Microsoft Identity Manager online resources (#MIM2016)
  1. Quick note on Microsoft Learn & Docs
  2. Microsoft news and announcements
    1. Microsoft Product support lifecycle
    2. Feeds
  3. Official documentation – Microsoft
    1. Getting prepared
    2. Best practices
    3. Deployment documentation
    4. MIM for developers
    5. MIM reference material
  4. Github
    1. (Microsoft) MIM Configuration Documenter
    2. (Microsoft) Workflow Activity Library (WAL)
    3. MIM projects
  5. Microsoft Community
    1. Forums (Active)
    2. Microsoft Answers
    3. Forums (Achive)
    4. Technet blogs archive
    5. Experts Exchange
    6. Microsoft Wiki
      1. FIM/MIM related content (check the tags)
      2. ILM/FIM/MIM article overview
      3. ILM/FIM/MIM Troubleshooting
    7. The FIM/MIM geek blogs & posts…
  6. Social Media
    1. Facebook
    2. Twitter
  7. Books
    1. Online Companion guide for MIM 2016 book
  8. Visio Stencils
  9. Archives
    1. Microsoft Learn – previous versions

Quick note on Microsoft Learn & Docs

A while ago Microsoft moved from Docs (Docs.microsoft.com) to Learn (Learn.microsoft.com), but still some older information might point to the Docs links. In case the redirect fails, replace the docs prefix in the URL to learn an try again.
If it still fails, Bing it and let me know.

Microsoft news and announcements

Microsoft Product support lifecycle

https://docs.microsoft.com/en-us/lifecycle/products/?terms=Identity

Feeds

Official documentation – Microsoft

Getting prepared

Supported platforms: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-supported-platforms

Best practices

https://learn.microsoft.com/en-us/microsoft-identity-manager/mim-best-practices

Deployment documentation

MIM for developers

MIM reference material

Github

(Microsoft) MIM Configuration Documenter

https://github.com/microsoft/MIMConfigDocumenter

(Microsoft) Workflow Activity Library (WAL)

https://github.com/microsoft/MIMWAL

MIM projects

https://github.com/search?q=mim2016

Microsoft Community

Forums (Active)

Microsoft Answers

Forums (Achive)

Technet blogs archive

Technet blogs archive: https://learn.microsoft.com/en-us/archive/blogs/

Experts Exchange

Microsoft Wiki

FIM/MIM related content (check the tags)

ILM/FIM/MIM article overview

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx

ILM/FIM/MIM Troubleshooting

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx#FIM_Troubleshooting_Article

The FIM/MIM geek blogs & posts…

Below you’ll find some interesting and helpful articles and posts (some of the are old/archived… But still valid for MIM too.)

In alphabetic order (on last name)

Social Media

Facebook

Twitter

Books

Online Companion guide for MIM 2016 book

Visio Stencils

https://github.com/PeterGeelen/Microsoft-Identity-Manager/tree/main/FIM-MIM%20stencils

Archives

Microsoft Learn – previous versions

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/forefront-2010/ee652263(v=vs.100)

PECB ISO27005:2022 Lead Implementer course – collateral material

Table of contents

  1. PECB Course info
  2. Day 1
  3. Day 2
  4. Day 3
  5. Day 4
    1. OCTAVE
      1. CMU – Carnegie Mellon University
      2. ENISA
      3. PECB
    2. OCTAVE Allegro
    3. MEHARI
      1. Clusif
      2. ENISA
  6. Exam reference material
    1. Exam candidate handbooks ISO27005
  7. References
    1. Toolkits
      1. PECB
    2. ISO 27005 downloads
      1. PECB
      2. ISO
  8. Free tools (open source)
    1. Monarc.lu
  9. Other useful material – add-on
    1. My Github

Below you’ll find some useful collateral (add-on, extra) information for the #PECB #ISO27005 Lead Risk manager course, that you can use for extra learning, deep dive, or educational support.

PECB Course info

Check: https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27005

Course categories

  • Intro (1d)
  • Foundation (2d)
  • Manager (3d)
  • Lead manager (5d)

Day 1

(in progress)

Day 2

(working on it)

Day 3

(yes, also)

Day 4

OCTAVE

CMU – Carnegie Mellon University

ENISA

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-ra-methods/m_octave.html

PECB

https://pecb.com/whitepaper > Search for OCTAVE

OCTAVE Allegro

https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=8419

MEHARI

Clusif

Clusif: https://clusif.fr/wp-content/uploads/2015/10/mehari-2010-risk-analysis-and-treatment-guide.pdf

ENISA

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-ra-methods/m_mehari.html

Exam reference material

For specific information about exam type, languages available, and other details, please visit the List of PECB Exams and the Examination Rules and Policies.

