Maxime Rapaille

Strengthen Supplier Due Diligence for DORA! But here is how to do it: → Conduct thorough assessments → Ensure clear contractual obligations → Regularly monitor and review And last but not least, → Take action now With the Digital Operational Resilience Act (DORA) coming into effect on 17 January 2025, managing third-party risks is more critical than ever for financial institutions. DORA sets stringent standards for handling supplier relationships, especially those providing critical ICT services. Here’s how to align with DORA’s requirements: 1. Conduct Thorough Assessments ↳ Evaluate supplier resilience, security measures, business continuity plans, and incident response capabilities to ensure they can handle disruptions effectively. 2. Ensure Clear Contractual Obligations ↳ Include specific clauses in contracts that mandate DORA compliance, regular performance monitoring, and defined exit strategies if standards are not met. 3. Regularly Monitor and Review ↳ Implement ongoing monitoring and periodic reviews to maintain oversight, verify compliance, and address any emerging risks promptly. You don’t have much time to prepare for DORA. So what are you waiting for? Start building a more resilient supply chain today.

32

3 Comments

The final tranche of Regulatory Technical Standards have been published today for the Digital Operational Resilience Act (DORA). Covering: 1. RTS and ITS on the content, format, templates and timelines for reporting major ICT-related incidents and significant cyber threats;  2. RTS on the harmonization of conditions enabling the conduct of the oversight activities; 3. RTS specifying the criteria for determining the composition of the joint examination team (JET); and 4. RTS on threat-led penetration testing (TLPT). Navigating the compliance landscape can be challenging, but Nemesis makes it easier. Our breach and attack simulation software allows your organization to simulate real-world scenarios to ensure compliance with ICT risk management policies and security posture, such as those required by NIS2 and DORA (Article 25).   You can automate those simulations with our user-friendly scheduler, validate controls, and safeguard critical infrastructure. By creating executive-quality reports, Nemesis provides clear insights and actionable data for decision-makers. This means less time navigating complex spreadsheets and more time focusing on strategic initiatives.  Elevate your compliance efforts today and ensure your organization is prepared for any scenario. Contact me for a chat and a demo! #DORA #BAS #Cybersecurity #Compliance Persistent Security Industries

9

#ISO27001 & #SOC2 are hard if you just starting this journey. We released a new feature to navigate the compliance road easily with UnderDefense MAXI. Discover the roadmap with key milestones and artifacts you need outlined to understand your journey & timeline - better. and yeah - #Compliance - could be #easy. It should be #AUTOMATED. That's what we are best at https://hubs.ly/Q02w5TCf0

4

#ISO27001 & #SOC2 are hard if you just starting this journey. We released a new feature to navigate the compliance road easily with UnderDefense MAXI. Discover the roadmap with key milestones and artifacts you need outlined to understand your journey & timeline - better. and yeah - #Compliance - could be #easy. It should be #AUTOMATED. That's what we are best at https://hubs.ly/Q02w5TgP0

2

🇧🇪 Cybersecurity Risks for the 2024 Elections in Belgium 🇪🇺 As #Belgium gears up for its federal, European, and regional elections on June 9, 2024, the digital landscape poses significant challenges to the democratic process. #Cybersecurity threats are multifaceted and evolving, from #deepfake manipulation and disinformation campaigns to #databreaches and foreign-backed cyber intrusions. 🏛️ The Centre for Cyber Security Belgium outlines these risks and strategic responses in their #CybersecurityStrategy 2021-2025, emphasizing the need for vigilance against #cybercrime, #hacktivism, and #terrorism. As we move closer to election day, understanding these threats and enhancing our defenses is crucial to safeguarding our democratic institutions. Explore how SOCRadar's comprehensive threat intelligence solutions can help protect against these risks and ensure the integrity of the electoral process. 👇 https://lnkd.in/dpTCQJGb #BelgiumElections #ElectionSecurity #ThreatIntelligence #EU2024BE #electionBelgie2024 #Belgium #UseYourVote

8

https://lnkd.in/eYiRXBvu Great insights from John. Some salient points.. 1. The NIS2 Directive went into effect January 2023. EU member states were imposed a deadline of Oct. 17, 2024, to transpose the directive into law. 2. “Costs could approach €10 billion (US$10.9 billion) annually, EU-wide,” according to Wright. “However, ISO 27001 certified entities have a head start, with approximately 70% of NIS2 requirements already covered.” 3. The measures required by NIS2, such as cyber risk management, supply chain security, and business continuity, are good business practices that enhance organisational resilience. 4. Businesses may need to consider NIS2 alongside other national, regional, and international regulations such as DORA (the EU’s Digital Operations Resilience Act), GDPR, and the EU AI Act.

