Gökhan Muharremoglu

The UAE's Information Security Regulation (ISR) enhances cybersecurity by establishing strict roles, robust data controls, and comprehensive incident management processes. Compliance with ISR is essential for safeguarding information and maintaining business continuity. It's a critical framework for any organization operating in the UAE. Learn more about ISR here. https://lnkd.in/dPKq2kyJ #CyberSecurity #ISR #UAECompliance

٤٢

٣ تعليق

Earth Simnavaz, also known as APT34 and OilRig, has been actively targeting governmental entities in the UAE and Gulf region. The group employs sophisticated tactics, including a backdoor that exploits Microsoft Exchange servers for credential theft and the use of CVE-2024-30088 for privilege escalation. Their arsenal includes customized .NET tools, PowerShell scripts, and IIS-based malware designed to blend with normal network traffic. The attackers focus on exploiting vulnerabilities in key infrastructure of geopolitically sensitive areas, aiming to establish persistent footholds in compromised entities for potential future attacks. Recent activities show an escalation in cyber espionage efforts, particularly against critical sectors in the UAE, highlighting the ongoing threat posed by state-sponsored actors to national security and economic stability. Adversary: Earth Simnavaz Industries: Government, Energy Targeted Country: United Arab Emirates Malware Family: STEALHOOK MITRE Attack (ATT&CK) TTP: T1003 - OS Credential Dumping, T1133 - External Remote Services, T1114 - Email Collection, T1204.002 - Malicious File, T1140 - Deobfuscate/Decode Files or Information, T1190 - Exploit Public-Facing Application, T1567 - Exfiltration Over Web Service, T1219 - Remote Access Software, T1505.003 - Web Shell, T1021.006 - Windows Remote Management, T1059.001 - PowerShell, T1078 - Valid Accounts, T1095 - Non-Application Layer Protocol, T1547.008 - LSASS Driver

١

In this case, I would suggest the two (2) skills are prioritized accordingly by placing a much higher priority on the business skills. This is something crucial that we always need to remember as security professionals is that our job is to help the business achieve its goals and objectives and to be an enabler for the business and having someone in that role with strong business acumen is highly critical, to say the least.

١

While benefiting from digital transformation of our business, increased digital vulnurability should not be the price to pay.

٢٣

I will give a talk at Third Party & Supply Chain Cyber Security Summit: Middle East Edition 2024 on Communicating Cyber Risk To The Board. Hoping for a great turnout! #sccybersecurity #sccssummit #supplychaincybersecuritysummit - via #Whova event app

٣٢

I will give a talk at Third Party & Supply Chain Cyber Security Summit: Middle East Edition 2024 on Communicating Cyber Risk To The Board. Hoping for a great turnout! #sccybersecurity #sccssummit #supplychaincybersecuritysummit - via #Whova event app

٨٤

١ تعليق واحد

When approaching cyber security in an #Operational #Technology (OT) or ICS environment these factors must be taken into account: - Understanding the applicable IEC 62443 standards - Identifying Target security level (SL-T), Capability security level (SL-C) and the Achieved security level (SL-A) - Aligning the strength of security measures with the risk exposure An IEC 62443-based approach to cyber security in an OT environment requires the integration of robust security measures at various Purdue levels. This ranges from improving the security of the hardware to ensuring secure configuration of software and networks. Several simple measures can be adopted to secure ICS systems and to harden them against potential exploitation by bad actors these include: - Periodic risk assessments based on IEC 62443 to identify and address gaps - Keeping systems patched/updated - Clearly assigning security-related responsibilities at all levels - Test and deploy an incident response strategy and tactics - Conduct Security Acceptance Testing for new devices - Request OEMs to share information on their security practices With a proven portfolio of solutions, threat intelligence, and managed services, Alliance Pro can help you elevate your IEC 62443 Achieved security level (SL-A) in a few easy steps.   #ICS #otsecurity #CYBERSECURITY #threatmanagement #risk #riskmanagement

١٩

I am humbled to announce that EFG Holding #InformationSecurity Group has been listed by OnConferences in the Top 50 Information Security Teams Award. #Information #Security is a continuous and collective "Team" effort; the #CISO is no more important a GRC specialist writing a policy or assessing a risk, an Offensive Security professional hunting for a bug, or an on-duty #SOC analyst whom vigilance ensures no #InfoSec offense went un-noticed and without a response: We are among the world top 50 #InfoSec teams because in #DefensiveSecurity, #OffensiveSecurity, #IdentitySecurity #ITSecurity, & #GRC everyone is important, everyone goes the extra mile, everyone is vigilant and ready ... You all out there know yourselves! You made everyone from my level to the Group CEO very proud ... We ... Salute you! Link to the winning teams: https://lnkd.in/dQ95zegp #OnConIconAwards #OnConferences #CyberSecurity #OnCon2024

