Sherifat Akinwonmi

Secure by Design Pledge, a voluntary program for software manufacturers. The program outlines a set of goals that manufacturers can agree to work towards in order to improve the security of their products. I believe this program is a positive step towards improving the overall security posture of the software we use every day. By encouraging software makers to prioritize security from the design phase, we can collectively create a more secure digital environment. Software makers pledged to make measurable progress in applying secure by design principles to their organization and publicly document how they achieved it within one year. #cybersecurity #softwaredevelopment #pledge #securebydesign #microsoft #aws #github #qualys #fortinet #google

12

Implementing DevSecOps in Nigeria’s banking and financial sector is revolutionising how we manage risk and ensure compliance. By integrating security into every phase of the development lifecycle, banks can now deliver faster, more secure digital services, enhancing resilience against cyber threats. Embracing DevSecOps not only protects sensitive data but also drives innovation and customer trust in our digital economy. #DevSecOps #CyberSecurity #NigeriaBanking #FinancialIndustry #Innovation.

4

What an amazing masterclass! A huge thank you to Dr. Fene Osakwe for sharing his wisdom and expertise at our cybersecurity career event last Saturday. As always, he did not disappoint. He gave actionable tips that could literally change lives. From mindset shifts to overcoming imposter syndrome, his insights left the audience feeling super motivated. I was thrilled to facilitate this event and share tips on building a successful cybersecurity career. Whether you're just starting out or have years of experience, there was something valuable for everyone. Cybersecurity pathways to financial freedom became much clearer thanks to Dr. Fene. For those who missed it, you really missed out. Unfortunately, there's no recording for those asking. Remember, investing in your career and networking are so important. Kudos to all who attended - together, we're building an incredible community. And remember, it's never too late to start or advance your cybersecurity career journey. Stay tuned for updates on upcoming events! #cybersecuritycareer #careerdevelopment #careergoals #mentorship

33

3 Comments

𝐏𝐄𝐂𝐁 𝐂𝐞𝐫𝐭𝐢𝐟𝐢𝐞𝐝 𝐍𝐈𝐒𝐓 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐧𝐬𝐮𝐥𝐭𝐚𝐧𝐭 𝐭𝐫𝐚𝐢𝐧𝐢𝐧𝐠 𝐜𝐨𝐮𝐫𝐬𝐞 𝐏𝐮𝐫𝐩𝐨𝐬𝐞: The course aims to equip participants with expertise in applying NIST guidelines, managing security controls, employing risk management techniques, and designing cybersecurity programs aligned with organizational objectives. 𝐊𝐞𝐲 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠 𝐎𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬 𝐀𝐫𝐞: - Learning cybersecurity principles such as confidentiality, integrity, and availability. - Understanding and applying key NIST publications (SP 800-12, SP 800-53,  SP 800-37, SP 800-171, and the NIST Cybersecurity Framework). - Implementing processes for monitoring, assessing, and managing security controls. - Developing risk mitigation strategies and align them with NIST's recommendations. - Designing organizational cybersecurity programs. Thanks PECB and Dr. Michael L Crawley, ESG, Future of Work, Cloud Value Stream, KPI,OKR, ML,AI, Cybersecurity Expert

45

5 Comments

Data Security and Protection Policy Template Data Security and Protection Policy Template: A Comprehensive Framework for Safeguarding Sensitive Information The "Data Security and Protection Policy Template" is a valuable resource for GRC (Governance, Risk, and Compliance) professionals looking to develop robust data security policies within their organizations. This draft policy document, outlines a comprehensive framework for protecting sensitive data from unauthorized access, use, disclosure, alteration, or destruction. Key highlights of the policy template include: 1. Clear statement of purpose and scope, covering all types of data and applying to all employees, contractors, and third-party vendors. 2. Commitment to ensuring the confidentiality, integrity, and availability of data, while complying with relevant regulations and industry best practices. 3. Detailed goals and objectives, such as preventing unauthorized access, ensuring data integrity, protecting against loss or damage, and maintaining a secure data environment. 4. Definitions of key terms, including "data," "data security," "data protection," "data controller," and "data processor," to ensure a common understanding. This policy template can serve as a valuable starting point for organizations looking to develop or update their data security and protection policies. GRC professionals are encouraged to review the document, provide feedback, and adapt it to their specific organizational needs and requirements. Remember, as this is a draft version, it is crucial to verify the information carefully before implementation and to seek professional guidance as needed.

20

1 Comment

What is a Policy? What is a Standard or a Procedure? You may find this infographic helpful.

