Keli Saville GAICD

Many thanks to 6PR Perth and Jamie Burnett for the kind invitation to discuss data breaches, ways to check if data has been stolen or leaked, job scams and the importance of understanding the powerful nature of data and be very mindful of digital footprint and online presence. Managing digital footprint is an ongoing process that requires vigilance, diligence and understanding of the digital world's dynamics and intricacies. It is about making sure that personal and professional data and information remain secure and private, minimizing exposure and breaches from cyberattacks and reducing vulnerability to these attacks. Swinburne University of Technology Swinburne Australian Graduate School of Entrepreneurship #databreaches #jobscams #dataleaks #cyberattacks #digitalfootprint #stolendata #onlinepresence #scams

5

1 Comment

ACS have just released their 2024 Digital Pulse, providing insights into the trends, challenges and opportunities shaping Australia’s tech sector. There are definitely some things I hope the industry pays attention to. The report calls out engaging the next generation of tech talent and increasing diversity in the industry. In my opinion, this has always been a huge challenge and in recent years many young graduates struggle to enter the workforce where employers seeking ten years of experience at entry-level wages, combined with a lack of graduate recruitment programs particularly in regional areas, to help those same people gain that early experience. Workplace diversity also remains extremely important in breaking down biases that have developed and matured over decades in the industry. The different perspectives from people’s different life experiences are often resulting in improvements in not just methods and technology, but in morale as well as goals are achieved. What do you think of the Digital Pulse 2024 report? you can download it from here: https://lnkd.in/g4Me7eN8 ACS (Australian Computer Society) #DigitalPulse #techtrends #LeadershipInsights #DigitalLeadership #TechCommunity

3

Medibank Data Breach: A Wake-Up Call for Robust Cybersecurity Measures Medibank's recent data breach, where critical Endpoint Detection and Response (EDR) alerts were allegedly missed, underscores a crucial lesson in cybersecurity. This incident resulted in the exposure of sensitive customer information, highlighting the need for comprehensive Security Information and Event Management (SIEM), Security Operations Centre (SOC), and Security Orchestration, Automation, and Response (SOAR) capabilities. Why SIEM, SOC, and SOAR Matter? SIEM: Ensures real-time threat detection and management by aggregating and analysing log data from multiple sources. SOC: Provides continuous monitoring and quick response to security incidents, reducing the window of exposure. SOAR: Enhances response efficiency by automating routine actions and orchestrating complex workflows. Organisations must reassess their cybersecurity strategies and invest in these critical areas to prevent future breaches. Read more about the Medibank incident here: https://lnkd.in/gFt-AwxV #Cybersecurity #SIEM #SOC #SOAR #DataBreach #Medibank #ITSecurity #RiskManagement

6

2 Comments

"Bunnings' implementation of facial recognition technology as a preventive measure against crime and violent behaviour was found to have breached Australia’s privacy laws. The Office of the Australian Information Commissioner (OAIC) found the retailer had analysed the faces of “hundreds of thousands” of customers across 62 stores in NSW and Victoria between November 2018 and November 2021. Individuals’ facial images were compared against those of individuals Bunnings had enrolled in a database who had been identified as posing a risk, for example, due to past crime or violent behaviour, according to the OAIC. Facial recognition and biometric information are both classed as sensitive information under the Privacy Act." https://lnkd.in/gbiKJ4ZY

9

🗞 It seems like data breaches are in the news every day at the moment. 👀 Today's victim is Ticketmaster (although they are yet to confirm it) who have experienced a HUGE data breach affecting over 560 MILLION customers. 💻 The data is being held to ransom by the notorious hacker group ShinyHunters, who claimed the personal details it had for sale included names, addresses, emails, phone numbers, and the last four digits and expiration date of credit cards. 🔐 Incidents like these underscores the urgent need for robust cybersecurity measures to protect user data in an increasingly digital world. Read more about the attack https://lnkd.in/gABGfdYm #cybersecurity #databreach #cyberattack #datasecurity #dataprivacy #data #personaldata