Exam candidate handbooks ISO27005

More info: https://help.pecb.com/index.php/list-of-pecb-exams/

(Search for ISO27005 and sort on your preferred language)

References

Toolkits

PECB

https://store.pecb.com/toolkits

ISO 27005 downloads

PECB

https://store.pecb.com/search?search=27005&cat=All+Categories

ISO

https://www.iso.org/search.html?q=27005

Free tools (open source)

Monarc.lu

Other useful material – add-on

My Github

https://github.com/PeterGeelen/ISO27001

Including:

#ISO27001:2022 transition requirements update published (MD 26:2023, Issue 2) – What has (not) changed?
  1. TLDR
  2. Ch1. Introduction
  3. Ch2. Summary of key changes
    1. §2.1 Background
    2. §2.2 Key changes (in ISO27001)
    3. $2.3 Impact
  4. Ch3. Key time scale
    1. AB
    2. CAB
  5. Ch4. Transition action process
    1. §4.1 AB Action
    2. §4.2 CAB Action
    3. §4.3 Other

IAF (the International Accreditation Forum), has published updated requirement for the transition of ISO 27001 from 2013 to the fresh 2022 version.

TLDR

  • transition period did not change (kept 3 years from publication)
  • (update) initial certification and recertification of ISO 27001:2023 until 30 april 2024
  • After 30 april 2024 you can only certify against the ISO27001:2022.
  • All ISO 27001:2013 shall expire or be witdrawn at the end of the transition period (3 years, october 2025)
  • (update) Certification transition assessment shall include minimum
    • an additional 1/2 day for recertification audit
    • an additional 1 day for surveillance or separate audit

Sources and milestones

Just you know

The MD:26 Issue 2 is published on 15 feb 2023, a few months after the publication of ISO 27001:2022 in October 2022.
Main issue: the previous issue was already published in august, before the final version of ISO 27001…

So obviously an update was required.

[For your info: If you need some help on acronyms, see the end of this article…]

Some thing were updated, but some were not.

The key topics to remember

What changed (green highlight) and what did not change (red highlight)?

  • Transition period is kept 3 years (36 months)
  • Initial certification and recertification by CAB to begin no later than 18 months (was: 12 months) after end of month of publication, (oct 2022).
    • This means that you can still certify against the old standard (ISO 27001:2013) until 30 April 2024
    • After 30 april 2024 you can only certify against the ISO27001:2022.
  • (4.2 CAB actions)
    • Certification transition assessment shall include minimum
      • an additional 1/2 day for recertification audit
      • an additional 1 day for surveillance or separate audit
  • All ISO 27001:2023 shall expire or be witdrawn at the end of the transition period (3 years, October 2025)

But of course, I don’t need to tell you : as soon as your CAB is ready, better upgrade your current certification to the newest version 2022.

A quick recap

A bit more details of the MD 26 document

Ch1. Introduction

Normative Document:ISO/IEC 27001:2022
Replacing:ISO/IEC 27001:2013
Current Status (at time of MD publication):IS
Transition Period:3 Years (36 months)

Ch2. Summary of key changes

§2.1 Background

Contains overview of ISO publication agenda from FDIS to IS

Did you know that

No more than two separate documents in the form of amendments shall be published modifying a current International Standard (see ISO/IEC Directive Part 1, 2022, Clause 2.10.3), therefore, the new edition of ISO/IEC 27001 had to be published after the preparation of ISO/IEC 27001:2013/DAmd1.

Source: IAF MD 26:2023

§2.2 Key changes (in ISO27001)

Source: MD26:2023

  1. Annex A references the information security controls in ISO/IEC27002:2022, which includes the information of control title and control.
  2. The notes of Clause 6.1.3 c) are revised editorially, including deleting the control objectives and using “information security control” to replace “control”.
  3. The wording of Clause 6.1.3 d) is re-organized to remove potential ambiguity.
  4. Adding a new item 4.2 c) to determine the requirements of the interested parties addressed through an information security management system(ISMS).
  5. Adding a new subclause 6.3 – Planning for changes, which defines that the changes to the ISMS shall be carried out by the organization in a planned manner.
  6. Keeping the consistency in the verb used in connection with documented information, for example, using “Documented information shall be available as evidence of XXX” in clauses 9.1, 9.2.2, 9.3.3 and 10.2.
  7. Using “externally provided process, products or services” to replace “outsourced processes” in Clause 8.1 and deleting the term “outsource”.
  8. Naming and reordering the subclauses in Clause 9.2 – Internal audit and 9.3- Management review.
  9. Reorder of the two subclauses in Clause 10 – Improvement.
  10. Updating the edition of the related documents listed in Bibliography, such as ISO/IEC 27002 and ISO 31000.
  11. Some deviations in ISO/IEC 27001:2013 to the high-level structure, identical core text, common terms and core definitions of MSS are revised for consistency with the harmonized structure for MSS, for example, Clause 6.2 d)

