When installing MIM 2016 on Windows Server 2022, you encounter an error:
The code execution cannot proceed because MSVCR120.dll was not found. Reinstalling the program may fix this problem.
Install the Visual C++ Redistributable Packages for Visual Studio 2013 from the Microsoft Download center.
If you want to quickly move around Microsoft PowerPoint, this list of short cut key combinations come in very handy:
Like using
But.. it looks like some interesting combinations are missing.
Like
Just a quick tip…
Georg Philip Krog started a post on LinkedIN with an interesting overview of EU policies, directives and regulations…
While the post is still under development (and growing), it might be interesting to get some more information on the list that Georg Philip created.
Furthermore the original list is not clear on which legislation is in force or in proposal / draft state.
Please consider that many of the rules and regulations below might apply directly to your business.
If not , then you might be impacted indirectly via the supply chain where your customer or supplier is impacted by the legislations. In that case, it’s very likely that you will be forced to apply the rules by delegation or obligation of your customer/supplier.
In many cased the supply chain security will impose these rules to you, one way or another. Be ready.
The chapters below contain, in most cases, a short description or extract of introduction to evaluate what
The list below is not maintaining the same positioning as originally posted by Georg Philip.
There is a split in
Source: https://european-union.europa.eu/institutions-law-budget/law/types-legislation_en
A “regulation” is a binding legislative act. It must be applied in its entirety across the EU.
For example: GDPR (General Data Protection Regulation
A “directive” is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to devise their own laws on how to reach these goals.
Reference by Georg Philip: Articles 7 and 8 CFREU
Article 7 – Respect for private and family life
“1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.”
Source :
Art 8 ECHR:
Source: Guide on Article 8 of the European Convention on Human Rights
Code number: Regulation 2016/679
Source: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Code number: EU Directive 2022/2555
Source: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
Important note, the NIS 2 Directive is repealing NIS (also called NIS 1 now)
Code number : Directive 2016/1148
Source: http://data.europa.eu/eli/dir/2016/1148/oj
Code name: EU Directive 2022/2554
Source: https://eur-lex.europa.eu/eli/reg/2022/2554/oj
DORA = digital operational resilience for the financial sector
More info and interesting reads:
Code name : EU Directive 2022/2557
http://data.europa.eu/eli/dir/2022/2557/oj
Code: Regulation 2022/2065
Source: http://data.europa.eu/eli/reg/2022/2065/oj
More Info: https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package
“The Digital Services Act (DSA) and the Digital Market Act (DMA) form a single set of rules that apply across the whole EU. They have two main goals:
Code: Directive 2020/1828
Source: https://eur-lex.europa.eu/eli/dir/2020/1828/oj
“The Digital Markets Act (DMA) establishes a set of narrowly defined objective criteria for qualifying a large online platform as a so-called “gatekeeper”. This allows the DMA to remain well targeted to the problem that it aims to tackle as regards large, systemic online platforms.
These criteria will be met if a company:
Code number: Directive 2013/40/EU
Source: https://eur-lex.europa.eu/eli/dir/2013/40/oj
Code number: Regulation (EU) 2022/868
Source: http://data.europa.eu/eli/reg/2022/868/oj
More info : https://digital-strategy.ec.europa.eu/en/policies/data-governance-act
Article 1
“1. This Regulation lays down:
| (a) | conditions for the re-use, within the Union, of certain categories of data held by public sector bodies; |
| (b) | a notification and supervisory framework for the provision of data intermediation services; |
| (c) | a framework for voluntary registration of entities which collect and process data made available for altruistic purposes; and |
| (d) | a framework for the establishment of a European Data Innovation Board. |
“
Original Code number: Directive 2002/58/EC
Source: http://data.europa.eu/eli/dir/2002/58/oj
Ammended :
http://data.europa.eu/eli/dir/2002/58/2009-12-19
Source: https://ec.europa.eu/commission/presscorner/detail/en/ip_22_6642
https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2020)651937
https://www.consilium.europa.eu/en/press/press-releases/2017/06/19/cyber-diplomacy-toolbox/
Code: Regulation (EU) 2019/881
Source: http://data.europa.eu/eli/reg/2019/881/oj
Code name: Directive 2014/53/EU
Source: http://data.europa.eu/eli/dir/2014/53/oj
(see Art 10(1), together with paragraph 17(2) in Annex I)
Code: Regulation (EU) 2017/745
Source: http://data.europa.eu/eli/reg/2017/745/oj
Code name: Regulation 910/2014,
eIDAS = Regulation on electronic identification and trust services (EIDAS)
Source: https://eur-lex.europa.eu/eli/reg/2014/910/oj
Code name: Directive (EU) 2019/770
Source: http://data.europa.eu/eli/dir/2019/770/oj
Code: Directive 2018/1972
Source: http://data.europa.eu/eli/dir/2018/1972/oj
Source: https://eur-lex.europa.eu/eli/reg/2021/887/oj
Special reference by Georg Philip: Art 4(2)(b)
“
Article 4
Objectives of the Competence Centre
1. The Competence Centre shall have the overall objective of promoting research, innovation and deployment in the area of cybersecurity in order to fulfil the mission as set out in Article 3.