4

1 Comment

The recent investigation by the Australian government into the large-scale ransomware data breach of MediSecure serves as a critical yet alarming wake-up call. This incident highlights, once again, the vulnerabilities within our healthcare sector's IT infrastructure and aged care industry with more vulnerabilities it’s evident that IT in healthcare specially aged care in woefully under-resourced. This scarcity of resources is reflective of a broader issue where aged care, in general, faces a persistent squeeze on IT budgets and personnel. This financial pressure often leads to cutting corners on best practices, especially in areas crucial to security such as architecture and data governance. There is a desperate need to uplift these practices towards more robust and comprehensive security measures not sure if the recent budget announcement of 1.2 B in ICT involved cyber security. We would need clarity on the inclusion of cyber security and data security measures within this strategic framework, and insights into how our ICT budget allocation will directly benefit aged care providers, particularly those with limited technological resources The resilience of our health IT infrastructure must be a priority. We need to advocate for adequate funding, resources, and the adoption of best practices that can safeguard against future cyber threats. This means investing in better architecture, comprehensive data governance, and ongoing training for IT and security professionals. #CyberSecurity #DataSecurity #HealthcareIT #AgedCare #Ransomware #ITInfrastructure #DataGovernance #HealthTech #CyberThreats #ITBudget #HealthcareSecurity #TechInHealthcare #CyberAwareness #ITResilience Paul Sadler Aged & Community Care Providers Association Dr Rodney Jilek MAICD https://lnkd.in/gQM5FZmK

1

ASD Essential Eight! Last week myself and some of the Proaxiom team attended the Australian Information Security Association (AISA) CyberCon conference in Melbourne. With heaps of great thought provoking sessions plus a metric ton of great networking, it was great to catch up with people plus get some industry insight! I'll summarise some of the sessions here - this one is from the session on ASD Essential Eight run by Arjen ☑ Lentz! Please note the following represents my views based on the fantastic information Arjen shared, and should not be considered a direct representation of his opinions or perspectives! The ASD (Australian Signals Directorate) Essential Eight has evolved over the past twenty years from it's origins as the ACSI 33 standard, and has gained in popularity as the propensity and rate of cyber criminal activity, and the value of proactive cybersecurity compliance frameworks, has increased. It provides all organisations - large and small - with eight essential cybersecurity risk mitigation strategies, which in turn comprise of a number of controls. The number of controls implemented in your organisation reflects your ASD E8 "maturity level" or ML - which can be ML 0, 1, 2, or 3. ML1 is a good standard for opportunistic or incidental threat behaviour, and provides the basic 46 controls under the eight strategies. ML2 is designed to defend against a targeted attack, where the TA (threat actor) is specifically targeting your company and consists of an additional 41 controls on top of ML 1 (for a total of 87). ML3 is geared up for organisations that need to defend against highly targeted and sophisticated TA's and contains a total of 123 controls. So, ML2 is ideal for most organisations, but definitely having at least ML1 is SO MUCH BETTER than being at level 0! However, I will write another post shortly where we talk about some of the gaps when ASD E8 is overlayed on the MITRE ATT&CK framework. Unlike other frameworks e.g. #ISO27001 the Essential Eight is not intended to be "scoped" - it should be applied to the entire organisation. It is also not designed as a "risk based" standard as it's not considered to be a point of negotiation on controls - you've either applied the control correctly or you haven't. So whilst a bit more rigid, it also avoids grey areas around what is in/out of scope for the #ISMS. It's not to say you should also not be running an effective risk governance process alongside your compliance framework! There are different standards of "evidence" that the controls are in place, ranging from #Excellent (the assessor tests a control to validate it's effectiveness), #Good (the configuration is viewed by the assessor directly through the system user interface), through to #Fair (the assessor views a copy of the configuration) and #Poor (the assessor receives a written or verbal statement). The highest standard of evidence should always be obtained where possible. Thanks for the great session Arjen ☑ Lentz!