$2.3 Impact

  • New annex A (as ISO 27002:2022 is published)
  • Annex is normative
  • Updated harmonized structure

Ch3. Key time scale

AB

  • ready to assess : 30 apr 2023
  • initial assessment by AB: 30 apr 2023
  • AB transition of CAB completed by 31 oct 2023

CAB

  • initial and recert of ISO27001:2022 no later than 30 april 2024
  • transition of certified clients: 36 months, 31 october 2025

Ch4. Transition action process

§4.1 AB Action

Only interesting if you are an AB, see MD 26

§4.2 CAB Action

Is extra time likely to be needed for the transition? Yes.

  • 1) Minimum of 0.5 auditor day for the transition audit when it is carried out in conjunction with a recertification audit.
  • 2) Minimum of 1.0 auditor day for the transition audit when it is carried out in conjunction with
    • a surveillance audit or
    • as a separate audit.

Important note:

When the certification document is updated because the client successfully completed only the transition audit, the expiration of its current certification cycle will not be changed.

All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period.

§4.3 Other

TLDR…

Acronyms

AB = Accreditation Body

CAB = Conformity Assessment Body, certification body

IAF: International Accreditation Forum

FDIS: Final Draft International Standard

IS: International standard

Outlook Lifehack: Anticipating phishing test mails

Ever thought to outsmart phishing exercises and have Microsoft Outlook alerting you for phishing, upfront?

You can.

In short

Set a mail rule that

  1. inspects the mail headers for X-PHISH and/or PHISHINGTEST tags…
  2. Moves the incoming mail to a folder
  3. Optionally flag the mail or set a category

Steps

Create a mail rule

Step 1: Select condition

Set : “specific words in the message header”

Set the tags

  • X-PHISH
  • PHISHTEST

There might be some variations on these tags.

Additionally, if you know phishing test mails are sent from specific domains… add the domain/mail server

Step 2: move it to specified folder in your mailbox

Other options

Some other ideas: set mail alerts or use Power Automate to alert you… (but that’s for another article)

Disclaimer

Obviously it only works for these specific mail header tags, if phishing tests use different headers or other approach, you’ll need to adapt. Don’t take this solution for granted.

And worse, the real stuff… is still out there attacking you.

Stay alert, don’t click on mails and links you don’t expect!

Advanced

While you never should click on any suspicious mail, suspicious links or links in these mails… it still might be a good exercise and learning item to inspect the mail header info.

Look for anomalies in

  • mail sender name and published address mismatch with mailbox listed
  • sender vs reply-to mismatch
  • mail server mismatch with originating server
  • mail domain mismatch with originating domain

Advisory – Best practice

If you suspect a mail to be the real thing, actual phishing, better report the mail as spam and forward it to your local CERT or local cybersecurity authority for analysis (and domain URL blocking)…

And message your security team they failed the phishing test 😉

See also

Some info for mail server administrators 😉

There is nothing new in the 2022 version of ISO27001 and ISO27002. [aka: How to match 2022 with 2013 version and easily fix your Statement of applicability (SoA).]
  1. Introduction
  2. The quick and dirty overview
  3. A bit more details
  4. Extra reading material
    1. So, what IS new then??
  5. Background info
  6. Conclusion
  7. It’s not perfect, send your feedback.
  8. Need more?

Introduction

Early last year ISO updated the ISO27002 to version 2022, putting the previous version to rest after almost 10 years.

The ISO27002:2022, “Information security, cybersecurity and privacy protection — Information security controls”; This document provides a set of guidelines for generic information security controls.
And in fact, it’s the foundation of the ISO27001 Annex (remember the annex is derived from the ISO27002).

The ISO27001:2022, published in october 2022, is a new land mark for information security and governance best practices and basics.

With the launch, there has been a lot of articles explaining what changed.

In numbers we went from 114 controls to 93, which looks like a compression but there are also 11 new controls added.

I explained this situation in an article I wrote early last year in #PECB Insights Magazine: here is the link

How Does the New Revision of ISO/IEC 27002 Affect ISO/IEC 27001 (PECB Insights Magazine, 25 mar 2022)

Most important : section “New controls in ISO/IEC 27002:2022”:

New as in, new named controls in ISO27002 version 2022… with explicit requirements.
But if you look into them, you’ll discover you can perfectly fit them in the existing ISO27001:2013 version to protect your environment.

