APACHE STRUTS 2 Critical Vulnerability – CVE: 2023-50164

Lockbit Ransomware

Risk Rating: CRITICAL CVSS Score: 9.8 Vulnerability Type: Remote Code Execution (RCE) CVE Identifier: CVE-2023-50164 Exploitation Status: Actively exploited. Affected Version: Struts 2.0.0-2.3.37(EOL), 6.0.0-6.3.0.1, 2.0.0-2.5.32. Link: Apache.org Introduction  Recently discovered, CVE-2023-50164 reveals a critical flaw in Apache Struts that could allow hackers to execute code remotely by manipulating file upload settings. Actively exploited, this poses an […]

How to Implement a Clear Desk & Clear Screen Policy for Your Organisation

Clear Desk and Screen Policy

You know that feeling when you walk into an office, and it looks like a hurricane just blew through? Papers litter the area, sticky notes cling to computer monitors like colourful barnacles, and chaos fills the air. The implications of these might seem obvious but they pose greater problems — Information and Cyber Security Risks. […]

ISO 27001 Clauses 4-10: A Complete Guide

ISO 27001 Clauses

ISO/IEC 27001  is an international standard for creating an information security management system (ISMS). It provides a systematic approach for organisations to manage and protect their sensitive information. This standard is broken down into Clauses and Security Controls (Annex A) which every organisation that intends to be ISO 27001 compliant is required to follow. The […]

What is Open-Source Intelligence? How to Get Started

Imagine a world intricately woven with connections, where information flows like a meandering river of possibilities. This is the world we currently live in. In the past, intelligence primarily revolved around strategic knowledge, used by decision-makers to gain advantages, often centred on foreign capabilities, global events, and local concerns, particularly in the military and security […]

How to Prepare for an ISO 27001 Audit

ISO 27001 Audit

In the world of information security, there are many frameworks and countless guidelines. But among them all, one standard rules them all. Originating from the Plateau of Gorgoroth in Northwestern Mordor, it towers high above the rest, peering deep into the very hearts of organisations like the Eye of Sauron; controlling information security for all […]

ISO 27001: Steps to Write a Statement of Applicability

ISO 27001 Statement of Applicability

ISO 27001 Statement of Applicability A central component of becoming compliant with ISO 27001 is creating a Statement of Applicability (SoA). This is a document in which a vast number of controls (defensive policies, procedures, techniques and mechanisms) are considered, and the applicability of each one is weighed up against your organisation’s risks. While a […]

How to Respond When Data Breaches Hit the Fan

incident response plan

Not many companies anticipate being the focal point of a significant data breach incident. However, cybercriminals can infiltrate around 93% of businesses within an average of two days. In the third quarter of 2022 alone, approximately 150 million data records were compromised In today’s competitive business landscape, companies increasingly rely on data systems like cloud […]

PPI Principals of GDPR for Small Businesses: Navigating Data Protection

“So, all we have to do to implement these 11 chapters containing 91 articles in 261 pages of data protection regulation and all our worries about our clients, staff and suppliers’ Personally Identifiable Information (PPI) will be over?” “Yes, that’s it.” “Jess how long have you worked here?” “Erm, 20 years since last spring. “ […]

Risk Crew