Joanna Dalton

Is Your Organisation Aligned With The Latest Cyber Security Governance Principles? With the release of the updated Cyber Security Governance Principles by the Australian Institute of Company Directors (AICD) and the Cyber Security Cooperative Research Centre (CSCRC), directors are called to take an active role in safeguarding their organisations against the ever-evolving cyber threat landscape. These principles support actionable insights into: 🔹 Defining clear roles and responsibilities. 🔹 Developing and evolving comprehensive cyber strategies. 🔹 Embedding cyber security into risk management practices. 🔹 Fostering a culture of cyber resilience. 🔹 Planning for significant cyber incidents. https://lnkd.in/g8SQeDpG   At CyberOps, we are proud to offer tailored solutions to empower boards and organisations to excel in these areas. Our services, such as Chief Information Security Officer as a Service (CISOaaS), IT Maturity & System Resilience Assessments, Ongoing Vulnerability Management Services and Customised Board Training Workshops, align closely with these principles. Whether it's conducting vulnerability assessments, designing security roadmaps, or facilitating incident simulation exercises, CyberOps is committed to helping Australian directors not just meet but exceed their cyber security governance obligations. The threat landscape is dynamic, but your response doesn't have to be reactive. Proactive alignment with governance principles can enhance resilience and trust while securing your organisation's future. Learn more about how we can support your journey toward cyber security excellence: https://cyberops.com.au [email protected] Derek Grocke. #CyberSecurity #Governance #Directors #RiskManagement #AICD #CyberOps

4

The State of Cloud Security Platforms and DevSecOps: A new survey by Cisco and Enterprise Strategy Group reveals the true contours of cloud native application development and security

1

Trying to navigate the aftermath of a cyber incident? Look no further than the Single Reporting Portal on cyber.gov.au! This helpful resource allows you to enter your sector and will display a list of potential reporting obligations. It's a great tool for building out your Incident Response plans and ensuring that you're meeting all necessary requirements. Check it out today! #cybersecurity #incidentresponse #reportingobligations

13

As the digital landscape evolves, so does cybersecurity, with fifth-generation SIEM solutions using AI to transform SOCs with predictive insights and automated responses. Learn how these advanced systems integrate seamlessly with DevSecOps, heralding new capabilities. https://lnkd.in/g3c_8cvS

1

A very interesting read with well-known scam fighter Jim Browning. Targeting retirees with large savings makes sense from a business point of view. They're often less tech-literate and also, as the article shows, unwilling to admit they might be getting scammed. It's important to remember that these scammers are operating a business, with KPIs and targets to meet. That means they're going to go with whatever works, no matter the moral or ethical implications. If they target children and the elderly, what makes you think they wouldn't target you? https://lnkd.in/ez6du6hR

13

5 Comments

This is an important moment in privacy for all Australians. Board Directors please take note of the reason for the action “failing to take reasonable steps to protect their personal information from misuse and unauthorised access or disclosure in breach of the Privacy Act 1988” This is a great time to have a board room conversation with your CISO, CIO and CRO. Some questions to ask: - Who is responsible for Cyber Security controls in our organisation? - Is our patching up to date? - What are our Crown Jewels and which systems process them? - Are our staff, supplier and customer accounts and identies manged across their lifecycle? - Is our data protected (access) and encrypted at rest and in transit? - When did we last test our cyber major incident response plan? I’m always open to a conversation with executives and directors who want to turn technospeak into business impact. #cyber #board #professinaldevelopment

56

6 Comments

Cybersecurity is critical in today's digital landscape, as highlighted by a recent incident involving Google Cloud. The tech giant accidentally deleted UniSuper’s $125 billion pension account, underscoring the significant risks associated with data management and storage in the cloud. Organizations must continuously evaluate and strengthen their security measures to protect against evolving threats. NetNeura’s commitment to security is a step in the right direction, demonstrating the proactive measures necessary to safeguard data and maintain trust in the digital ecosystem. https://lnkd.in/d2hTrU9z

1

On 21 August 2024, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), CISA, FBI, NSA, and international partners are releasing Best Practices for Event Logging and Threat Detection. This guide will assist organizations in defining a baseline for event logging to mitigate malicious cyber threats. Here some key points include: - Importance: Event logging and threat detection are crucial for maintaining a robust security posture, facilitating swift incident response, and ensuring compliance with regulatory requirements. - Challenges: Common challenges include managing large volumes of log data, reducing false positives, and dealing with resource constraints. - Best Practices: The document recommends standardizing log formats, centralizing log collection, implementing a log retention policy, encrypting logs, using anomaly detection systems, integrating machine learning algorithms, and combining human analysis with machine learning to validate detection results. To implement these best practices effectively, organizations should integrate event logging and threat detection systems with existing infrastructure, provide training to personnel, and regularly test these systems to ensure they are functioning correctly. Continuous improvement and staying updated with the latest technologies and best practices are also emphasized. By following these guidelines, organizations can significantly improve their ability to detect and respond to cyber threats.