2. The Competence Centre shall have the following specific objectives:
| (a) | enhancing cybersecurity capacities, capabilities, knowledge and infrastructure for the benefit of industry, in particular SMEs, research communities, the public sector and civil society, as appropriate; |
| (b) | promoting cybersecurity resilience, the uptake of cybersecurity best practices, the principle of security by design, and the certification of the security of digital products and services, in a manner that complements the efforts of other public entities; |
| (c) | contributing to a strong European cybersecurity ecosystem which brings together all relevant stakeholders |
“
under revision 2021/0419(COD): https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A2021%3A813%3AFIN
Code: Directive 2010/40/EU
Source: http://data.europa.eu/eli/dir/2010/40/oj
https://www.eeas.europa.eu/eeas/strategic-compass-security-and-defence-1_en
Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52016DC0766
NIS 2 also points to some interesting references like the one below.
| EC recommendation 2017/1584 | Recommendation on coordinated response to large-scale cybersecurity incidents and crises | http://data.europa.eu/eli/reco/2017/1584/oj |
| Regulation 2019/881 | Regulation on information and communications technology cybersecurity certification | http://data.europa.eu/eli/reg/2019/881/oj |
| EC recommendation 2019/534 | Recommendation on Cybersecurity of 5G networks | http://data.europa.eu/eli/reco/2019/534/oj |
Code number: EC recommendation 2017/1584
Source: http://data.europa.eu/eli/reco/2017/1584/oj
Code name: Regulation 2019/1020
Source: http://data.europa.eu/eli/reg/2019/1020/oj
More info: https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2022/0272(COD)&l=en
More info: https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act
“The proposal for a regulation on cybersecurity requirements for products with digital elements, known as the Cyber Resilience Act, bolsters cybersecurity rules to ensure more secure hardware and software products.”
More info: https://www.euractiv.com/section/cybersecurity/news/eu-sets-out-plan-for-cyber-defence-policy/
More info: https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52022PC0068
More info:
Source: https://ec.europa.eu/commission/presscorner/detail/en/ip_22_7741
Source: https://ec.europa.eu/commission/presscorner/detail/en/QANDA_22_2712
EHDS “is a health-specific data sharing framework establishing clear rules, common standards and practices, infrastructures and a governance framework for the use of electronic health data by patients and for research, innovation, policy making, patient safety, statistics or regulatory purposes“
EU information: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-chips-act_en
Info: https://sciencebusiness.net/news/ICT/act-three-chips-act-heads-negotiation-phase
You don’t want to miss this chart, compiled by Nicolas Amaye.
Source: this LinkedIN post by Nicolas Ameye (PDF orginal download source here)
As legislation is continuously on the move, this article is never finished.
If you have great ideas to add, feedback or suggestions, let me know.
A while ago Microsoft moved from Docs (Docs.microsoft.com) to Learn (Learn.microsoft.com), but still some older information might point to the Docs links. In case the redirect fails, replace the docs prefix in the URL to learn an try again.
If it still fails, Bing it and let me know.
https://docs.microsoft.com/en-us/lifecycle/products/?terms=Identity
Supported platforms: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-supported-platforms
https://learn.microsoft.com/en-us/microsoft-identity-manager/mim-best-practices
https://github.com/microsoft/MIMConfigDocumenter
https://github.com/microsoft/MIMWAL
https://github.com/search?q=mim2016
Technet blogs archive: https://learn.microsoft.com/en-us/archive/blogs/
Below you’ll find some interesting and helpful articles and posts (some of the are old/archived… But still valid for MIM too.)
