Luke Ma

This is a great summary by Prashant Singh (CISM). All relevant pieces of legislation must be joined up to ensure a consistent approach to protecting critical infrastructure and responding to a crisis. No longer should penalties be described as “the cost of doing business”. Australians deserve so much better. #cyber #cybersecurity #resilience #criticalinfrastructure

5

I am hearing on the vine that this campaign is having significant success in a number of sectors. Make sure your staff are aware. Update your response plans. Do you have a playbook for stolen session cookies? Update your systems with known IOCs. Comment below if you have additional suggestions or tips.

36

3 Comments

https://lnkd.in/gjGrEkGh The Ministry of Foreign Affairs and Trade (MFAT)in New Zealand recently commissioned an independent quality assessment by PwC to evaluate its cloud transformation programs. The assessment followed a cost escalation and rescoping of the original business case. The chief information officer has resigned and a fundamental reset of the program promised. The reset involves removing unnecessary costs, changing the delivery approach, resetting scope, and retaining only essential components. The review highlighted issues related to leadership and governance and sources within the IT industry and government allege that funds for the $33 million cloud computing project were mismanaged. The original cost of the project was estimated at c$13 - 14m. That's an eyewatering discrepancy. If you read the PwC report available from the link below lack of clear scope, deliverables and benefits were evident from the beginning. Whilst the CIO may have fallen on her sword, broader accountability must surely follow?

22

7 Comments

Governance is often seen as the least exciting task of cybersecurity, but it’s actually one of the strongest pillars of a robust plan as it's the key ingredient to align cyber strategy with business strategy. I caught up with Munashe Kandawasvika to discuss how to advance cyber governance maturity, and learned that he is a great advocate for a holistic approach to cyber governance. In the article below, Munashe emphasizes the importance of business alignment, risk-based strategies, cross-departmental collaboration, comprehensive frameworks, continuous adaptation, effective measurement, and a strong security culture that involves all employees. He also shared great examples of how to shift cyber from a cost centre function to a business enabler. Read the full article here: https://lnkd.in/g2CAKDut #Cyberscurity #GRC #CISO #CISOFSI

47

2 Comments

The Australian Critical Infrastructure Risk Management Program (CIRMP) under the SOCI Act is due on August 17. Responsible entities must have documented material risks and controls to minimise these risks to their CI asset. They must also have documented mitigations in place or being developed over time. Compliance with CIRMP requirements involves implementing these controls and mitigations. This comprehensive guide will help you understand and meet your obligations to ensure the security and resilience of your critical assets: https://lnkd.in/ggZX2-2R Learn more about SOCI and get the guidance you need here: https://lnkd.in/gJtBcBpi 👉 Reach out if you need help understanding SOCI 👈 hashtag #CriticalInfrastructure hashtag #RiskManagement hashtag #SOCI hashtag #CIRMP hashtag #CyberSecurity hashtag #Compliance hashtag #NEXTGEN

3

Active Directory security is crucial in safeguarding against cyber threats. Attackers often target Active Directory to gain domain admin-level access, posing serious risks like executing harmful code and breaching cloud environments. The Australian Signals Directorate (ASD) has provided valuable guidance on this issue. XM Cyber stands out in the industry for its expertise in addressing Active Directory abuse within the attack path. Through a combination of attack techniques, including vulnerabilities and misconfigurations, XM Cyber can pinpoint critical risks and offer detailed prioritized remediation guidance. Reach out if you want to enhance your organization's Active Directory security and protect against evolving cyber threats. #Cybersecurity #ActiveDirectory #ASD #XMcyber

21

Please join me for a keynote session on "Ransomware Resilience and Lessons Learned from Recent Attacks in Victoria." In this session, we'll delve into crucial topics that affect us all: - Why Ransomware is Still a Threat: Understanding the ongoing risks. - Lessons from Recent Attacks: What we can learn from the past. - Improving Our Response: Tips for better handling future breaches. Let's come together to discuss how we can enhance our cyber resilience and safeguard our digital assets. I look forward to your participation and insightful discussions! #Security #Ransomware #CyberResilience #Victoria #Cybersecurity #KeynoteSpeaker

170

1 Comment

So, #GCP had a little mishap – accidentally deleted the main account and with it the redundancies from another geography for UniSuper resulting in a blackout for the firm's more than half a million users and $125 billion fund. A gentle reminder of the importance of staying alert in the world of auto setups and provisioning. While going multi-cloud or even multi-account setups might seem daunting, putting all your eggs in one basket? Well, that can spell disaster. Also, major props to the brains behind UniSuper's backup and disaster recovery plan! 🏅 #ops #cloud #disasterrecovery

9

Practice makes progress, not perfection. Vitally important to test your thinking in a cyber security scenario, as you’ll never be perfect. Each time you learn something new, and no two scenario’s are exactly the same. Great to see Gateway Network Governance Body Ltd leading the charge to improve the resilience of one of the largest financial pillars of the Australian 🇦🇺 economy. #systemsthinking #cybersecurity #superannuation