1

✨ We are delighted to pass the high standards of the Joint Accreditation System of Australia and New Zealand (JASANZ) to audit organisations against ISO 27001 standards - the world's best-known standard for information security management systems (ISMS)!🔒 In a world of rapid technological advancements and constantly emerging cyber attacks, there is an urgent and growing need for businesses to implement robust information security systems. Our JASANZ ISO 27001 accreditation demonstrates our cyber expertise and auditor capabilities to assess information security standards, and further strengthens our position as a trusted, internationally recognised provider of digital trust services. Read more and safeguard your organisation 👉 https://bit.ly/4igTOA2 #SGSAustralia #CyberSecurity #ISO27001 #InformationSecurity

72

6 Comments

Did you know that 60% of targeted cyber-attacks in Australia hit SMBs but only 14% are prepared to defend themselves? Don’t assume your business is too small to be targeted. Implementing strong cyber security measures following the Australian recommended framework, the Essential 8, is important to protect what matters most. Our guide covers everything you need to know about the Essential 8. Check it out now and ensure your business has the right level of security 🔐 #FutureITServices #Essential8 #ASD #Cybersecurity #ITservices

2

Great to see @AusGov taking the lead on proactive cybersecurity. Businesses, take note - protecting customer data is more crucial than ever. This initiative paired with an overhaul of our ancient Privacy Act where we hopefully end up with a GPDR equivalent like our friends in the EU, will ensure companies are taking our data privacy seriously. https://lnkd.in/eP7s9Qtt #IdentityTheft #Cybersecurity #Australia #Privacy #DataProtection

3

There are now some more details out about the Medibank breach of 2022, which lead to 9 million Australian's having their data put up for sale on the dark web. Please keep in mind while reading that Medibanks cybersecurity team has 13 full-time staff and $1million per year budget. Some key takeaways are: - An employee of a Medibank contractor saved his Medibank username and password to his personal internet browser profile on a work computer. When this worker then signed into his internet browser profile on his personal computer, these credentials were synced across. Do NOT save credentials in your browser, not only is it trivial for hackers to pull the usernames/passwords out of the browser, it's just bad practice all around. Look into something like Keeper, 1pass, Lastpass, etc to manage your passwords. - The hacker then comprimised that employees personal computer and stole the credentials from the browser. This is also very common. If you're a hacker looking to steal credentials, do you a) go after the highly-secure organisation or b) old mates laptop with Norton free antivirus that hasn't been updated in 4 years. - Those credentials were then used to log on to Medibanks corporate network. No MFA, nothing to stop anyone from using those credentials to get the full keys to Medibank's kingdom. It's a miracle the breach didn't happen earlier. - The malicious activity was flagged by Medibanks security software, but the alerts generated were never investigated. Whoopsies.

10

As we delve further into the digital age, the importance of cyber information governance cannot be overstated. With cyber threats evolving daily, establishing a robust governance framework is not only about protecting assets but also about building a resilient foundation for business continuity and trust. For cybersecurity professionals, IT governance enthusiasts, compliance auditors, and business owners in Australia, staying abreast of the national frameworks and standards is imperative. Siege Cyber is an Australian-owned and operated cyber security company focusing on cyber security services. Our goal is to help our customers secure their organisation. www.siegecyber.com.au [email protected] #cybersecurity #informationsecurity #governance #standards #australia

2

1 Comment

One notable data breach in early 2024 impacted over 10 million Australians, the highest number recorded since the Notifiable Data Breaches (NDB) scheme began. Even though 63% of breaches only affected 100 or fewer people, large-scale incidents are a stark reminder that a single breach can cause massive reputational and financial damage. We're continuing our focus on Cyber Security Awareness Month! Here are 5 steps to prevent large-scale breaches: 1. Security audits: Conduct regular reviews of your IT infrastructure to identify potential weaknesses as they emerge. 2. Data encryption: Always encrypt sensitive data at rest (when stored) and in transit (when transferred across networks). Encryption makes stolen data unreadable to attackers. 3. Automation tools: Use automation to continuously monitor for suspicious activity, ensuring any unusual patterns are quickly flagged for investigation. 4. Role-based access control (RBAC): Limit access to sensitive data based on roles, ensuring only authorised personnel can view or alter critical information. 5. Take Action: If you need additional external support. Book a free 30-minute consultation with Meridian IT, to gain insights from industry experts on strategies to strengthen your cyber-security posture. • Email: [email protected] • Website: www.meridianit.com.au • Phone: (02) 8870 9000

9

1 Comment

Gain professional development in cyber security with Essential Eight Training! 💻 In today’s digital landscape, strong cyber security skills are essential. This course, designed by the Australian Signals Directorate, Australian Cyber Security Centre and delivered by TAFEcyber, equips cyber security and IT professionals with the knowledge and hands-on training needed to thrive. Throughout the course, you’ll delve into the Essential Eight strategies, gaining insights to assess and enhance your organisation’s cyber security posture effectively. With a mix of expert-led sessions and practical exercises, you'll develop the skills to identify vulnerabilities, implement robust security measures, and stay ahead of potential threats. Whether you’re looking to upskill, advance your career or ensure your organisation’s safety, this course is your pathway to success! Ready to take the next step? Discover more and enrol for Term 4 👉 https://lnkd.in/dDxnj9M4 #TAFEcyber #EssentialEight #CyberSecurity #ProfessionalDevelopment

31

2 Comments

PUBLIC SERVICE ANNOUNCEMENT: The Australian Privacy landscape is changing and organisations operating in this market need to understand how these changes will impact the way they access, store and consume customer data. Jamie Rubbi-Clarke from Amazon Web Services (AWS) and I will delve into some of the changes and discuss the challenges of balancing data security with data usability and accessibility. CTA: If you are responsible for data privacy or data protection.... go on, register now 😀 If you know the person responsible in your organisation, send them the post. 📬

31

Small Business Cyber Security: How to secure your small business from common cyber security threats. Credit: The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) #cybersecurity #Smallbusiness

5

Did you know that SMS alerts from the ATO no longer contain hyperlinks? This will help protect you by making it easier to distinguish between a legitimate ATO SMS and a fake SMS, and is only for SMS alerts: email alerts still contain hyperlinks. Read the full update at: https://lnkd.in/gbDqxNkS #ATO #SMSFAuditors #SMSF #Compliance

2