١١٦

٢٢ تعليق

In today’s interconnected world, data privacy isn’t just a box to tick – it’s a responsibility that touches every part of a business. With regulations constantly changing across the GCC (like DIFC, ADGM, and KSA’s PDPL) and globally with GDPR, navigating compliance can feel overwhelming. That’s where my team at Infinitrs comes in. We help organizations like yours make sense of these complex regulations, ensuring your business stays compliant and protected, both locally and globally. It’s not just about following the rules – it’s about building trust and safeguarding your future. Let’s connect and have a conversation about how we can support your data privacy journey! 📧 Feel free to reach out to me directly at: [email protected] 🌐 Check out our website for more info: www.infinitrs.com 🔗 Follow us on LinkedIn: Infinitrs on LinkedIn #DataPrivacy #GCCCompliance #GDPR #PDPL #CyberSecurity #Infinitrs #DataProtection #Compliance

٣

Are we doing enough to manage #cyberrisks and elevate #cyberresilience? The glut of cybersecurity point solutions may not be adequate. Is it crucial for executive management to be aware and lead cyberrisk management? CyberEdBoard Community EliteCISOs Global CISOS.CLUB ClubCISO #cnii #nationstate #cyberresponse

١٠

Balancing Power and Protection: AI in Cybersecurity and Cybersecurity in AI - AI’s extraordinary capabilities have the potential to transform cybersecurity, but AI systems themselves must be protected from attacks to prevent harm to people, process and technology. #pwc #cybersecurity #artificialintelligence

٢٠

#amifiu #cybersecurity briefing #ishield360 The hackers are continuously stress-testing your systems and attempting to exploit them daily. You cannot say you have the upper hand when you do pen tests once or twice a year. Now is the time for continuous threat intelligence. Real-time assessment and response.

١

In my latest blog, I discuss Cyber security Compliance in the Middle East! As digital transformation accelerates, governments across the Middle East are ramping up regulations to secure digital assets. Frameworks like SAMA CSF, NESA, and NIAP are just a few examples of how cybersecurity compliance is becoming a non-negotiable priority for businesses operating in the region. In the blog, I delve into: ✅ The growing number of vulnerabilities—over 28,900 reported in 2023. ✅ The importance of tools like Microsoft Purview, Sentinel, and Defender for security and compliance. ✅ Practical strategies for navigating the region’s evolving regulatory landscape. Cybersecurity compliance isn’t just about following the rules—it’s about ensuring resilience, trust, and operational continuity. 📖 Check it out here: https://lnkd.in/guchZhsg Let me know what you think, and feel free to share your insights! Microsoft Veraqor Microsoft Cloud Saudi Central Bank – SAMA National Institute of Standards and Technology (NIST) Life@Veraqor Muhammad Farrukh Arif Lala Ramez Mounir

١٨

3 take aways from the ecrime and cybersecurity congress at Abu Dhabi. 1. CISO-board communication is getting increasingly critical: The CISO panel discussion focused on CISO-board communication more than any other topic! 2. Patch management and vulnerability mitigation are still the pain points: The breakout sessions focusing on this topics were a full house! 3. The debate on AI within cybersecurity rages on! Is it a blessing or a curse? Is it an attackers dream or a defenders best friend?You are likely to get conflicting opinions based on whom you ask. The discussions on this topic were hot and intense.

١٩

Speaking at the Black Hat MEA #BHMEA Executive Panel, OffSec CEO ning wang emphasized the human element in cybersecurity. From AI’s dual role in opportunities and risks to teaching the why behind security, she highlighted cyber literacy as critical to resilience and culture. 

١٧٥

٢ تعليق

⏳ Just 2 days left until the CIS Critical Infrastructure Cyberforge Summit in Abu Dhabi! ⏳ 🌟 Honored to join the Leadership Panel to discuss current challenges in protecting critical infrastructure. Looking forward to insightful discussions with industry leaders on safeguarding our most vital assets. Stay tuned for impactful conversations! 🌍🔐 #CISCyberforgeSummit #CyberSecurity #Leadership #Oman #CriticalInfrastructure #OmanAirports

٥٠

٣ تعليق

If you are at CDIS today, make sure you drop by the main hall at the below time slots. 10:00 - 10:45 Securing National Critical Infrastructures Against Cyber Threats Amidst a Global Rise In Cyber Attacks Menna Gamal, our practice lead for cyber risk will share some insights on this critical topic. 12:00 - 12:45 Unlocking Post-Quantum Secrets: The Next Generation of Secure Communication, I will be moderating the session, demystifying this topic with my fellow pannelists See you there #PwC #PwCETIC #NCI #PostQuantum

٧٤

٣ تعليق

🌐 Thrilled to announce the completion of the DIFC Cyber Essentials: Navigating Compliance with NIST and ISR certification! Over six weeks, I immersed myself in cyber compliance essentials, focusing on the frameworks and best practices needed to align with NIST and ISR standards. Thank you to DIFC Academy for this opportunity. Gaining these insights is invaluable as I continue my journey in cybersecurity and aim to ensure robust, compliant digital environments. #Cybersecurity #Compliance #NIST #DIFCAcademy #CyberEssentials

٢٣

١ تعليق واحد