And you should have them implemented already a long time ago.

They are not new to protect your current environment against the current cyber threats.

But how do you map these new ISO27002/ISO27001:2022 controls in the existing 2013 implementation?

The quick and dirty overview

A bit more details

A bit more explanation needed, check this XLS Spread Sheet.

personal-use-mapping-new-iso27001-2022-controls-to-iso27001-2013Download

Extra reading material

The various controls and clauses in the new ISO27002 provide some interesting references to other standards, you could check:

  • Additional information relating to cloud services to be found in
    • ISO/IEC 17788,
    • ISO/IEC 17789 and
    • ISO/IEC 22123-1.
  • Cloud portability support and exit strategies
    • ISO/IEC 19941.
  • information security and public cloud services
    • ISO/IEC 27017.
  • PII protection in public clouds
    • ISO/IEC 27018.
  • Supplier relationships for cloud services
    • ISO/IEC 27036-4 and
  • cloudservice agreements
    • ISO/IEC 19086 series,
  • security and privacy specifically covered by
    • ISO/IEC 19086-4
  • guidance on ICT readiness for business continuity :
    • ISO/IEC 27031.
  • guidance on business continuity management systems
    • ISO 22301 and
    • ISO 22313.
  • guidance on BIA
    • ISO/TS 22317.
  • information on ICT security evaluation
    • ISO/IEC 15408 series.

Some free stuff: https://ffwd2.me/FreeISO

So, what IS new then??

For the hardcore perfectionistas: yes, the ISO27002 does update and change some the security controls, to be more modern.

Also the structural approach in the ISO27002 is now PPT, correction PPPT: Physical, People, Process and Technology (logical security tools).

But more important, major changes are actually present in the ISO27001 management clauses, not really in the ISO27002 (considering a reshuffle).
The most important update on the level of governance, compliance and audit DOES contain some important updates.

And it will be more result based, related to risk.

Do you want to know what has changed significantly, in de management processes, have a look at the presentation I hosted with PECB:

https://youtu.be/Vm8d-vIBNvo

You can download the presentation from slideshare:

ISO/IEC 27001:2022 – What are the changes? from PECB (at SlideShare)

And there is more interesting stuff as extra, on this LinkedIN article:

Background info

Conclusion

So, there is some work to do, moving from ISO27001:2013 to ISO27001:2022…

But make your life easy, fix the ISMS implementation now, update your SoA using the ISO27002 translation tables.
Watch out for the extra requirements in ISO27001 (As Koenraad Béroudiaux rightfully mentions on LinkedIn: check clause 4.4 and 8.1).

More info in the webinar.

Get ready!

It’s not perfect, send your feedback.

If you got improvement suggestions, let me know.

We can always make it better, together.

I’ll update the blog post and files with constructive suggestions.

Need more?

If you are curious about the topics below, let me know.

  • personal use spreadsheet for SoA mapping 2022 and 2013 version
  • personal use spreadsheet ISO27002:2022 categories to keep using the ISO27001, the same way you did before (organizing your ISMS with 14 business functions like management, HR, CISO, dev, legal, operations, …)

You know were to find me here on LinkedIn, here on Twitter, by mail, or direct messaging via Signal and other.

Note-to-self: redirect DNS bypass over your DNS blackhole server

When you have smart devices at home, like smart TVs, you might notice that they are bypassing your internal DNS server, by using public internet DNS (like Google DNS).

And if you use a DNS black hole server like PI-Hole, to protect your network against adware, malware, phishing this is not a healthy situation, as these smart devices bypass your security.

Resources:


Originally, I tried to implement the solution proposed and documented by Scott Helme.

But I ended up with DNS lockdown (and killing my entire internet connection, due to blockage of DNS.)

The solution documented by “Fiction becomes Fact” on this page, did the trick.

Apparently, since the 2018 version, some configuration items like the folder locations have changed…

Important: carefully verify the site folder location mentioned in the posts, to upload the config file. It has changed in newer Ubiquity versions. (Currently : unifi/unifi/data/sites/default/)

Older articles might point to wrong folders (I suppose it has recently changed with new versions of Ubiquiti…)

Just a few more important attention points:

  • in the newer version (dd oct 2022) of the Ubiquity interface, it looks like the topology does not support upload of maps anymore… so you can’t auto-create the site folder… (to be confirmed). You need to create the folders manually. And set the owner/group permission of the folders and config file yourself.
  • explicitly verify the owner settings of the newly created folders too

You can of course, apply this approach to other security solutions.