12

The #CyberResilienceAct is Here! The Cyber Resilience Act (CRA) was published in the European Union Official Journal, today, 20th November 2024. Twenty days later, on 11th December 2024, the CRA will enter into force across all EU member states. The 11th December 2024 will also mark the start of the 36-month transition period, meaning that manufacturers, distributors and importers of products with digital elements will need to be fully compliant with the new CRA legislation by 11th December 2027. The clock has started ticking for all businesses implicated by the new legislation. What is the Cyber Resilience Act? The CRA is a new EU legislation that aims to improve baseline cybersecurity standards for products with digital elements made available on the EU internal market. Products with digital elements are defined as products with hardware and/or software components and any associated remote data processing solutions. This encompasses a breadth of product types including internet of things (IoT) devices. This is a horizontal legislation, meaning it is not specific to one business sector. The CRA will implicate all products with digital elements bar a few exceptions such as medical devices and motor vehicles. The CRA legislation sets out essential requirements for cybersecurity and vulnerability handling of products with digital elements. Manufacturers of products with digital elements must implement these essential requirements and show proof of compliance by completing a conformity assessment. Once the product with digital elements has passed the conformity assessment, the CE mark must be affixed to the product. This shows customers that the product has met the CRA legislation requirements. Next Steps Manufacturers of products implicated by the CRA should start researching what they need to do to incorporate the CRA into their product lifecycle process. The CRA expects cybersecurity to be taken into account across all stages of the product lifecycle and this may be a change for some manufacturers. Start your CRA journey by checking out our blog posts on the CRA, such as information on product scope: https://bit.ly/4el2Mco and CRA product categories: https://bit.ly/3Ux7b51 . Follow Cyber Cert Labs on LinkedIn for more information and updates on the CRA. Have questions? Need more specific advice about the CRA? Reach out to us at our website: https://lnkd.in/ezGHFnuM

13

⚠️ Critical Infrastructure Threat Volt Typhoon, a state-backed espionage group, is targeting critical infrastructure worldwide, exploiting outdated, unprotected routers in government and industrial networks. This group uses these entry points to infiltrate systems and remain undetected. #Cybersecurity 🔍 Re-Emergence of Volt Typhoon Previously thought inactive, Volt Typhoon has resurfaced with a more sophisticated approach. Compromised Cisco and Netgear routers now form a covert botnet, enabling attacks while blending into normal network traffic. Their adaptive methods make detection particularly difficult. #BotnetThreat 🌐 Expanding Global Network Volt Typhoon’s network uses compromised small-office devices worldwide, which disguise malicious traffic as regular network activity. These routers, outfitted with specialized malware, allow covert communication, particularly in sectors dependent on older technology. #NetworkSecurity 🛰️ New Caledonia as a Cyber Hub A compromised VPN device in New Caledonia plays a key role, acting as a bridge for Volt Typhoon’s network between the Asia-Pacific region and the Americas. This hidden route helps Volt Typhoon evade detection and expand its influence. #CyberEspionage 🔗 Supply Chain Vulnerabilities Critical infrastructure, often reliant on legacy systems and third-party vendors, provides entry points for Volt Typhoon. Weaknesses in these supply chains threaten essential services like energy, impacting global economies and industrial stability. #SupplyChainRisk 🚨 Ransomware Ecosystem Influence While Volt Typhoon doesn’t directly deploy ransomware, it operates within a ransomware-driven environment. Ransom payments fund new hacking tools, heightening cyber threats for industries dependent on third-party and cloud providers. #RansomwareRisks 🤖 AI-Powered Cyber Threats A recent report highlights rising cyber risks in the U.S. energy sector, with 45% of incidents stemming from third-party breaches. State-backed groups like Volt Typhoon may increasingly use AI, intensifying attacks and the need for robust cybersecurity. #AICybersecurity 🌍 Global Coalition Response In response to the escalating threat, 68 countries led by the U.S. have launched the International Counter-Ransomware Initiative. This coalition aims to reduce ransom payments and protect critical sectors like energy from sophisticated attacks. #GlobalCyberDefense ⏰ A Call to Strengthen Infrastructure Security Volt Typhoon’s return underscores the urgency of securing outdated systems and third-party networks. The expanding botnet is a stark reminder of the potential for infrastructure crises unless these vulnerabilities are addressed. #InfrastructureSecurity Are outdated systems putting our infrastructure at risk? Explore the full findings to learn more: https://lnkd.in/gVYN8YxH

3

Under the Borealis: OT Cyber Threat Intelligence Tailored for Nordic Countries 

1

Strengthen Governance and Oversight with DORA Digital Operational Resilience Act! Here’s how to meet its requirements for governance and oversight, along with techniques to implement them: 1. Accountability of Senior Management Technique: Clear Role Definition  ↳ How it Helps: Ensures leaders are responsible for ICT risk compliance. 2. Establish Governance Frameworks Technique: Role Integration  ↳ Defines roles and integrates ICT risk management. 3. Promote Cybersecurity Culture Technique: Regular Training  ↳ Encourages employees to practice cybersecurity. 4. Allocate Resources Technique: Invest in Technology and Training  ↳ Provides skilled staff and necessary tools. 5. Create Risk Committees Technique: Diverse Input  ↳ Oversees ICT risks with varied organizational input. 6. Implement Reporting Mechanisms Technique: Transparent Communication  ↳ Maintains regular updates on risks. 7. Integrate Risk Frameworks Technique: Alignment with Broader Management  ↳ Aligns ICT risk with overall risk management. 8. Continuous Monitoring Technique: Internal Audits and External Assessments  ↳ Conducts regular checks to ensure compliance. 9. Establish Feedback Loops Technique: Incident Learning  ↳ Uses past incidents to strengthen resilience. DORA compliance is essential. Equip your organization with robust governance structures and oversight to withstand digital threats. Follow me David ⚡ Clarke FBCS CITP

