Vaughan Shanks

Everyone, AI security might just be another software issue to tackle! 📢 if you are Building an AI system? It's crucial to consider responsible AI practices from the start. Check out the Responsible AI Pattern Catalogue from CSIRO (I like how they illustrated it as a pattern) : Why it's a game-changer: • Guides you through critical questions at every development stage • Supports creation of RESPONSIBLE system architecture, sequence diagrams, and user stories • Helps integrate responsible AI principles into your UML and overall design • Promotes a "secure by design" approach • Minimizes technical debt related to AI compliance • Ensures your AI system is responsible and adaptable This catalog is like having an AI ethics expert on your team, prompting important considerations as you build! ❗ Remember: Addressing AI responsibility after development can be incredibly challenging or even impossible. The technical debt is immense. Start right, start responsibly! #responsibleAI #aiethis #softwareengineer #aicompliance #UML https://lnkd.in/gqchazFk

19

PROBLEM: crooks 🦹‍♂️ use hooks 🪝to get your passwords 🤦🏻 SOLUTION: use passkeys 🔑not passwords BACKGROUND myGov is one of the most impersonated 😡Australian Govt websites 🔹 Phishing-fake websites typically steal 🦹‍♂️ your password and username by mimicking the login page of a legitimate website. 🔹When you enter your email and password on the fake website, they are captured by the attacker 🪝 🟣 Good news / news flash 📣 1️⃣ myGov is NOW among the first govt digital services in the world 🌎 to start using passkeys - which are resistant to phishing ✅ 2️⃣ turning off - your myGov password as a sign-in option - and using your passkey 🔑 instead - makes it harder for scammers to access your accounts using stolen usernames and passwords ✅ 3️⃣ On average, more than 860,000 people sign in to myGov each day 🤯 4️⃣ In Australia ♥️ last year scams cost $2.74 billion, with $250 million coming from someone stealing/phishing 🪝 your log in details. For more information on how to set up your myGov passkey ➡️ https://lnkd.in/ggWP5XaH See comments for set up instructions … Bravi to Minister Bill Shorten and Services Australia for being an early govt adopter of passkeys 🏆 📸 Serena Hardwick 📍Wagga Wagga TackleWorld

540

43 Comments

🚀 Key takeaways from the Institute of Directors in New Zealand conference panel on #AI and #privacy, sponsored by Kordia. The panel was stacked! We heard from: Liz MacPherson, Deputy Privacy Commissioner, Office of the Privacy Commissioner, New Zealand Matt Ensor, Chair AI Forum NZ working group for LLMs, and Founder of FranklyAI Alastair Miller, Principal Consultant at Aura Information Security And a little bit from me also 😊 Key takeaways: Understand AI's potential, tie it into strategy, prioritize privacy safeguards, and invest in responsible AI training for your organization. #AI #Privacy #Innovation #IoDNZConf #Governance #Boards #responsibleAI

29

Couldn’t agree more. Security in depth is super important as well as where your data is stored.

3

It might be time the Privacy Act needs an update. Everyday thousands of companies received data on every available ad slot on Australians’ devices, which they could copy to build their own databases about Australians and resell the information over and over again. Data included information about people’s movements, sexual interests, financial concerns, service providers, personal problems, gambling, drinking habits and online purchases. Currently, Australia has no limits on how this sensitive information is used which means residents’ private information can be sold to scammers and foreign-state actors. #cybersecurity #privacy #australia #advertising https://lnkd.in/gv9cJSTP

4

More Projects On The Way Thanks for Sharing James Patto. No doubt there will be projects initiated to harden the organization's cybersecurity. It is not whether the threat actors will be successful; rather how long can we avoid a successful breach or disruption? It's a great time to be in project management. Project Management Institute Bond University #projectmanagement #cybersecurity #cybersecurityawareness #pmo #resilience

5

In my latest article in The Conversation Australia + NZ, I explain the impact #errors have on #cybersecurity in tune with Cyber Awareness Month. I explain why despite increased investment in Cyber Education, Training & Awareness Programs, our current approach is showing limited results when it comes to reducing human error. At the core is acknowledging that changing #behaviours and attitudes towards cybersecurity is tough, and requires more than just phishing simulations or telling people to change their passwords. It is doable with the right strategy however. Read more here: https://lnkd.in/gggpfUu6 #Cybersecurity #HumanFactor #CyberAwarenessMonth #CyberStrategy

