1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco發佈 SD-WAN vManage API 安全更新
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-unauthapi-sphCLYPA

郵件伺服器系統Zimbra修補已被用於攻擊行動的零時差漏洞
https://info.zimbra.com/security-update-zimbra-collaboration-suite-version-8.8.15-important

Zimbra Warns of Critical Zero-Day Flaw in Email Software Amid Active Exploitation
https://thehackernews.com/2023/07/zimbra-warns-of-critical-zero-day-flaw.html

Juniper修補網路設備作業系統高風險漏洞
https://www.securityweek.com/juniper-networks-patches-high-severity-vulnerabilities-in-junos-os/

微軟發佈7月份安全性公告
https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul

Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack
https://thehackernews.com/2023/07/microsoft-releases-patches-for-130.html

Attackers Exploit Unpatched Windows Zero-Day Vulnerability
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/microsoft-zeroday-exploit

駭客利用Windows的相容性政策瑕疵，打造核心層級的驅動程式簽章
https://thehackernews.com/2023/07/hackers-exploit-windows-policy-loophole.html
https://blog.talosintelligence.com/old-certificate-new-signature/
https://blog.talosintelligence.com/undocumented-reddriver/
https://news.sophos.com/en-us/2023/07/11/microsoft-revokes-malicious-drivers-in-patch-tuesday-culling/

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens
https://thehackernews.com/2023/07/microsoft-bug-allowed-hackers-to-breach.html

Yet Another MS CVE: Don’t Get Caught In The Storm!
https://www.cynet.com/blog/yet-another-ms-cve-dont-get-caught-in-the-storm/

Fortinet 發布 FortiOS 和 FortiProxy 安全更新
https://www.fortiguard.com/psirt/FG-IR-23-183

Fortinet修補防火牆、網頁安全閘道RCE漏洞
https://www.fortiguard.com/psirt/FG-IR-23-183

MOVEit再爆新漏洞! 多個版本受影響
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10557

Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software
https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html

Adobe 已發布安全更新，以解決多個 Adobe 產品中的弱點
https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html

Mastodon Social Network Patches Critical Flaws Allowing Server Takeover
https://thehackernews.com/2023/07/mastodon-social-network-patches.html

開源程式庫Ghostscript存在重大漏洞
https://www.kroll.com/en/insights/publications/cyber/ghostscript-cve-2023-36664-remote-code-execution-vulnerability

SoincWall修補防火牆管理系統的重大漏洞
https://www.sonicwall.com/support/notices/urgent-security-notice-sonicwall-gms-analytics-impacted-by-suite-of-vulnerabilities/230710150218060/

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products
https://thehackernews.com/2023/07/new-vulnerabilities-disclosed-in.html

WordPress外掛程式All-In-One Security出現曝露明文密碼的漏洞
https://www.securityweek.com/popular-wordpress-security-plugin-caught-logging-plaintext-passwords/

Improve Your Security WordPress Spam Protection With CleanTalk Anti-Spam
https://thehackernews.com/2023/07/improve-your-security-wordpress-spam.html

Adobe修補ColdFusion、InDesign漏洞
https://www.securityweek.com/adobe-patch-tuesday-critical-flaws-haunt-indesign-coldfusion/

VMware事件記錄分析系統漏洞CVE-2023-20864已出現概念性驗證攻擊程式碼
https://www.bleepingcomputer.com/news/security/vmware-warns-of-exploit-available-for-critical-vrealize-rce-bug/

社群網站Mastodon修補重大漏洞TootRoot
https://www.bleepingcomputer.com/news/security/critical-tootroot-bug-lets-attackers-hijack-mastodon-servers/
https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm
https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp

2.銀行/金融/保險/證券/金融監理 新聞及資安
Malicious ad for USPS fishes for banking credentials
https://www.malwarebytes.com/blog/threat-intelligence/2023/07/malicious-ad-for-usps-phishes-for-jpmorgan-chase-credentials

New TOITOIN Banking Trojan Targeting Latin American Businesses
https://thehackernews.com/2023/07/new-toitoin-banking-trojan-targeting.html