10

1 Comment

🔐 Cybersecurity Simplified: The CISO Role: A LEADERS Framework [Derived from Australian Information Security Manual (ISM)] The Australian Information Security Manual sets a comprehensive standard for security leadership. Here's a structured breakdown of the modern CISO role: L - Lead & Guide • Drive security strategy • Build high-performing teams • Champion security initiatives E - Executive Duties • Navigate boardroom discussions • Manage dedicated security budgets • Bridge business & security objectives A - Awareness & Culture • Foster security-first mindset • Develop training programs • Drive organisational change D - Defence & Response • Orchestrate incident response • Mitigate enterprise risks • Ensure ISM compliance E - Emergency Planning • Strengthen business resilience • Plan recovery strategies • Handle crisis management R - Relationships • Manage cyber supply chain • Build stakeholder trust • Lead security committees S - Skills Required • Technical mastery • Business acumen • Leadership excellence • Continuous learning #Cybersecurity #ISM #AustralianCyber #Leadership #CISO #SecurityStrategy #InformationSecurity Credit: Based on the Australian Information Security Manual (ISM) -

1

4 Comments

Here are the key takeaways from the article on ASIC’s actions regarding board directors and cybersecurity breaches: 🔒 Director Accountability: ASIC is holding board directors responsible for cybersecurity breaches, stressing personal accountability for data protection. 🔍 Increased Scrutiny: Regulators are closely examining directors' roles in preventing cyber incidents, spotlighting governance responsibilities. 🚨 Proactive Security Measures: Directors must ensure robust cybersecurity frameworks to mitigate risks effectively. ⚖️ Legal Consequences: Directors could face legal action if cybersecurity measures are insufficient during breaches. 📈 Regulatory Pressure: There’s growing pressure on directors to prioritize compliance and cybersecurity risk management. For more details, check out the full article here. https://lnkd.in/gHt-uGVG #cyberriskmanagement #BoardofDirectors #CyberLiability #CyberBreach #LegalAction #DataProtection

27

1 Comment

Small and Medium Enterprises (SME) and Not-for-Profit (NFP) sectors face an impossible challenge of increasing cyber threats and reducing budgets. It’s a delicate dance to ensure cyber resilience when the resources, both human and financial, are scarce. Directors of the Boards are accountable for cyber risk and therefore need to ensure sufficient resources are allocated, instead of just assuming that CIOs will take care of it. Independent assurance of your cyber posture is essential.

3

The Australian Cyber Security Centre (ACSC) has released its Annual Cyber Threat Report for 2023–2024, highlighting a significant increase in cyber threats impacting Australian individuals and organisations. Notably, reporting of cyber security incidents affecting Australian critical infrastructure has increased by almost one-third during the 2022–2023 financial year. Key findings include: - Increase in Cybercrime Reports: Nearly 94,000 cybercrime reports were submitted to ReportCyber during the 2022–2023 financial year, marking a 23% increase compared to the previous year. This means one report received every six minutes. - Financial Impact on Businesses: The cost of cybercrime to businesses has risen by 14% compared to the previous financial year. Small businesses experienced an average financial loss of $46,000, medium businesses $97,200, and large businesses $71,600. - Critical Infrastructure Targeted: Approximately 57% of cyber incidents reported by critical infrastructure entities involved compromised accounts or credentials, compromised assets, networks, or infrastructure, and denial of service attacks. Some other stats: - ASD answered over 36,700 calls to the Australian Cyber Security Hotline, up 12%, on average, 100 calls per day, an increase from 90 calls per day - Average self-reported cost of cybercrime per report for individuals, up 17% ($30,700) - Average self-reported cost of cybercrime per report for businesses, down 8% overall -- small business: $49,600 (up 8%) -- medium business: $62,800 (down 35%) -- large business: $63,600 (down 11%) - Top 3 self-reported cybercrime types for individuals -- identity fraud (26%) -- online shopping fraud (15%) -- online banking fraud (12%) - Top 3 self-reported cybercrime types for business -- email compromise (20%) -- online banking fraud (13%) -- business email compromise fraud (13%) - Publicly reported common vulnerabilities and exposures increased 31% - 11% of all incidents responded to included ransomware, a 3% increase from last year Read the full report here:  https://lnkd.in/giXNQ4Fe