29

3 Comments

Identity and Access Management (IAM) Policy Template Establishing an Effective Identity and Access Management Policy In today's dynamic business landscape, where digital transformation is the norm, organizations must ensure robust cybersecurity measures to protect their critical assets. One such essential element is a comprehensive Identity and Access Management (IAM) Policy. The National Cybersecurity Authority (NCA) has released a comprehensive IAM Policy Template that provides a valuable framework for organizations to develop and implement their own tailored policies. This template outlines key elements that should be addressed, including: 1. General Requirements: Establishing documented access management procedures, secure user authentication and validation, an authorized access matrix based on the principles of "need to know," "segregation of duties," and "least privilege," as well as centralized logging and monitoring of IAM systems. 2. Granting Access: Defining user account access requirements, including standardized naming conventions and restrictions on concurrent logins, as well as additional controls for users with elevated permissions. 3. Roles and Responsibilities: Clearly delineating the responsibilities of various stakeholders, such as the cybersecurity function, line managers, and system owners, to ensure effective policy implementation and accountability. 4. Update and Review: Implementing a regular review and update process to ensure the policy remains aligned with the organization's evolving needs and changes in relevant regulations and standards. By adopting this NCA-provided IAM Policy Template as a starting point and customizing it to their specific requirements, organizations can establish a robust framework to manage identities and access, ultimately enhancing their overall cybersecurity posture and mitigating the risks associated with unauthorized access to critical information and technology assets.

34

1 Comment

SABSA (Sherwood Applied Business Security Architecture) is a proven methodology for developing business-driven, risk and opportunity focused Security Architectures at both enterprise and solutions level that traceably support business objectives. It is also widely used for Information Assurance Architectures, Risk Management Frameworks, and to align and seamlessly integrate security and risk management into IT Architecture methods and frameworks. Where SABSA differs from other approaches, is that it defines a conceptual layered model which enables the provision of an holistic, strategic architectural approach as opposed to the more typically seen application of technology and process stand-alone and point solutions to tactical security objectives. For those familiar with, it also leverages the Zachman Framework and is compatible with TOGAF, ISO 27001, Agile and other methodologies. Read More Here 👇🏻 https://lnkd.in/gZ8Zdv3E #SecurityArchitechture #CyberGovernance

9

Digital Resilience vs Cyber Resilience Digital resilience Refers to an organization’s capacity to overcome disruptions in business by leveraging digital technologies. It is critical for sustaining operational functions during disturbances and adapting to new circumstances. Digital resilience involves utilizing modern technologies to address various crises extending beyond cyber-attacks to include areas like change management, operational risk management, IT resilience, competitive strategy, business continuity management and disaster recovery. Cyber resilience Cyber resilience involves preparing for, responding to, and rapidly recovering from a range of cyber risks, enabling business to maintain operations with minimal disruption. The primary goal is to maintain cybersecurity preparedness, ensuring essential business functions during disruptions, swiftly restoring critical operations post breach, and utilizing cyberattacks insights to enhance overall cyber capabilities and business resilience. Cyber resilience, focusing on identifying IT vulnerabilities, responding to attacks, and safeguarding IT assets, has been a long outstanding concept.

14

2 Comments

🔐 Understanding NIST Cybersecurity Framework (CSF): Subcategory GV.SC-04 🔐 I am firing this series back up. Let’s break down another subcategory! Today, let’s talk about GV.SC-04—a key subcategory in the framework that focuses on ensuring organizations inventory their suppliers and prioritize them by criticality. Why does this matter? Imagine your organization has top-notch security measures, but (somehow) does not know what vendors are critical to your day-to-day operations. This misalignment can lead to poor vulnerability prioritization, disastrous incident response, and probably legal issues. 🔍 GV.SC-04 ensures you keep a record of all suppliers and develop criteria for supplier criticality. Criticality could be based on the sensitivity of data processed by the vendor, the degree of vendor access to your systems, or simply the vendor's involvement in your critical business processes. This not only helps in protecting your data but also in avoiding potential legal pitfalls. For those not familiar with the NIST CSF, think of it as a guide that helps organizations manage and reduce cybersecurity risks. It’s widely respected and used across various industries. 🌐 As cybersecurity becomes more critical, understanding and implementing these best practices can make a significant difference in protecting your organization’s data and reputation. #Cybersecurity #NISTCSF #Compliance #InformationSecurity #RiskManagement

15

3 Comments

Great suggestions on how to effectively measure and improve your business.