德意志銀行發生資料外洩，起因疑為服務供應商遭MOVEit Transfer零時差攻擊
https://www.bleepingcomputer.com/news/security/deutsche-bank-confirms-provider-breach-exposed-customer-data/

拉丁美洲遭到銀行木馬Toition鎖定
https://www.zscaler.com/blogs/security-research/toitoin-trojan-analyzing-new-multi-stage-attack-targeting-latam-region

農金成立資訊安全部， 通過ISO 27001認證
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10569

元大金供應商大會，聚焦資安管理議題
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10570

中國大陸金融反腐震動大陸金融圈　光大集團前董座唐雙寧被查
https://udn.com/news/story/7333/7302520

防疫險釀產險浩劫 金管會 要檢討商品監理法規
https://reurl.cc/7kly2D

中國大陸金融監管總局發布修訂後的汽車金融公司管理辦法
http://big5.news.cn/gate/big5/www.news.cn/fortune/2023-07/15/c_1129750929.htm

3.信用卡/電子支付/行動支付/pay/支付系統/資安
Revolut Faces $20 Million Loss as Attackers Exploit Payment System Weakness
https://thehackernews.com/2023/07/hackers-steal-20-million-by-exploiting.html

第三方支付淪洗錢工具　數位部出手全面納管
https://www.cardu.com.tw/news/detail.php?49283

六月最新調查 - 台灣行動支付使用習慣
https://www.thenewslens.com/article/188375

悠遊卡、街口支付都能在日本用啦！日本超方便的行動支付介紹～購物超快速
https://reurl.cc/v7X5Do

中柬合作 推動跨境QR Code支付互聯互通
https://reurl.cc/65ky2O

5月電子支付再遇亂流　拖垮業績主因竟是他
https://www.cardu.com.tw/news/detail.php?49282

勾結大陸駭客、盜刷集團利用電子支付盜刷千萬 刑事局逮15人
https://udn.com/news/story/7315/7282139

政府App唔方便 電子支付裹足不前
https://hk.news.yahoo.com/%E6%94%BF%E5%BA%9Capp%E5%94%94%E6%96%B9%E4%BE%BF-%E9%9B%BB%E5%AD%90%E6%94%AF%E4%BB%98%E8%A3%B9%E8%B6%B3%E4%B8%8D%E5%89%8D-214500255.html

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
貝萊德CEO發豪語：加密貨幣將「超越」任何一種國際貨幣
https://www.blocktempo.com/blackrock-ceo-says-crypto-will-transcend-international-currencies/

2.7億潛在用戶》印尼「國家級」加密貨幣交易所，預告7月上線
https://www.blocktempo.com/indonesian-officials-to-launch-cryptocurrency-exchange-this-month/

韓國幣圈文化：為何他們偏愛加密貨幣，卻唯獨不喜歡 DeFi
https://blockcast.it/2023/07/15/why-koreans-love-crypto-but-not-defi/

美法院認定瑞波幣非證券 加密貨幣士氣大振
https://reurl.cc/GADddZ

貝萊德CEO：加密貨幣具有獨特的價值，將超越任何一種貨幣
https://news.cnyes.com/news/id/5252843

不轉帳就殺！日本男健身遭6巨漢圍毆，逼吐1.1億日圓加密貨幣
https://www.blocktempo.com/japanese-cryptocurrency-crime-surges/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
木馬程式LokiBot透過MSHTML漏洞和Follina散布
https://www.fortinet.com/blog/threat-research/lokibot-targets-microsoft-office-document-using-vulnerabilities-and-macros

中國駭客鎖定電玩產業，散布含有微軟WHQL簽章的Rootkit
https://www.trendmicro.com/en_us/research/23/g/hunting-for-a-new-stealthy-universal-rootkit-loader.html

勒索軟體駭客Clop將62個安永會計師事務所客戶列入受害組織名單
https://www.bankinfosecurity.com/clop-crime-group-adds-62-ernst-young-clients-to-leak-sites-a-22514

有人模仿竊資軟體W4SP，散布惡意PyPI套件
https://unit42.paloaltonetworks.com/malicious-packages-in-pypi/

勒索軟體Big Head假借軟體安裝程式散布
https://www.trendmicro.com/en_us/research/23/g/tailing-big-head-ransomware-variants-tactics-and-impact.html