In alphabetic order (on last name)
https://github.com/PeterGeelen/Microsoft-Identity-Manager/tree/main/FIM-MIM%20stencils
Table of contents
Below you’ll find some useful collateral (add-on, extra) information for the #PECB #ISO27005 Lead Risk manager course, that you can use for extra learning, deep dive, or educational support.
Check: https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27005
Course categories
(in progress)
(working on it)
(yes, also)
https://pecb.com/whitepaper > Search for OCTAVE
https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=8419
Clusif: https://clusif.fr/wp-content/uploads/2015/10/mehari-2010-risk-analysis-and-treatment-guide.pdf
For specific information about exam type, languages available, and other details, please visit the List of PECB Exams and the Examination Rules and Policies.
More info: https://help.pecb.com/index.php/list-of-pecb-exams/
(Search for ISO27005 and sort on your preferred language)
https://store.pecb.com/toolkits
https://www.iso.org/search.html?q=27005
https://github.com/PeterGeelen/ISO27001
Including:
IAF (the International Accreditation Forum), has published updated requirement for the transition of ISO 27001 from 2013 to the fresh 2022 version.
The MD:26 Issue 2 is published on 15 feb 2023, a few months after the publication of ISO 27001:2022 in October 2022.
Main issue: the previous issue was already published in august, before the final version of ISO 27001…
So obviously an update was required.
[For your info: If you need some help on acronyms, see the end of this article…]
Some thing were updated, but some were not.
What changed (green highlight) and what did not change (red highlight)?
But of course, I don’t need to tell you : as soon as your CAB is ready, better upgrade your current certification to the newest version 2022.
A bit more details of the MD 26 document
| Normative Document: | ISO/IEC 27001:2022 |
| Replacing: | ISO/IEC 27001:2013 |
| Current Status (at time of MD publication): | IS |
| Transition Period: | 3 Years (36 months) |
Contains overview of ISO publication agenda from FDIS to IS
Did you know that
No more than two separate documents in the form of amendments shall be published modifying a current International Standard (see ISO/IEC Directive Part 1, 2022, Clause 2.10.3), therefore, the new edition of ISO/IEC 27001 had to be published after the preparation of ISO/IEC 27001:2013/DAmd1.
Source: IAF MD 26:2023
Source: MD26:2023
Only interesting if you are an AB, see MD 26
Is extra time likely to be needed for the transition? Yes.
Important note:
When the certification document is updated because the client successfully completed only the transition audit, the expiration of its current certification cycle will not be changed.
All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period.
TLDR…
AB = Accreditation Body
CAB = Conformity Assessment Body, certification body
IAF: International Accreditation Forum
FDIS: Final Draft International Standard
IS: International standard
Ever thought to outsmart phishing exercises and have Microsoft Outlook alerting you for phishing, upfront?
You can.
Set a mail rule that
Create a mail rule
Set : “specific words in the message header”
Set the tags
There might be some variations on these tags.
Additionally, if you know phishing test mails are sent from specific domains… add the domain/mail server
Some other ideas: set mail alerts or use Power Automate to alert you… (but that’s for another article)
Obviously it only works for these specific mail header tags, if phishing tests use different headers or other approach, you’ll need to adapt. Don’t take this solution for granted.
And worse, the real stuff… is still out there attacking you.
Stay alert, don’t click on mails and links you don’t expect!
While you never should click on any suspicious mail, suspicious links or links in these mails… it still might be a good exercise and learning item to inspect the mail header info.
Look for anomalies in
If you suspect a mail to be the real thing, actual phishing, better report the mail as spam and forward it to your local CERT or local cybersecurity authority for analysis (and domain URL blocking)…
And message your security team they failed the phishing test 😉
Some info for mail server administrators 😉
Early last year ISO updated the ISO27002 to version 2022, putting the previous version to rest after almost 10 years.
The ISO27002:2022, “Information security, cybersecurity and privacy protection — Information security controls”; This document provides a set of guidelines for generic information security controls.
And in fact, it’s the foundation of the ISO27001 Annex (remember the annex is derived from the ISO27002).
The ISO27001:2022, published in october 2022, is a new land mark for information security and governance best practices and basics.
With the launch, there has been a lot of articles explaining what changed.
In numbers we went from 114 controls to 93, which looks like a compression but there are also 11 new controls added.
I explained this situation in an article I wrote early last year in #PECB Insights Magazine: here is the link
Most important : section “New controls in ISO/IEC 27002:2022”:
New as in, new named controls in ISO27002 version 2022… with explicit requirements.