In essence:

  • all DNS traffic through your firewall must come from your (PiHole) DNS server
  • DNS traffic from any other device is redirected to the DNS server
  • DNS server logs and manages and filters (blocks/allow) the DNS requests

10x times thank you for your support! #mvpbuzz

If you’re in my community and professional network you must have witnessed a wave of Microsoft MVP #mvpbuzz announcements and notifications, early july on the various social media, Twitter, LinkedIN, blogs… a bit later than usual this year.

I was part of it, but due to personal reasons and summer vacation early July, I only had time till now to process it…

Certainly this year is a special year for me, a lot of things have changed professionally.
And when another special award disk dropped in the mail box just a few days ago, I can proudly announce that I’m honored to be awarded the Microsoft MVP award for the 10th time.
You work hard for it, hope for it, but never know if you have met the tough expectations.

[If you want to know more about the Microsoft MVP award, check this page on the MVP site. It’s a reward for a select expert community with great passion for Microsoft technologies, for all community efforts for last year.]


Honestly, it’s not about these white and blue glass disks, but appreciation for the passion and effort in the Microsoft community, to be recognized for the passion in Microsoft Security, more specifically Identity & Access.

And I certainly welcome the program change where the group of MVP “Enterprise Mobility” now moved to MVP Security, which aligns better with reality, what I stand for.

But I could never have achieved this with the great help and support of you, my audience.
So want to thank you, more than 10x for this.

Thank you!

Schakel die ontvangstbevestiging van mail alvast uit (in #Microsoft #Outlook, outlook.com, Outlook web en andere mail apps)

Deze week is er een aanpassing van het Belgische Wetboek uitgevoerd, die het eindelijk mogelijk maakt om via email kennisgeving te doen… zodat je via elektronische mail rechtsgeldige verzending zou moeten kunnen doen.
Zou…

Want het is misschien wel een grote stap vooruit in de rechtsspraak… maar waarom zou je de tegenpartij moedwillig in de kaart willen spelen?
In het ergste geval zou je dus ZELF het bewijs gaan leveren aan de tegenpartij…

Is dat nu wel een goed idee?
Ik denk het niet…

Dus zoals het artikel in de Tijd over deze wetsaanpassing al aangeeft…

 ‘Als blijkt dat u de mail gelezen heeft, door te antwoorden of via een leesbevestiging, dan is de kennisgeving sowieso geldig gebeurd.’ Het voorgaande impliceert dat e-mailgebruikers maar beter voorzichtig met leesbevestigingen omspringen. Zonder leesbevestiging of antwoord is het nog altijd aan de verzender om te bewijzen dat de ontvanger de mail wel degelijk ontvangen of gelezen heeft.

Mieke Verplancke in De Tijd – door PETER VAN MALDEGEM 
17 augustus 2022

Maar hoe schakel je die ontvangstbevestiging van mail nu uit?

Voor enkele van de meest gebruikte mail programma’s geef ik je alvast de nodige stappen mee.
Voor alle duidelijkheid, veel van die stappen vind je al op ‘t internet, dus voor enkele programma’s geef ik wat pointers naar goeie artikels… kwestie van de mail niet opnieuw uit te vinden.

Mogelijk voeg ik er later nog wat extra mail programma’s toe aan het lijstje.. maar hier kan je al mee starten. Kijk maar even of je favoriete mail client er tussen zit… En anders nog wat opties helemaal achteraan dit artikel.

Disclaimer: ik heb zelf niet altijd de Nederlandstalige versie van de gebruikersomgeving, dus sommige referenties gebruiken Engelse termen, maar je komt er zo ook wel.

Ik heb de volgende mail clients alvast opgelijst

  • Windows Mail app (Win10/11)
  • Outlook.com (web)
  • Microsoft 365 / Office 365 Outlook web
  • Microsoft 365 / Office 365 Outlook client
  • Outlook for Mobile Devices (Android)
  • Apple
  • GMail

Windows Mail app (Win 10)

Geen probleem, want er zijn geen opties in de Windows Mail app.
Dus als je opties wil, moet je een andere mail client zoeken, deze is te eenvoudig.

Outlook.com (web)

Zelf leesbevestiging vragen?

Njet, de Outlook.com web mail heeft die optie niet. (Wel via de Outlook voor Windows)

Leesbevestiging uitschakelen

Bron: https://support.microsoft.com/en-us/office/read-receipts-in-outlook-com-dc1b74ac-8578-469f-8894-82746e8e5aef

  1. Selecteer Instellingen Instellingen > Alle Outlook-instellingen weergeven.
  2. Selecteer E-mail > berichtafhandeling.
  3. Kies onder Leesbevestigingenhoe u reageert op aanvragen voor leesbevestigingen.