勒索軟體BlackByte 2.0利用Exchange伺服器漏洞入侵受害組織，5天內完成加密檔案並進行勒索
https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/

Wise Remote Stealer結合RAT木馬及竊資軟體能力，駭客可從遠端下達攻擊指令
https://www.cyfirma.com/outofband/wise-remote-stealer-unleashed-unveiling-its-multifaceted-malicious-arsenal/

伊朗駭客TA453同時針對Windows和macOS用戶發動攻擊
https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware

Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware
https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware?utm_source=twitter&utm_medium=social&utm_source=social_organic&utm_social_network=twitter&utm_campaign=threat_research&utm_post_id=381f2172-cb7f-4d7a-bc5f-f4e2eeee72cb

Six Malicious Python Packages in the PyPI Targeting Windows Users
https://unit42.paloaltonetworks.com/malicious-packages-in-pypi/

Loader activity for Formbook "QM18"
https://isc.sans.edu/diary/rss/30020

Agile Approach to Mass Cloud Credential Harvesting and Crypto Mining Sprints Ahead
https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/

LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros
https://www.fortinet.com/blog/threat-research/lokibot-targets-microsoft-office-document-using-vulnerabilities-and-macros

BlackByte 2.0 Ransomware: Infiltrate, Encrypt, and Extort in Just 5 Days
https://thehackernews.com/2023/07/blackbyte-20-ransomware-infiltrate.html

Cybersecurity Agencies Sound Alarm on Rising TrueBot Malware Attacks
https://thehackernews.com/2023/07/cybersecurity-agencies-sound-alarm-on.html

Iranian Hackers' Sophisticated Malware Targets Windows and macOS Users
https://thehackernews.com/2023/07/iranian-hackers-sophisticated-malware.html

RomCom RAT Targeting NATO and Ukraine Support Groups
https://thehackernews.com/2023/07/romcom-rat-targeting-nato-and-ukraine.html

Beware of Big Head Ransomware: Spreading Through Fake Windows Updates
https://thehackernews.com/2023/07/beware-of-big-head-ransomware-spreading.html

Ransomware Extortion Skyrockets in 2023, Reaching $449.1 Million and Counting
https://thehackernews.com/2023/07/ransomware-extortion-skyrockets-in-2023.html

New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries
https://thehackernews.com/2023/07/new-soho-router-botnet-avrecon-spreads.html

惡意軟體PicassoLoader鎖定烏克蘭及波蘭而來
https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland/

PicassoLoader Malware Used in Ongoing Attacks on Ukraine and Poland
https://thehackernews.com/2023/07/picassoloader-malware-used-in-ongoing.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
即時通訊框架QuickBlox存在漏洞，恐曝露數百萬使用者資料
https://www.hackread.com/exploitable-flaws-quickblox-expose-user-records/

Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
https://thehackernews.com/2023/07/google-releases-android-patch-update.html

看似正常的檔案管理與復原App暗中收集安卓手機資料，並傳送至中國
https://blog.pradeo.com/spyware-tied-china-found-google-play-store

Two Spyware Apps on Google Play with 1.5 Million Users Sending Data to China
https://thehackernews.com/2023/07/two-spyware-apps-on-google-play-with-15.html

蘋果重新發布緊急安全更新，原因是瀏覽部分網站可能會出錯
https://support.apple.com/en-us/HT213823
https://support.apple.com/en-us/HT213825
https://www.bleepingcomputer.com/news/apple/apple-re-releases-zero-day-patch-after-fixing-browsing-issue/

蘋果針對電腦、行動裝置、瀏覽器發布快速安全回應更新，修補零時差漏洞CVE-2023-37450
https://www.bleepingcomputer.com/news/apple/apple-releases-emergency-update-to-fix-zero-day-exploited-in-attacks/
https://support.apple.com/kb/HT213826
https://support.apple.com/kb/HT213823
https://support.apple.com/kb/HT213825

Apple Issues Urgent Patch for Zero-Day Flaw Targeting iOS, iPadOS, macOS, and Safari
https://thehackernews.com/2023/07/apple-issues-urgent-patch-for-zero-day.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
駭客組織SiegedSec鎖定美國衛星接收器及工控系統下手
https://cyberscoop.com/siegedsec-hack-transition-bans-satellite-systems/