21

2 Comments

Organisations are the custodians of customer data, and with that comes a profound responsibility. Ensuring data breaches are prevented is not just a technical challenge but a foundational business imperative. Adequate safeguards demand consistent investment in both implementation and maintenance. A robust data strategy is essential, beginning from the moment customer data is collected. Organisations must ask themselves critical questions: What data are we collecting and why? Who requires access to this data and for what purpose? If the data is stored in the cloud, what measures ensure that only authorised personnel have access? These considerations should be integral from the start. A comprehensive data governance process, aligned enterprise architecture strategy, and thorough understanding of data flows and potential vulnerabilities are key. Clear articulation of business priorities regarding customer engagement, loyalty, and market growth should govern data use practices. Collaboration across the C-suite is crucial to ensure that everyone understands and aligns on the handling and purpose of customer data. Building and maintaining customer trust hinges on the assurance that their data is secure. Trust is the cornerstone of customer retention and business success. #privacy #informationsecurity #cfo #ceo #csio #cdo #cio https://lnkd.in/gkP7UM8D

22

1 Comment

The recent release by the Australian, state and territory governments of the national framework for the assurance of artificial intelligence in government (AI Assurance Framework) provides much-needed guidance that paves the way for these organisations to harness AI effectively and responsibly. A statement issued within the framework acknowledges the importance of government leadership in the safe and responsible use of AI, with careful oversight of legal, privacy, security, and ethical risks such as bias and fairness. “To gain public confidence and trust, we commit to being exemplars in the safe and responsible use of AI,” the governments said. “This requires a lawful, ethical approach that places the rights, well-being and interests of people first.” The development of the framework can help overcome public scepticism and boost trust in AI, paving the way for government and public sector organisations to realise its transformative potential.

5

1 Comment

With increasing regulatory expectations around cyber, this is a good reference source, particularly for organisations looking for low-cost controls. Key messages for me are to ensure you are protecting what matters most, and be prepared (the old "it's not if, but when" adage). #cybersecurity #governance #informationsecurity

20

Small and Medium Enterprises (SME) and Not-for-Profit (NFP) sectors face an impossible challenge of increasing cyber threats and reducing budgets. It’s a delicate dance to ensure cyber resilience when the resources, both human and financial, are scarce. Directors of the Boards are accountable for cyber risk and therefore need to ensure sufficient resources are allocated, instead of just assuming that CIOs will take care of it. Independent assurance of your cyber posture is essential.

3

Cyber Governance is the glue that holds all the rest of cyber security pillars together. NIST recognises the importance of cyber governance and therefore included it as the central domain in their latest release of NIST Cyber Security Framework 2.0 in February 2024.

4

ASIC isn't playing games, and it has extreme penalties for cyber breaches that could've been avoided. With more businesses being hacked weekly, it's critical to your business, reputation, and more to ensure your cybersecurity is up to par. Book in today for a complimentary audit, and let's lock down your systems.

1

"Medibank is expecting to have completed "the vast majority" of its cyber security uplift following a 2022 data breach by mid-2025, with the total cost of the incident now expected to be $126 million-plus. The data breach has now cost the insurer $86.2 million and is likely to climb to around $126 million by the end of June next year. The health insurer said in financial statements that it incurred “non-recurring cybercrime costs” of $39.8 million in FY24, after a $46.4 million cost the prior year. While this is a 14.2 percent decrease year-on-year, the insurer is expecting costs between FY24 and FY25 to remain around the same level - and potential litigation costs extending beyond that. Medibank said [pdf] that the $39.8 million spent in FY24 covered “further IT security uplift and legal and other costs related to regulatory investigations and litigation”." https://lnkd.in/g8s9xRv2

20

6 Comments

The importance of a data governance strategy cannot be overstated - and the necessity for this to align with the cyber strategy is fundamental to ensure a solid cyber foundation is in place. If a cyber crisis hits, the need to understand what data is at risk must be addressed. #informationassets #datagovernance #cyber

4

Cyber tools can be incredibly expensive, and can take up a significant amount of budget. I am glad to see Shane has taken the initiative in order to get better returns for Victorians. "Deputy CISO Shane Moffitt unveiled the new cyber security state purchase contract in a LinkedIn post. State purchase contracts contain a list of approved technologies and suppliers, and are intended to maximise the state’s buying power and reduce risk by negotiating contract terms and conditions with the suppliers in advance. The arrangement initially covers four key security domains: endpoint protection, vulnerability management, application control and third-party risk management. For endpoint, the admitted technologies come from Fortinet, CrowdStrike and Microsoft; for vulnerability management they are Tenable and Qualys; for application control, they are Airlock Digital, Ivanti and VMware; and for third-party risk management, a single solution from CyberGRX is approved." https://lnkd.in/g6aKjFpz

4