Microsoft Outlook

Microsoft 365 / Office 365 online web versie

Bron: https://support.microsoft.com/nl-nl/office/leesbevestigingen-in-outlook-web-e09af74d-3519-45fc-a680-37a538a92157

Het scherm is gelijkaardig aan de outlook.com versie…

Leesbevestiging uitschakelen doe je zo

Settings> Mail >Message Handling > Read Receipts

Microsoft 365 / Office 365 / Outlook v2016, v2019, … mail client

Leesbevestiging vragen (voor één mail of alle mail)

Zie dit Microsoft Support Artikel : https://support.microsoft.com/en-us/office/add-and-request-read-receipts-and-delivery-notifications-a34bf70a-4c2c-4461-b2a1-12e4a7a92141?WT.mc_id=ES-MVP-5002204

Leesbevestiging uitschakelen

Open je Outlook client, menu File (Bestand) > Selecteer de juiste mailbox (als je er meer dan één hebt) > Kies Options (Opties) > Mail > Tracking

Meer details alvast in deze interessante artikels (Engels)

Outlook for Mobile Devices (Android)

Bron: https://answers.microsoft.com/en-us/outlook_com/forum/all/disable-read-receipts-in-outlook-for-android/eee5a248-935c-42da-9087-1487fa70b860

  1. Open Outlook Web App(OWA).
  2. Login op je mailbox (je moet onderstaande herhalen als je meerdere maiboxen hebt)
  3. Kies Settings/Instellingen (View All Settings)
  4. Kies General/Algemeen > Mobile Devices
  5. Kies Don’t send read receipts for messages read on devices that use Exchange ActiveSync.

Apple

Houd er rekening mee dat de meeste instellingen voor het lezen van e-mails zich op het niveau van de e-mailtoepassing bevinden… het hangt er dus van af welke e-mailapp u op uw apparaat gebruikt.

Maar: “Apple Is Killing Email Read Receipts With a Single Popup” (https://medium.com/big-tech/apple-is-killing-email-read-receipts-like-entirely-14da5aa7fa75)

En ook:

Gmail

Google workspace (professional/enterprise)

How do I turn off automatic read receipts for my users?https://support.google.com/googlecloud/answer/10636687

Gmail web (gratis)

Geen opties voor ontvangstbevestiging bij verzenden of ontvangen.
[Opmerking, ik heb ze alvast niet gevonden, … als ze er zijn, laat gerust iets weten.]

En nog een paar andere mail clients

Nog andere artikels

Cyber-vakantielectuur: 2 #mustread boeken over impact van desinformatie en fake news, de wondere wereld van factchecking

Vakantie is de ideale tijd om even bij te lezen… dus ik heb van de gelegenheid gebruik gemaakt om 2 nieuwe, versgepubliceerde boeken onder handen te nemen. 1 boek van onderzoeksjournalist Tim Verheyden en een boek van fact-checker Maarten Schenk.

Beide gaan over desinformatie en fake news…een vakgebied dat op ‘t eerste zicht niks te maken heeft met privacy, data protection of cybersecurity…

Hoewel het minder relevant is voor cyber-security, is het na 2 jaar corona-pandemie anders wel heel erg duidelijk hoe desinformatie en manipulatie van de publieke opinie een belangrijke rol heeft gespeeld in het verloop van de pandemie…

Maar als je even wat verder kijkt en beseft dat recente wereldconflicten en grote politieke evenementen tegenwoordig allemaal vooraf gegaan worden door grote cyberaanvallen en massieve internet-propaganda campagnes, wordt het snel duidelijk dat desinformatie en fake news daar integraal een onderdeel van zijn.

Maar desinformatie is geen recent fenomeen. Dat is in de voorgaande wereld-oorlogen ook steeds toegepast of zelfs in recente oorlogsgeschiedenis,… kijk maar waar zogezegde atoomdreiging in het Midden-Oosten toe geleid heeft…


Alleen, door internet zijn de proporties en de mogelijkheden enorm toegenomen om beïnvloeding en manipulatie toe te passen.
En het feit dat we zowat alles vanop afstand regelen, en nauwelijks nog direct contact met mekaar hebben… (en zeker niet tijdens corona), maakt desinformatie alleen maar makkelijker.

En dit heeft een grote impact op respect voor mekaar, begrip voor mekaar, tolerantie, rekenschap/aansprakelijkheid, vrijheid van spreken, … heel wat grenzen vervagen.