27

Australia’s new cybersecurity legislation aims to mandate businesses to report ransomware payments and address risk management deficiencies, reflecting the government’s increasing concern over cyber threats. The law introduces “limited use” obligations for information shared with the National Cyber Security Coordinator, though it doesn’t fully protect companies from future prosecution. The law also sets minimum cybersecurity standards for smart devices, aiming to secure consumer data. The establishment of the Cyber Incident Review Board and the Australian Cyber Network (ACN) highlights a holistic approach to tackling rising cyber incidents, with over 94,000 cases reported last year. While ambitious, the government’s vision to make Australia a cybersecurity leader by 2030 hinges on effective collaboration between the government, industry, and community. Australia’s new cybersecurity law aims to improve transparency and collaboration by mandating ransomware payment reporting and setting smart device standards. However, without full protections, businesses might hesitate to report incidents, fearing reputational damage. Enforcing global compliance for device standards and ensuring the Cyber Incident Review Board’s independence could also be challenging. The government’s goal of becoming a global cybersecurity leader by 2030 seems ambitious without concrete support and collaboration. Overall, while promising, the law’s effectiveness will depend on clear guidelines, cooperation, and adaptability. #CyberSecurity #Australia #Ransomware #Legislation #DataProtection #SmartDevices #CyberThreats #GovernmentPolicy #ACN #CyberLeadership https://lnkd.in/gCi8fmbR

3

The Australian Prudential Regulation Authority (APRA) has written to all regulated entities to provide further insights and guidance on common cyber control weaknesses. This letter is part of APRA's ongoing commitment to supervising cyber resilience across industry. Common issues have been observed in terms of security in configuration management, privileged access management and security testing. 💡 Key Takeaways: 🔸Weaknesses in basic cyber hygiene practices remain a major risk for businesses. 🔸Limited board-level oversight on cyber resilience can lead to gaps in security. 🔸Incident response plans are often incomplete or outdated, reducing their effectiveness. Entities across banking, superannuation and insurance must remain vigilant and proactively implement strategies to mitigate risks posed by the evolving and escalating cyber threat landscape. #CyberResilience #CyberSecurity #IncidentResponse #BoardOversight #ciso #cio https://lnkd.in/eNa_hH3C

9

The ever-evolving landscape of cyber threats presents a significant challenge for organisations across the globe, emphasising the critical role of cybersecurity as part of a comprehensive business strategy. In Australia, Chief Information Security Officers (CISOs) are at the helm of this digital battleground, ensuring their companies’ data and assets remain protected. Yet, without unwavering support from senior leadership, sustaining an effective security posture can be arduous. This guide provides actionable insights for CISOs and security professionals on garnering ongoing commitment from the top echelons of their organisations. Siege Cyber is an Australian-owned and operated cyber security company focusing on cyber security services. Our goal is to help our customers secure their organisation. www.siegecyber.com.au [email protected] #ciso #cybersecurity #security #leadership #commitment

1

The Office of the Australian Information Commissioner (OAIC) published latest notifiable data breaches report (Jan – Jun 2024). I find these reports insightful and looked at data breaches statistics and mitigating controls proposed in the report. My goal was twofold, to provide: [1] Very specific mitigating feedback based on the breakdown of breaches (mostly on the main cause of breaches), and [2] Concentrate on controls I believe will be most useful, then further rank those in terms of their effectives (High, Medium, Low). Feel free to add any other controls you feel are relevant!

16

Best Practices for Event Logging and Threat Detection: Executive Summary This publication defines a baseline for event logging best practices to mitigate cyber threats. It was developed by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) in cooperation with the following international partners:  * United States (US) Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA). * United Kingdom (UK) National Cyber Security Centre (NCSC-UK). * Canadian Centre for Cyber Security (CCCS). * New Zealand National Cyber Security Centre (NCSC-NZ) and Computer Emergency Response Team (CERT NZ). * Japan National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and Computer Emergency Response Team Coordination Center (JPCERT/CC). * The Republic of Korea National Intelligence Services (NIS) and NIS’s National Cyber Security Center (NCSC-Korea). * Singapore Cyber Security Agency (CSA). * The Netherlands General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD). Event logging supports the continued delivery of operations and improves the security and resilience of critical systems by enabling network visibility. This guidance makes recommendations that improve an organization’s resilience in the current cyber threat environment, with regard for resourcing constraints. The guidance is of moderate technical complexity and assumes a basic understanding of event logging. An effective event logging solution aims to: * Send alerts to the network defenders responsible for monitoring when cyber security events such as critical software configuration changes are made or new software solutions are deployed. * Identify cyber security events that may indicate a cyber security incident, such as malicious actors employing living off the land (LOTL) techniques or lateral movement post-compromise. * Support incident response by revealing the scope and extent of a compromise. * Monitor account compliance with organizational policies. * Reduce alert noise, saving on costs associated with storage and query time. * Enable network defenders to make agile and informed decisions based on prioritization of alerts and analytics. * Ensure logs and the logging platforms are useable and performant for analysts. There are four key factors to consider when pursuing logging best practices: * Enterprise-approved event logging policy. * Centralized event log access and correlation. * Secure storage and event log integrity. * Detection strategy for relevant threats. To access the PDF version of this report, visit here. Introduction The increased prevalence of malicious actors employing LOTL… https://lnkd.in/gBe_Bji7

1