Skip to content

Weekly ISMS sync — 2026-07-02

Attendees: Olaf Jacobson, Andrea Cardinali (CyberSquad) Format: Live screen-share walkthrough of the ISMS repo and Claude Code workflow. Source: Zoom transcript (ISO Talk - July 2, 2026.srt, not stored in this repo).

1. Incident reported: phishing via new product feature 🔴

Olaf reported that the previous night, a scammer signed up for a Soon account and abused a feature launched days earlier — a personal-message field on invitations plus team-logo upload — to send convincing phishing invitations impersonating Microsoft and PayPal (fake "your purchase was denied" style messages, with the attacker's uploaded logo rendered in the email).

  • The feature had barely been used by real customers yet; an attacker found and abused it within days of launch.
  • This is a live example of risk R-06-class social-engineering abuse via a Soon product surface, distinct from the phishing-of-Soon-staff risk already in the register (R-19). It has been added to the risk register as R-21 (see Risk Assessment Report), since it is a concrete, dated event with a real control gap (unvalidated user-supplied content — message text and uploaded logo — rendered in outbound transactional email, enabling brand impersonation).
  • TODO(owner): once the Incident Response Procedure (PR #5) merges, formally log this as Soon's first recorded incident (severity, timeline, accounts involved, remediation) per that procedure, and add a Lessons Learned entry.
  • Suggested immediate product fix (Olaf/eng, outside this repo): rate-limit or moderate free-text invitation messages and logo uploads for new/unverified accounts; consider disabling third-party brand-name/logo patterns or adding a "sent via Soon" banner that can't be removed.

2. Live workflow demo (repo, Claude Code, publishing)

Walked through, end to end, with Andrea driving:

  • Cloning the repo, opening it in Claude Code, and using the /isms:* command set.
  • Using Claude to find whether a document already exists before creating a new one.
  • Reviewed and corrected the Access Control Policy (ISMS-DOC-A05-15-1) against actual practice:
  • Minimum password length: 8 → 12.
  • SSO section: removed "used within the internal network" language (didn't fit a fully-remote company with no internal network) → now "used wherever the system supports it," with a documented exception for accounts that only access non-sensitive information.
  • MFA text simplified: MFA is enforced for production access; must be enabled everywhere supported.
  • Confirmed: SSO is used, and MFA is required for high-risk/production systems; an exception is permitted for accounts with no access to sensitive data.
  • This was committed, pushed, opened as a PR, reviewed by Olaf and merged — PR #10 — the first document authored end-to-end by Andrea through the intended branch → PR → merge workflow.
  • Confirmed the published documentation site auto-redeploys after a merge (Cloudflare Access-gated; only @soon... addresses + Andrea's email can log in).
  • Troubleshooting note: Andrea's machine didn't have gh installed, so Claude Code correctly reported "branch pushed, ready for a PR" and asked Olaf to open/merge it instead of failing silently — the intended fallback per AGENTS.md.
  • Agreed: documents can be worked in Dutch or English via Claude Code, but the documents themselves stay in English (per CONTRIBUTING.md).
  • Andrea's take on the doc set: useful content overall, but several documents should be shortened — supports the earlier decision to move to the checklist-policy format.

3. Pentest / SOC 2 / ISO vendor discussion

  • Candidate pentest/security vendors discussed: Pinewood (established, ISO certified), Hornet, G-Unit.
  • Rough pricing mentioned: ~€3–4k for a scoped pentest, ~€4k/year for ongoing work.
  • Agreed: before requesting quotes, define the pentest scope precisely (e.g. external unauthenticated testing, testing via a created user account to assess data leakage/access-control bypass) so vendors can quote accurately.
  • Olaf to call the agency to confirm SOC 2 is actually offered at the price previously quoted, and what exactly is included.

4. Ideas raised (not yet actioned)

  • Dedicated security/privacy agents (Andrea) — purpose-built AI agents (e.g. Fable 5-based) to help automate control checks. Olaf to prototype agent-prompt ideas.
  • Custom SIEM-like monitoring (Andrea) — infrastructure monitoring with alerting and failover handling, potentially combined with external SOC support. Discussion only; no action yet.

5. Scheduling

Next Thursday's session is skipped due to a conflict; recurring series adjusted (all future weekly Thursday 13:00 CEST sessions unaffected).

Action items

# Action Owner Status
1 Formally log the phishing/logo-abuse incident once Incident Response Procedure (PR #5) merges; add Lessons Learned entry Olaf Open
2 Product fix for unvalidated invitation-message/logo content (rate-limit / moderate for new accounts) Olaf / eng Open
3 Define precise pentest scope (external unauth. + authenticated-user data-leakage testing) before requesting quotes Andrea Open
4 Call the security agency to confirm SOC 2 is available at the quoted price and what's included Olaf Open
5 Follow up with pentest vendor candidates (Pinewood, Hornet, G-Unit) Olaf Open
6 Create a local "Zoom" project folder for Zoom-related files before future repo work Andrea Open (housekeeping)
7 Continue tailoring/shortening the remaining template policies into the checklist format Andrea Ongoing
8 Prototype dedicated security/privacy agent prompts Olaf Idea — not started