36

1 Comment

NEWS UPDATE 📣 The Digital ID Bill passed through the Australian parliament yesterday afternoon. BACKGROUND 1️⃣ Digital ID already exists - with over 10m Australians having a myGovID. 2️⃣ myGovID can only be used for certain Govt transactions. 3️⃣ Eg using myGovID reduces the time to obtain a Tax File Number from 28 days to just 10 minutes 🤯🤯🤯 4️⃣ However - when we open up a - bank account - telco account - hire a car - rent a house - enter a club etc we have to hand over copies of our passport, driver’s licence etc - ie - we OVERSHARE - so much of our personal information - which creates a honeypot of credentials and therefore poses a cyber risk for individuals and businesses alike🤦🏻 5️⃣ This bill creates a roadmap for a voluntary Digital ID for use throughout the Australian ecosystem ✅ 6️⃣ Importantly it provides for choice - so that other regulated Digital ID providers eg state govts and private sector can also be used. We are now one big step closer to making sure we do not OVERSHARE our personal information ✅ For more details ➡️ https://lnkd.in/gtTfDxF5 🟩 Again much kudos to Minister Katy Gallagher for her stellar leadership in this massive national reform. 🟩 Big shout out also to John Shepherd PSM and the team at Australian Government Department of Finance and other collaborating agencies for their tireless work over many years. 🟩 also thanks to my fellow colleagues on the expert panel for all the outstanding advice you have given Malcolm Crompton, AM, FAICD, CIPP , Margo Stephen and Dot West. 🟪 Now for the implementation - there will be proofs of concepts and pilots/trials to get this right before roll out - I promise to keep you posted along the way 🙏🙏

4,150

374 Comments

From ASIC on the state of AI adoption in finance ... and management of the risks: “Misinformation, unintended discrimination or bias, manipulation of consumer sentiment and data security and privacy failures” could “cause consumer harm and damage to market confidence,” he said. “It is clear that work needs to be done – and quickly – to ensure governance is adequate. We want to see licensees harness the potential for AI in a safe and responsible manner – one that benefits consumers and financial markets.” https://lnkd.in/gF8spuYp

8

2 Comments

A very interesting read with well-known scam fighter Jim Browning. Targeting retirees with large savings makes sense from a business point of view. They're often less tech-literate and also, as the article shows, unwilling to admit they might be getting scammed. It's important to remember that these scammers are operating a business, with KPIs and targets to meet. That means they're going to go with whatever works, no matter the moral or ethical implications. If they target children and the elderly, what makes you think they wouldn't target you? https://lnkd.in/ez6du6hR

13

5 Comments

Australian Signals Intelligence and Cybersecurity The landscape of Australian Signals Intelligence (SIGINT) and cybersecurity is a tapestry woven with threads of secrecy, ingenuity, and resilience. Revealing Secrets: An unofficial history of Australian Signals intelligence & the advent of cyber, penned by John Blaxland & Clare Birgin, offers a captivating glimpse into this intricate world. https://lnkd.in/dZpXDi-B

1

If you're still not actively patching and relying on the absence of public exploits or proof of concept (PoC) code to feel secure after vulnerability disclosures, it's time to reconsider. The recent Cloudflare Application Security Report 2024 highlights the rapid weaponisation of disclosed CVEs. There was a 15% increase in disclosed CVEs between 2022 and 2023, and a staggering 97 zero-days were exploited in the wild last year. In one instance, Cloudflare detected exploitation attempts for the JetBrains TeamCity authentication bypass just 22 minutes after PoC code was published online! Threat actors are increasingly targeting particular CVEs to compromise as many systems as possible. Apache, Adobe installations, and Citrix have been significant targets recently, with notable attacks into 2024. It's crucial to stay on top of your patch and vulnerability management programs. Don't delay system updates simply because no PoC or exploit is currently available. The absence of a PoC at the time of your last scan or penetration test doesn't guarantee there won't be one available soon after. Stay proactive! 😀 David Morrison #vulnerabilityManagement #riskManagement #cybersecurity

10

1 Comment

Incentives to safeguard PPI data will likely come from punitive fines that drive boardroom decisions to fund CISOs and Tech/Product leaders aiming to create secure, scalable software. Government needs to take action to prevent further breaches by regulating more strictly. MediSecure's loss of healthcare data of 12.9M people in the latest cyber incident that shows the lack of investment in cyber resilience in healthcare. As is quickly becoming the norm in BFSI, government and healthcare providers should stipulate compliance to cyber standards during procurement and for on-going renewal. As with regulation for safety in cars that we now take for granted, e.g. airbags and seat-belts, this should become a standard. Its not good enough when your personal data is compromised by companies we trust to provide core services.

14

An informative article sheds light on the distinctions between data sovereignty, data residency, and more. In New Zealand, despite assertions from Azure, AWS, or Google Cloud, it's crucial to note that they will not explicitly confirm your data as "sovereign." Unlike them, TEAM Cloud, owned and operated by TEAM IM and powered by Oracle Cloud, can assure you of data sovereignty. Explore more about sovereign cloud solutions: #sovereigncloud #teamcloud #teamim #oci Check out the article here:

13

Cybersecurity is a non-negotiable aspect of doing business in the modern world – and for Australian businesses, the Australian Signals Directorate (ASD) Essential 8 framework is a benchmark for best practices in cyber defence. Yet there remains confusion over whether adherence to this protocol is a recommendation or a regulatory must. This post sets out to clarify the status of the ASD Essential 8 for Australian businesses and compliance professionals, detailing why and how to integrate these practices into your cybersecurity strategy. Siege Cyber is an Australian-owned and operated cyber security company focusing on cyber security services. Our goal is to help our customers secure their organisation. www.siegecyber.com.au [email protected] #asdessential8 #mandatoryinaustralia #ciso #cybersecurity

6

certutil.exe is showing up in my investigations - what do I do next? Michael Wilkinson goes into the details in this blog https://lnkd.in/e2TPHivM

2