澳洲基礎設施服務業者Ventia遭到網路攻擊
https://therecord.media/ventia-hit-with-cyberattack-australia

中國駭客入侵美國政府機關的電子郵件帳號
http://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads
https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/
https://www.washingtonpost.com/national-security/2023/07/12/microsoft-hack-china/
https://edition.cnn.com/2023/07/12/politics/china-based-hackers-us-government-email-intl-hnk/index.html
https://abcnews.go.com/Politics/commerce-secretary-gina-raimondos-emails-hacked-microsoft-cyber/story?id=101201179
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a

Malicious campaigns target government, military and civilian entities in Ukraine, Poland
https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2023/07/malicious-campaigns-target-entities-in-ukraine-poland.txt
https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland/

Microsoft Thwarts Chinese Cyber Attack Targeting Western European Governments
https://thehackernews.com/2023/07/microsoft-thwarts-chinese-cyber-attack.html

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector
https://thehackernews.com/2023/07/chinese-hackers-deploy-microsoft-signed.html

U.S. Government Agencies' Emails Compromised in China-Backed Cyber Attack
https://thehackernews.com/2023/07/us-government-agencies-emails.html

TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud
https://thehackernews.com/2023/07/teamtnts-cloud-credential-stealing.html

TeamTNT's Silentbob Botnet Infecting 196 Hosts in Cloud Attack Campaign
https://thehackernews.com/2023/07/teamtnts-silentbob-botnet-infecting-196.html

電競設備業者Razer傳出資料外洩，有人在駭客論壇兜售網站後端登入資料
https://www.bleepingcomputer.com/news/security/razer-investigates-data-breach-claims-resets-user-sessions/

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
北約高峰會遭駭客組織Romcom鎖定，進行網釣攻擊
https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit

It’s Raining Phish and Scams – How Cloudflare Pages.dev and Workers.dev Domains Get Abused
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/

Diplomats Beware: Cloaked Ursa Phishing With a Twist
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/

Vishing Goes High-Tech: New 'Letscall' Malware Employs Voice Traffic Routing
https://thehackernews.com/2023/07/vishing-goes-high-tech-new-letscall.html

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security
https://thehackernews.com/2023/07/new-mozilla-feature-blocks-risky-add.html

俄羅斯駭客APT29假借拋售BMW汽車的名義，對烏克蘭外交官發動釣魚攻擊
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/

針對鎖定北約國家高峰會的網釣攻擊，微軟指出駭客利用了新的Office零時差漏洞
https://www.bleepingcomputer.com/news/security/microsoft-unpatched-office-zero-day-exploited-in-nato-summit-attacks/
https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/
https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
https://cert.gov.ua/article/5077168

駭客濫用網站代管平臺Glitch架設釣魚網站，騙取Microsoft 365帳號
https://www.vadesecure.com/en/blog/m365-phishing-email-analysis-eevilcorp

研究人員揭露可繞過語音身分驗證的攻擊手法，若進行6次比對成功率達99%
https://www.ithome.com.tw/news/157699
https://uwaterloo.ca/news/media/how-secure-are-voice-authentication-systems-really
https://www.pindrop.com/blog/exposing-the-truth-about-zero-day-deepfake-attacks-metas-voicebox-case-study

惡意NPM套件被用於供應鏈攻擊及網路釣魚
https://www.reversinglabs.com/blog/operation-brainleeches-malicious-npm-packages-fuel-supply-chain-and-phishing-attacks

美國翻譯公司資料庫不設防，曝露2.5萬筆敏感資料
https://www.hackread.com/global-translation-service-exposed-records/

語音網釣攻擊Letscall鎖定韓國而來，利用VoIP和WebRTC等技術繞過防火牆
https://www.threatfabric.com/blogs/letscall-new-sophisticated-vishing-toolset

孟加拉政府網站曝露市民個資
https://techcrunch.com/2023/07/07/bangladesh-government-website-leaks-citizens-personal-data/

