Hispasec Sistemas

Hispasec Sistemas
Name	Hispasec Sistemas
Type	Private
Industry	Computer security
Founded	1990s
Headquarters	Madrid, Spain
Products	Security software, malware analysis, consultancy

Hispasec Sistemas is a Spanish computer security firm known for vulnerability research, malware analysis, and security tools. The company gained public attention through disclosures affecting major technology vendors and collaborations with academic and industry institutions. Hispasec has influenced cybersecurity practices across Spain and internationally through advisories, publications, and incident response.

History

Hispasec Sistemas traces roots to the rise of antivirus and information assurance efforts in the 1990s alongside entities such as McAfee, Symantec, Kaspersky Lab, ESET, and Trend Micro. The company emerged during the same era as initiatives like CERT Coordination Center, FIRST, ENISA, US-CERT, and CIAC. Hispasec’s evolution paralleled developments at Microsoft, Apple, Google, Oracle Corporation, Adobe Systems, and Cisco Systems as exploits targeting Windows NT, Linux, macOS, Android (operating system), and iOS proliferated. Over time Hispasec interacted with institutions including Universidad Politécnica de Madrid, Complutense University of Madrid, Universidad Carlos III de Madrid, Instituto Nacional de Ciberseguridad (INCIBE), and Centro Criptológico Nacional during collaborative research and training. The firm’s timeline reflects trends evident in events like the IETF, Black Hat (conference), DEF CON, Virus Bulletin Conference, FIRST Conference, and RSA Conference.

Products and Services

Hispasec offers malware analysis tools, vulnerability assessment, penetration testing, and security audits for clients including banks and telcos such as Banco Santander, BBVA, CaixaBank, Telefónica, Vodafone Group, and Orange S.A.. Service offerings align with standards from ISO/IEC 27001, PCI DSS, NIST Cybersecurity Framework, CIS Controls, and OWASP. Products and advisories complement platforms from vendors like Microsoft Windows, Red Hat, Debian, Ubuntu, SUSE, VMware, Citrix Systems, and Fortinet. Hispasec’s toolset has been used alongside frameworks and projects including Metasploit Framework, Wireshark, Snort, Suricata, OpenVAS, Nmap, Kali Linux, and Burp Suite.

Research and Publications

Hispasec publishes technical analyses, white papers, and advisories that appear in forums and journals frequented by researchers from IEEE Computer Society, ACM, Springer, Elsevier, and Wiley. Its work references malware families and incidents tied to actors and events such as Stuxnet, WannaCry ransomware attack, NotPetya, Equation Group, Lazarus Group, APT28, APT29, Cozy Bear, Fancy Bear, Shadow Brokers, and Operation Aurora. Hispasec contributions intersect with academic research from MIT, Stanford University, University of Cambridge, University of Oxford, Carnegie Mellon University, ETH Zurich, TU Delft, École Polytechnique Fédérale de Lausanne, and National University of Singapore. The company’s publications cite standards and protocols such as TCP/IP, HTTP, SSL/TLS, DNS, SMTP, and SSH when explaining vulnerabilities.

Vulnerability Disclosures and Impact

Hispasec has disclosed vulnerabilities affecting widely used products from Microsoft Exchange Server, Microsoft Office, Adobe Flash Player, Adobe Reader, Oracle Java, Apple Safari, Google Chrome, Mozilla Firefox, WordPress, and Drupal (software). Disclosures have had implications for infrastructure providers and services including Amazon Web Services, Microsoft Azure, Google Cloud Platform, Cloudflare, Akamai Technologies, S3 (Simple Storage Service), Elastic Load Balancing, and Kubernetes. Security bulletins influenced patch cycles at vendors such as Cisco Systems, Juniper Networks, Palo Alto Networks, Check Point Software Technologies, and Fortinet. Impact assessments referenced incident response playbooks used by teams at CERT-EU, NCC Group, SANS Institute, Mandiant (now Google Cloud Mandiant), and CrowdStrike.

Corporate Structure and Leadership

Hispasec operates as a private company structured to provide consultancy, research, and product development. Leadership and technical teams have professional intersections with figures and organizations from SANS Institute, GIAC, ISC2, CompTIA, ISACA, CEH (Certified Ethical Hacker), CISSP, and CISM. Executives and researchers often participate in events and panels alongside representatives from European Commission, Spanish Ministry of Defence, Spanish National Police Corps, Guardia Civil, Interpol, and Europol.

Partnerships and Certifications

Hispasec maintains partnerships and certification alignments with accreditation bodies and industry groups such as ISO, ANSSI (Agence nationale de la sécurité des systèmes d'information), ENISA, INCIBE, CCN-CERT, FIRST, OWASP Foundation, Linux Foundation, Red Hat Certified Engineer, Cisco Certified Network Professional, and Microsoft Certified: Azure Security Engineer Associate. Collaborative projects have involved companies and institutions like Telefonica Tech, Indra Sistemas, S21sec, BBVA Next Technologies, Atos, Capgemini, Accenture, Deloitte, KPMG, and PwC.

Controversies and Legal Issues

Hispasec’s disclosures and analyses have occasionally provoked debate involving vendors, researchers, and regulators, echoing high-profile disputes seen in cases involving Microsoft and Google over disclosure timelines, or controversies similar to those surrounding Hacking Team, NSO Group, and Cambridge Analytica. Legal and policy discussions have referenced frameworks and statutes such as the European Union Agency for Cybersecurity guidance, General Data Protection Regulation, Ley Orgánica de Protección de Datos, Digital Millennium Copyright Act, and national cybersecurity laws. Incidents have engaged stakeholders including Spanish Data Protection Agency, European Data Protection Board, Audiencia Nacional (Spain), Tribunal Supremo (Spain), and other judicial bodies.

Category:Computer security companies