En dat is wat de boeken van Tim Verheyden en Maarten Schenk mooi uit de doeken doen, op een goed leesbare manier. (Maar ik garandeer je dat je op ‘t einde met een hoop nieuwe vragen achter blijft…)

2 boeken

Het is erg nuttig om beide boeken na elkaar te lezen…

Start eerst met het boek van Tim Verheyden: “Het had waar kunnen zijn”.

De reden is simpel, op het einde van zijn boek verwijst Tim naar het tweede boek: “De fake news files” van Maarten Schenk (Subtitel : “De onthullingen van een bullshit detective“).

Beide boeken bespreken een heel aantal real-life cases en verwijzen naar een shitload van andere lectuur, boeken, papers, websites en ander referentie materiaal. Het boek van Tim Verheyden vermeldt niet duidelijk de bronnen.
Dat is erg jammer, want het is vaak erg handig om eens te gaan kijken naar de inhoud en de kernpunten van het verhaal.

[Dit is alvast een oproep aan Tim Verheyden om, net zoals Maarten Schenk, een bronnenlijst te publiceren, zodat je zelf wat verder op zoek kan gaan naar de achtergrond van hun verhalen.

Tim is een uitstekende onderzoeksjournalist, dus die lijst heeft ie al. Daar ben ik zeker van.]

“Het had waar kunnen zijn”

Tim Verheyden toont aan, met ondersteuning van een aantal experts zoals Nathalie Van Raemdonck, Siri Beerends, Rien Emmery, Maarten Schenk, … hoe erg desinformatie en fake news ons dagelijks leven beïnvloedt.

Het pakt echt bij de adem als je erbij stilstaat hoe ver het gaat.
Maar vergis je niet, zoals ik al eerder zei, dit is geen recent probleem. Desinformatie, propaganda en fake news is zo oud als de mensheid. Dus het is erg moeilijk uit te roeien, net zoals roddels is het een onderdeel van menselijk gedrag.

Het is door internet en de overvloed van informatie, alleen maar moeilijker geworden om feiten en fictie uit elkaar te houden.

De conclusie van Tim is duidelijk, we moeten back to the basics van persoonlijke communicatie, zeker na de corona periode.

“Durf bullshit te benoemen, meer dan ooit. Maar laten we vooral weer met elkaar praten”

(Tim Verheyden)

Bovendien zijn we de laatste decennia heel erg gewoon geraakt aan een stabiele, bijna risicoloze wereld. En Corona en de Russisch-Oekrainse oorlog heeft dat beeld ernstig verstoord.

“De fake news files”

Terwijl Tim Verheyden als onderzoeksjournalist, desinformatie, fake news en propaganda eerder bekijkt vanuit het recente wereldnieuws, bekijkt Maarten Schenk het onderwerp eerder vanuit een technische hoek.

Dit is op het eerste zicht een totaal andere aanpak… Maar het wordt snel duidelijk dat de 2 boeken heel erg op elkaar aansluiten. En het boek van Maarten Schenk brengt heel wat verheldering op het boek van Tim Verheyden.

Daarnaast verwijzen ze allebei naar herkenbare verhalen, die we allemaal wel al ergens in ‘t nieuws gezien hebben, of op internet of op social media…

Maarten maakt duidelijk dat voor heel wat mensen de desinformatie een essentieel onderdeel van hun identiteit geworden is en dat elk redelijke discussie of bewijsmateriaal van het tegendeel dan onmogelijk is omdat het een persoonlijke belediging wordt, die op hun persoon gericht is.

Maar deze gedachtengang kan, net zoals het corona virus, erg aanstekelijk zijn… En je kan door continue factchecking wel een soort vaccinatie opzetten, die de impact besmetting kan indammen… maar het is werk van lange adem.

En je moet er continue aan blijven werken want er komen elke dag nieuwe fabeltjes bij.

Extra info – Het had waar kunnen zijn (Tim Verheyden)

Frances Haugen

Frances Haugen (Facebook klokkenluidster)

https://en.wikipedia.org/wiki/Frances_Haugen

https://www.theguardian.com/technology/2021/oct/24/frances-haugen-i-never-wanted-to-be-a-whistleblower-but-lives-were-in-danger

https://time.com/6121931/frances-haugen-facebook-whistleblower-profile/

Haar website: https://www.franceshaugen.com/

Frances Haugen on Twitter: https://twitter.com/franceshaugen?lang=en

Arjen Luback – De fabeltjesfuik

Siri Beerends

https://www.siribeerends.nl/

Research: https://www.siribeerends.nl/research/

SETUP Media Lab: https://www.setup.nl/

World Economic Forum (WEF) – The Great Reset

https://www.weforum.org/great-reset

Extra info – De Fake News Files (Maarten Schenk)