13

1 Comment

Everything You Need to Know About The Digital Operational Resilience Act (DORA) DORA (Digital Operational Resilience Act) (Regulation (EU) 2022/2554) is the newest EU regulatory framework for ICT risk management to help financial institutions build better cyber resilience. The regulation establishes uniform requirements for the financial sector regarding the security of its networks and information systems. Key focus areas include robust incident reporting, rigorous third-party oversight, and standardized resilience testing. The deadline for all EU organizations or businesses that operate in the EU to comply with DORA's requirements is expected to be January 17, 2025. DORA aims to harmonize risk and resilience management, ensuring a secure and resilient financial ecosystem across the EU. Are you ready for DORA? Is it applicable to you? To learn more, please visit our latest #blog today! https://lnkd.in/d73AG9NX Ardent Privacy Sameer A. Shivraj Jadhav Sushil Raverkar Scott Suhy Tejas Joshi #CyberSecurity #FinancialServices #DORACompliance #LegallyDisruptive #DigitalResilience #DORA #FinancialSector #CyberSecurity #ICTRiskManagement

9

Like #ISO26262 for Functional Safety ASIL levels, we have an interesting standard coming up for #ISO21434. With ISO PAS 8475, #Cybersecurity Assurance Levels look for a good starting point. Join János Kovács at the SOS2024 ASRG conference. #AutomotiveECU #CAL #AutomotiveCybersecurity

3

Maybe it is time to take a leaf out of the European Union book and use #ISO standards that have been intricately put together to guide all forms of sectors. Let the ISO/TS 31050:2023 Risk Management — Guidelines for managing an emerging risk to enhance resilience - guide you of such emerging risks venture as presented in "The Emerging Risk - AI" article - https://lnkd.in/dA3AfjuP Standards and Framework acknowledged in the article: - - OECD (2022), “OECD Framework for the Classification of AI systems”, OECD Digital Economy Papers, No. 323, OECD Publishing, Paris, https://lnkd.in/erWCRsJx. - ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. - ISO/IEC 38507:2022 Information technology — Governance of IT — Governance implications of the use of artificial intelligence by organisations. - ISO/IEC 23894:2023 Information technology — Artificial intelligence — Guidance on risk management. - ISO/IEC TR 24028:2020 Information technology — Artificial intelligence — Overview of trustworthiness in artificial intelligence. - ISO/IEC 23053:2022 Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML). -  ISO/IEC 27001 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. -  ISO/IEC 27701 Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines. - ISO 31000:2018 Risk Managementt — Guidelines - NIST Artificial Intelligence Risk Management Framework https://lnkd.in/eEduAa6x

4

The ECSF provides an open tool to build a common understanding of the cybersecurity professional role profiles in Europe and common mappings with the appropriate skills and competences required. https://lnkd.in/dP7UyRmN #SIEM #SOC #DFIR #TI #CTI #MITRE

2

The Security Navigator 2025 is here! ⚡ This is your number one source for professional insights on key information about #cyberdefense. It's never been more important to stay informed about the #cybersecurity #landscape. The annual report, which gathers, cross-references and analyzes data from a wide variety of sources, paints a broad and complex picture of the world of hashtag#cybersecurity, amplified by geopolitical, economic and social dimensions. Research-driven insights to build a safer digital society - 100% first-hand information from the operations and research teams of a leading Security Services provider. - Invaluable insights into the threat landscape. - Expert reports and expert reviews on topics like #Cyber #Extortion, #Vulnerability Management, #Hacktivism. - #Attack patterns and statistics for different business sizes and industries. - Analysis of the most disrupting events and what to expect in the future Find these stories and many more in the Navigator! 👉 Download your copy today: https://lnkd.in/dBUvggze #securitynavigator #Orange #Orangecyberdefense #OrangeEgypt #saferdigitalsociety

6

BIG HELPING SMALL IN CYBER From little things, big things grow, (so the tune goes) which in cybersecurity terms means countries need to do more in practical operational terms by building operational capacity & capabilities to support & enable the protection of small & medium businesses (SMBs) from cyber-attack. The integrated cross-sector CI-ISAC non-government & not-for-profit model anchored in the sovereignty of independent countries yet driven by industry in each country, is the most financially sustainable & analytically effective way for civil-society & the private sector to leverage the benefits of cyber threat information for their day-to-day cyber defence. The model not only helps protect the smaller less cyber mature businesses, but also helps defend the larger businesses with whom small business form the supply-chain to reduce the risk of potential 3rd-party attack vector for larger more cyber mature businesses. Just another example of why we are #Strongertogether when we #Leavenoonebehind both within countries & globally. #Trustedlocal = #Trustedglobal

33

3 Comments