster representative to discuss potential collaboration opportunities.

4

Security risks of diagnostic dongles in your car: small devices that put your car at risk. 🚘🛠️🔌👨🏻‍💻☣️ Security researchers Roberto Gesteira-Miñarro, Ignacio Gutiérrez, Rafael Palacios, and Gregorio López share their project: an offensive cybersecurity toolkit and test platform designed to analyze and exploit vulnerabilities in OBD-II dongles. OBD-II dongles are small devices plugged into a car’s diagnostic port that often communicate via Bluetooth or Wi-Fi. They are used not only by DIY enthusiasts in home garages, but also by rental car agencies, taxi companies, and commercial fleets to remotely monitor vehicles. The authors tested multiple commercial OBD dongles and found that even recent firmware versions once again allow CAN message injection. Final verdict: OBD dongles significantly expand a vehicle’s attack surface. You’ll find several interesting details inside - especially if you work in automotive cybersecurity. If you have colleagues in this field, please feel free to share it with them as well. Stay safe! More details: pwnobd: Offensive Cybersecurity Toolkit for Vulnerability Analysis and Penetration Testing of OBD-II Devices [PDF]: https://lnkd.in/dfRUT3fk pwnobd [Github]: https://lnkd.in/dQt4WggU #automotive #cybersecurity #carhacking #Bluetooth #Wireless #infosec #technology #driving #diagnostics #DIY #cars #technology #wireless #research

203

5 comentarios

🚨 Cyber resilience is no longer an option. It is a critical ability to survive and grow in an uncertain environment. At next week's Cyber Resilience Forum - ISMS Forum, you'll have the opportunity to hear a conversation that goes beyond firewalls and regulations: 🎯 Cyber-resilience: between security and business An interview with two leaders who understand cybersecurity as a lever of business value: 🔹 Damien Henault, Managing Director at Forgepoint Capital. 🔹 Daniel Largacha, Global Security Operation Centre Director at MAPFRE. 👉 What does it mean to build real digital resilience? 👉 How are security decisions integrated into corporate strategy? 👉 What do boards expect from their cybersecurity teams? 📍 CaixaForum Madrid 📅 June 18 🎟️ Register with the code: IIFOROCR 🔗 bit.ly/4jqGcBs #ISMSForum #CyberResilience #RiskLeadership

10

Cyber resilience requires shared responsibility—and today’s Information Security Committee Plenary in Madrid demonstrated how collaboration between public entities, regional leadership, and organisations like ISACA can move the needle. Hosted by the Cybersecurity Agency of Comunidad de Madrid the session brought together public sector leaders, cybersecurity experts and ISACA to address key topics such as the implementation of cybersecurity frameworks, regulatory obligations, and long-term digital resilience. A special thanks to ISACA Madrid Chapter for their continued collaboration with the regional government and for their active participation in today’s roundtable. Their ongoing work helps translate global best practices into local action—and builds trust where it matters most. Read more about the event here - https://lnkd.in/dmnM_6BM #CyberSecurity #DigitalTrust #CyberResilience #ISACA

22

This is a great interview by Alejandro Novo, Country Manager for Synack, Inc. My key takeaway is, 'We aim to make pentesting strategic , not tactical'. Read the full article to undestand how the Synack, Inc. PTaaS platform is meeting the needs of companies whose attack surface is growing constantly.

17

Thrilled to share that I’ve joined the Steering Committee shaping the agenda for the 2nd edition of #EspañaSec, part of QG Media’s Cyber Series, taking place in Madrid on 10–11 February. As architects of resilience, we know that cyber-security is no longer just about defence—it’s about designing systems, governance models and organisational habits that scale under pressure. Contributing to this summit has been an opportunity to bring that lens to the table: connecting threat realities with the structural capabilities organisations need to withstand, respond and recover. The committee has curated a programme grounded in what truly matters: operational resilience, intelligence-driven defence, secure architecture, and the real-world challenges teams face across Spain’s critical sectors. 🔗 Explore the agenda shaped by our collective input: https://lnkd.in/dRBuqVBA 🎟️ Early-bird registration (save 250€ until 11th December): https://lnkd.in/dRBuqVBA Proud to collaborate with such an exceptional group of cyber leaders who are not just reacting to threats but engineering the future security baseline. #CyberSecurity #OperationalResilience #CyberResilience #SecurityArchitecture #RiskManagement #CyberLeadership #CISO

23

1 comentario

🚨 Spain is under a highly targeted cyber siege. Are you prepared? 🇪🇸 We just published the SOCRadar Spain Threat Landscape Report, and the numbers reveal a rapidly evolving, hyper-localized threat environment. Here is what you need to know right now: 🛑 Hyper-Targeted Ransomware: A massive 97.2% of ransomware activity is exclusively focused on Spanish organizations. 🛒 Dark Web's #1 Targets: Retail (15.3%) and E-commerce (13.1%) dominate dark web data leaks. 🔒 The HTTPS Illusion: Don't trust the padlock! 71% of phishing sites targeting Spain now use HTTPS to bypass security and deceive users. Cybercriminals are refining their local tactics. Is your security strategy keeping up? 📥 Download the full report here: https://lnkd.in/enSyWxkb #CyberSecurity #ThreatIntelligence #Spain #CISO #SOCRadar #Ransomware #DarkWeb

29

Spanish flag carrier Iberia has begun notifying customers of a data security incident stemming from a compromise at one of its suppliers. https://lnkd.in/dzFrpT2Y

2

Is your cybersecurity strategy keeping up with the speed of Data+AI? (Espanol) In this article for IT Masters Mag, I dive into why traditional security methods are no longer enough in an era where attackers use AI to scale at superhuman speeds. Here are three key takeaways: 1. Cybersecurity is a Data Problem: Defensive AI is only as strong as the data foundation it relies on. Without unified, high-quality data, even the best models will have blind spots. 2. The Danger of Fragmentation: Disconnected tools and fragmented data across different clouds create gaps that attackers are quick to exploit. True visibility requires breaking down these silos. 3. Moving Toward Predictive Defense: By leveraging unified data and AI platforms, security teams can shift from reactive firefighting to a proactive, predictive stance that learns and evolves with every threat. Question for you: Are we adding more tools when we should be focusing on better data? I’d love to hear how other leaders are navigating the shift toward AI-driven security. Full article here: https://lnkd.in/ebY_gMYX #Cybersecurity #AI #DataIntelligence #CISO #CloudSecurity Databricks

31

4 comentarios