Leadstories

Just Because It’s Trending Doesn’t Mean It’s True — Fact checking at the speed of likes since 2015

https://leadstories.com/

Trendolizer

https://www.trendolizer.com/

Referenties & bronnen

Maarten Schenk heeft de meeste van zijn bronnen en referenties uit het boek verzameld op onderstaande link, wat het erg handig maakt om dit verder door te nemen…

https://leadstories.com/de-fake-news-files.html

Boek referenties

Als je de boeken zelf in je kast of eLibrary will hebben, dan vind je hieronder de nodige informatie.

(Ter info, ik heb beide paperbacks hier in de kast staan, moest je ze even willen uitlenen… laat me iets weten.)

“Het had waar kunnen zijn” (1 jun 2022), uitgeverij Pelckmans

e-book (ISBN 978-94-6401-659-8, €14,99): https://www.pelckmansuitgevers.be/het-had-waar-kunnen-zijn-e-book.html

Paperback (ISBN 978-94-6401-609-3, €22,50): https://www.pelckmansuitgevers.be/het-had-waar-kunnen-zijn.html

De Fake News Files (22 mar 2022), uitgeverij Lannoo

Paperback: (ISBN 978-94-0147-686-7, €22,99): https://www.lannoo.be/nl/de-fake-news-files.

E-book (ISBN 978-94-0148-391-9, €12,99): https://www.ebook.nl/ebook/9789401483919-de-fake-news-files-maarten-schenk/

Andere interessante referenties

(deze referenties kunnen in de toekomst nog verder bijgewerkt worden, of er kan nog bijkomende info toegevoegd worden na de initiele publicatie…)

VRT – Boek bespreking door Jef Cauwenberghs

https://www.vrt.be/vrtnws/nl/2022/06/09/zes-inzichten-desinformatie-tim-verheyde/

Zelf verder zoeken! Meer weten?

Online

Tim Verheyden

Blog met heel wat interessante artikels: https://timverheyden.com/blog

Nathalie Van Raemdonck

LinkedIN: https://www.linkedin.com/in/nathalievraemdonck/

Twitter: https://twitter.com/eilah_tan

Website: https://nathalievanraemdonck.com/

Enkele van haar laatste presentaties:

https://eooh.eu/podcasts/he2rnyb04b5no6q6k1xbdpeiey0kd0-nf5e8-99npr-7jnyr

Rien Emmery (@ArbiterOfTweets)

Twitter

Website

https://muckrack.com/rien-emmery/articles

Boeken

On Bullshit (1986), Harry G. Frankfurt

https://en.wikipedia.org/wiki/On_Bullshit

And also

VRTNWS fact checks:

https://www.vrt.be/vrtnws/nl/rubrieken/desinformatie/check/

https://www.vrt.be/vrtnws/nl/2022/06/28/de-checkers-2022/

De Checkers

https://decheckers.be/ : “Een non-profitorganisatie die het publieke debat wil voeden met feiten en nieuwsgeletterdheid stimuleren. deCheckers werkt samen met journalisten van Knack, VRT NWS en Factcheck.Vlaanderen.“

Note-to-self: CIS Software Supply Chain security guide

CIS (Center for Internet Security) has published an interesting guide on software supply chain security.

Even if you do not build software on your own, it still is useful to to pick the relevant security measures/controls as part of your information security management to protect yourself and your enterprise.

As we all learned from the log4j issue which impacted many generally used platforms, it has become very clear that you need to look beyond the first level of control (your own)…

It’s critical to manage 2nd (your suppliers) and even third level (suppliers of suppliers)

Highlights

In high level overview, the document discusses:

  1. Source code
    • Code changes
    • Repository management
    • Contribution access
    • Third party
    • Code risks
  2. Build pipelines
    • Build environment
    • Build worker
    • Pipeline instructions
  3. Dependencies
    1. Third party packages
    2. Validate packages
  4. Artifacts
    • Verification
    • Access to artifacts
    • Package registries
    • Origin traceability
  5. Deployment
    • Deployment configuration
    • Deployment environment

Supply chain guide access (need to register on CIS)

https://workbench.cisecurity.org/files/3972 (login needed, but it’s non-commercial, limited data protection risk)

More info:

Extra references

Software impacted by Log4j, see the NCSC Github / Software inventory: https://github.com/NCSC-NL/log4shell/tree/main/software

(if necessary this post will be updated with more interesting material, when applicable)