But if you look into them, you’ll discover you can perfectly fit them in the existing ISO27001:2013 version to protect your environment.
And you should have them implemented already a long time ago.
They are not new to protect your current environment against the current cyber threats.
But how do you map these new ISO27002/ISO27001:2022 controls in the existing 2013 implementation?
A bit more explanation needed, check this XLS Spread Sheet.
The various controls and clauses in the new ISO27002 provide some interesting references to other standards, you could check:
Some free stuff: https://ffwd2.me/FreeISO
For the hardcore perfectionistas: yes, the ISO27002 does update and change some the security controls, to be more modern.
Also the structural approach in the ISO27002 is now PPT, correction PPPT: Physical, People, Process and Technology (logical security tools).
But more important, major changes are actually present in the ISO27001 management clauses, not really in the ISO27002 (considering a reshuffle).
The most important update on the level of governance, compliance and audit DOES contain some important updates.
And it will be more result based, related to risk.
Do you want to know what has changed significantly, in de management processes, have a look at the presentation I hosted with PECB:
You can download the presentation from slideshare:
ISO/IEC 27001:2022 – What are the changes? from PECB (at SlideShare)
And there is more interesting stuff as extra, on this LinkedIN article:
So, there is some work to do, moving from ISO27001:2013 to ISO27001:2022…
But make your life easy, fix the ISMS implementation now, update your SoA using the ISO27002 translation tables.
Watch out for the extra requirements in ISO27001 (As Koenraad Béroudiaux rightfully mentions on LinkedIn: check clause 4.4 and 8.1).
More info in the webinar.
Get ready!
If you got improvement suggestions, let me know.
We can always make it better, together.
I’ll update the blog post and files with constructive suggestions.
If you are curious about the topics below, let me know.
You know were to find me here on LinkedIn, here on Twitter, by mail, or direct messaging via Signal and other.
When you have smart devices at home, like smart TVs, you might notice that they are bypassing your internal DNS server, by using public internet DNS (like Google DNS).
And if you use a DNS black hole server like PI-Hole, to protect your network against adware, malware, phishing this is not a healthy situation, as these smart devices bypass your security.
Originally, I tried to implement the solution proposed and documented by Scott Helme.
But I ended up with DNS lockdown (and killing my entire internet connection, due to blockage of DNS.)
The solution documented by “Fiction becomes Fact” on this page, did the trick.
Apparently, since the 2018 version, some configuration items like the folder locations have changed…
Important: carefully verify the site folder location mentioned in the posts, to upload the config file. It has changed in newer Ubiquity versions. (Currently : unifi/unifi/data/sites/default/)
Older articles might point to wrong folders (I suppose it has recently changed with new versions of Ubiquiti…)
Just a few more important attention points:
You can of course, apply this approach to other security solutions.
In essence:
If you’re in my community and professional network you must have witnessed a wave of Microsoft MVP #mvpbuzz announcements and notifications, early july on the various social media, Twitter, LinkedIN, blogs… a bit later than usual this year.
I was part of it, but due to personal reasons and summer vacation early July, I only had time till now to process it…
Certainly this year is a special year for me, a lot of things have changed professionally.
And when another special award disk dropped in the mail box just a few days ago, I can proudly announce that I’m honored to be awarded the Microsoft MVP award for the 10th time.
You work hard for it, hope for it, but never know if you have met the tough expectations.
[If you want to know more about the Microsoft MVP award, check this page on the MVP site. It’s a reward for a select expert community with great passion for Microsoft technologies, for all community efforts for last year.]
Honestly, it’s not about these white and blue glass disks, but appreciation for the passion and effort in the Microsoft community, to be recognized for the passion in Microsoft Security, more specifically Identity & Access.
And I certainly welcome the program change where the group of MVP “Enterprise Mobility” now moved to MVP Security, which aligns better with reality, what I stand for.
But I could never have achieved this with the great help and support of you, my audience.
So want to thank you, more than 10x for this.
Thank you!
All About Identity And Security On-Premises And In The Cloud - It's Just Like An Addiction, The More You Have, The More You Want To Have!
Complete Identity Orchestration for Microsoft Entra and On Premises Identity and Access
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
My connector space to the internet metaverse (also my external memory, so I can easily share what I learn)
Identity Underground 
You must be logged in to post a comment.