別再放！台鐵置物櫃取「金融卡」 逮37件詐騙
https://reurl.cc/M8DZ1p

E.研究報告/工具
與22年相比，無檔案攻擊暴增14倍
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10553

挖礦攻擊行動Scarleteel濫用無伺服器運算服務AWS Fargate
https://sysdig.com/blog/scarleteel-2-0/

研究人員針對Ubiquiti路由器漏洞公布細節
https://ssd-disclosure.com/ssd-advisory-edgerouters-and-aircube-miniupnpd-heap-overflow/

Stories from the SOC: OneNote MalSpam – Detection & Response
https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-onenote-malspam-detection-response

Close Security Gaps with Continuous Threat Exposure Management
https://thehackernews.com/2023/07/close-security-gaps-with-continuous.html

JumpCloud Resets API Keys Amid Ongoing Cybersecurity Incident
https://thehackernews.com/2023/07/jumpcloud-resets-api-keys-amid-ongoing.html

Surviving the 800 Gbps Storm: Gain Insights from Gcore's 2023 DDoS Attack Statistics
https://thehackernews.com/2023/07/surviving-800-gbps-storm-gain-insights.html

Global Retailers Must Keep an Eye on Their SaaS Stack
https://thehackernews.com/2023/07/global-retailers-must-keep-eye-on-their.html

How to Apply MITRE ATT&CK to Your Organization
https://thehackernews.com/2023/07/how-to-apply-mitre-att-to-your.html

The Risks and Preventions of AI in Business: Safeguarding Against Potential Pitfalls
https://thehackernews.com/2023/07/the-risks-and-preventions-of-ai-in.html

惡意軟體PyLoose挾持雲端工作負載挖掘門羅幣
http://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads

Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining
https://thehackernews.com/2023/07/python-based-pyloose-fileless-attack.html

Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures
https://thehackernews.com/2023/07/hackers-exploit-windows-policy-loophole.html

Defend Against Insider Threats: Join this Webinar on SaaS Security Posture Management
https://thehackernews.com/2023/07/defend-against-insider-threats-join.html

AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plaintext
https://thehackernews.com/2023/07/aios-wordpress-plugin-faces-backlash.html

WormGPT: New AI Tool Allows Cybercriminals to Launch Sophisticated Cyber Attacks
https://thehackernews.com/2023/07/wormgpt-new-ai-tool-allows.html

Defend Against Insider Threats: Join this Webinar on SaaS Security Posture Management
https://thehackernews.com/2023/07/defend-against-insider-threats-join.html

F.商業
調查：23年台灣企業增加資安預算但信心度不足
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10544

Azure AD更名為Microsoft Entra ID
https://www.microsoft.com/en-us/security/blog/2023/07/11/microsoft-entra-expands-into-security-service-edge-and-azure-ad-becomes-microsoft-entra-id/

SCARLETEEL Cryptojacking Campaign Exploiting AWS Fargate in Ongoing Campaign
https://thehackernews.com/2023/07/scarleteel-cryptojacking-campaign.html

Let's Encrypt將於2024年終止跨簽章支援
https://www.ithome.com.tw/news/157725

Intel vPro新三大安全特性，聚焦虛擬化、攻擊面降低、AI威脅偵測
https://www.ithome.com.tw/news/157727

打造Banking 4.0、綠色金融新生態 昕力資訊：「跨領域合作」成金融轉型關鍵助力
https://www.businessweekly.com.tw/business/indep/1003533

G.政府
財政部展開個資行政檢查，萬家業者入列
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10554

經濟部：即日起資安納入「電動車充電設備」自願性產品驗證項目
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10556

經濟部將資訊安全納入電動車充電設備的產品驗證項目
https://www.moea.gov.tw/MNS/populace/news/News.aspx?kind=1&menu_id=40&news_id=110500

台灣網路資訊中心與CSC合作強化 .tw 跨域快速處理機制
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10551

架構細節首度揭露！衛福部揭次世代HIS平臺架構雛形，還要建醫療器材平臺串IoT資料
https://www.ithome.com.tw/news/157801

桃園市政府消防局緊急救護平臺傳出遭駭
https://bccnews.com.tw/archives/458814

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
中小企業的工控資安：「生態系資安聯防」是關鍵
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10545

Rockwell Automation控制系統ControlLogix漏洞恐導致工控系統曝露於遠端攻擊風險
https://www.dragos.com/blog/mitigating-cves-impacting-rockwell-automation-controllogix-firmware/

Rockwell Automation ControlLogix Bugs Expose Industrial Systems to Remote Attacks
https://thehackernews.com/2023/07/rockwell-automation-controllogix-bugs.html

Critical Security Flaws Uncovered in Honeywell Experion DCS and QuickBlox Services
https://thehackernews.com/2023/07/critical-security-flaws-uncovered-in.html

臺灣半導體產業推動資安標準SEMI E187，獲SEMI國際標準貢獻獎
https://moda.gov.tw/ADI/news/latest-news/5701

西門子、施耐德電機發布7月例行更新，修補逾50個漏洞
https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-fix-50-vulnerabilities/

為強化OT資安，Honeywell買下SCADAfence
https://www.honeywell.com/us/en/press/2023/07/honeywell-to-acquire-scadafence-strengthening-its-cybersecurity-software-portfolio

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

6.近期資安活動及研討會
JMUG | 台灣初登場 2023/7/18
https://jamf.kktix.cc/events/cloudidpokta

Taipei LangChain Hacky Hour 2023/7/18
https://www.meetup.com/taipei_langchain/events/294403943/

Taiwan Multimedia Tech #9 2023/7/19
https://www.meetup.com/taiwan-multimedia-technology/events/293987313/

一鍵完成設備部署、資安、合規的實作秘笈-科技製造業專場｜犇亞會議中心 2023/7/20
https://jamf.kktix.cc/events/appleinmanufacturing

【全景軟體ｘ啄木科技】Zero Trust Solution 零信任解決方案 2023/7/20
https://www.accupass.com/event/2306130338409522122060

Taipei dbt Meetup #13 (in-person 👫 & online 👨‍💻)2023/7/26
https://www.meetup.com/taipei-dbt-meetup/events/294298229/

2023政府資安發展論壇-零信任 打造韌性國家 2023/7/27
https://www.informationsecurity.com.tw/seminar/2023_Infosec-gov/

AI引爆電商革命 數據驅動變現力 2023/7/27
https://www.accupass.com/event/2305190535222139620296

大數據分析進階班 2023/7/27 ~ 2023/7/28
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=600

【舒虎教育】《區塊鏈初階課程》平日班 2023/7/27 ~ 2023/7/28
https://www.accupass.com/event/2305280843071623542481

緯育TibaMe「 第二屆IT人才求職趣」大型人才招募活動 2023/7/29
https://tibametibame.kktix.cc/events/goodjob729even

【舒虎教育】《區塊鏈初階課程》假日班 2023/7/29 ~ 2023/7/30
https://www.accupass.com/event/2305280843202058678448

COSCUP 2023 2023/07/29 ~ 2023/07/30
https://coscup.org/2023/zh-TW/landing

入門 AI 開源的生態系平台 Hugging Face 2023/7/31
https://www.meetup.com/rladies-taipei/events/294283382/

InfoSec Taiwan 2023 國際資安大會 2023/8/1 ~ 2023/8/3
https://csa.kktix.cc/events/infosectaiwan2023

大數據分析進階班 2023/8/10 ~ 2023/8/11
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=611

DEF CON 32 2023/8/10 ~ 2023/8/13
https://defcon.org/index.html

AIoT應用實作研習班 2023/8/16 ~ 2023/8/17
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=601

HITCON CMT 2023 2023/08/18 ~ 2023/08/19
https://hitcon.org/2023/CMT/

大數據分析進階班 (台中) 2023/8/21 ~ 2023/8/22
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=612

AIoT應用實作研習班 (台中) 2023/8/23 ~ 2023/8/24
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=604

5G+AIOT機器人智慧生活應用科學營 2023/8/23 ~ 2023/8/25
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=625

PyCon TW 2023 2023/9/2 ~ 2023/9/3
https://tw.pycon.org/2023/zh-hant/registration/tickets

Web應用滲透測試 2023/9/7 ~ 2023/9/8
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=631

Hou.Sec.Con 2023/10/12 ~ 2023/10/13
https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023