4

I passed the AKYLADE Certified Cyber Resilience Practitioner (A/CCRP) [CRP-002] Exam. This certification evaluates practical knowledge of the NIST Cybersecurity Framework (CSF) Version 2.0, a structured approach to cybersecurity risk management that can be adapted to various sectors and organizational sizes. This framework is essential for decision-makers, from executives to IT professionals, as it enhances their understanding and management of cybersecurity risks, fostering a more secure and resilient organizational environment. I sincerely thank AKYLADE, Lee Marer, and Alyson Laderman, Esq. for their unwavering support and guidance throughout my journey to achieve the AKYLADE Certified Cyber Resilience Practitioner (A/CCRP) certification. Your support has been invaluable, and I am genuinely grateful for it. For my preparation and completion of the AKYLADE Certified Cyber Resilience Practitioner (A/CCRP) [CRP-002] exam, I utilized a comprehensive suite of resources that provided the depth of knowledge required to master the exam’s content. The resources I used include: ·      AKYLADE_CRP-002_Objectives_1.0 ·      AKYLADE_CRP-002_Practice_Exam_1_Official ·      AKYLADE_CRP-002_Practice_Exam_2_Official ·      The NIST Cybersecurity Framework (CSF) 2.0 ·      Cybersecurity Framework Version 1.1 Manufacturing Profile ·      Mastering Cyber Resilience: From Theory to Practice: Practical Strategies for Cyber Resilience (Second Edition) (AKYLADE) I thank Kip Boyle, Jason Dion, and Lisa McKinley for their outstanding work on "Mastering Cyber Resilience: From Theory to Practice: Practical Strategies for Cyber Resilience (Second Edition)." This book has been an essential resource in my studies. The constant level of detailed knowledge across all domains and its engaging presentation with examples has significantly deepened my understanding of the NIST Cybersecurity Framework concept. Thank you for creating such a valuable and enlightening resource!  #Akylade #CyberResilience #ISACA #ISC2 #CyberSecurity #NISTCSF #CISSP #CybersecurityFramework #NISTCSF2

195

56 Comments

Human Resources Cybersecurity Policy Template As organizations navigate the evolving digital landscape, safeguarding sensitive information and mitigating insider threats have become critical priorities. To address these concerns, the National Cybersecurity Authority (NCA) has developed a comprehensive Human Resources Cybersecurity Policy Template that serves as a valuable guide for businesses. This policy template provides a structured framework for managing cybersecurity risks associated with personnel throughout the employee lifecycle. It covers key aspects such as pre-employment screening, in-service cybersecurity roles and responsibilities, and procedures for the end of employment. The policy outlines general requirements, including conducting regular cybersecurity awareness campaigns, defining critical system access privileges, and implementing robust access controls. It also delves into specific policy statements for each phase of the employee journey, ensuring a holistic approach to cybersecurity. By adopting and customizing this template to their organization's unique needs, businesses can establish a robust human resources cybersecurity framework. This not only helps preserve the confidentiality, integrity, and availability of sensitive information but also fosters a culture of security awareness among the workforce. The NCA's Human Resources Cybersecurity Policy Template serves as a valuable resource for organizations seeking to enhance their overall cybersecurity posture and mitigate the risks associated with internal and external threats. Implementing this policy can be a crucial step in an organization's comprehensive cybersecurity strategy.

12

1 Comment

Cybersecurity and resilience are critical for SACCOs due to their handling of sensitive financial data and member personal information/data. I have some key points to consider: 1. Understanding Cyber Threats: Types of Threats: Phishing, ransomware, malware, insider threats, and denial-of-service attacks. Impact: Financial loss, reputational damage, and legal consequences. 2. Risk Assessment: Identify Assets: Determine what data and systems are critical. Vulnerability Assessment: Evaluate weaknesses in current systems and processes. Threat Analysis: Understand potential threats specific to the SACCO environment. 3.Cybersecurity Framework: Policies and Procedures: Develop clear cybersecurity policies, including data protection and incident response plans. Access Control: Implement strict access controls to sensitive information. Encryption: Use encryption for data at rest and in transit. 4.Employee Training: Awareness Programs: Regular training on recognizing phishing attempts and safe online practices. Incident Reporting: Encourage employees to report suspicious activities. 5.Technology Solutions: Firewalls and Antivirus Software: Use up-to-date security software to protect against threats. Multi-Factor Authentication (MFA): Implement MFA for an additional layer of security. Regular Updates: Ensure all software and systems are regularly updated to patch vulnerabilities. 6.Incident Response Plan: Preparation: Develop a plan that outlines steps to take in the event of a cyber incident. Testing: Regularly test the incident response plan through simulations. Recovery: Establish procedures for data recovery and business continuity. 7.Regulatory Compliance: Understand Regulations: Stay informed about relevant laws and regulations governing data protection and cybersecurity in your jurisdiction. Audit and Reporting: Regular audits to ensure compliance and identify areas for improvement. 8. Building Resilience: Backup Solutions: Regularly back up data and ensure backups are secure and accessible. Business Continuity Planning: Develop a comprehensive business continuity plan that includes cyber incident scenarios. 9.Collaboration and Information Sharing: Partnerships: Collaborate with other financial institutions and cybersecurity organizations to share threat intelligence and best practices. Conclusion SACCOs must prioritize cybersecurity and resilience to protect their members' funds and maintain trust. By implementing a comprehensive cybersecurity strategy, conducting regular assessments, and fostering a culture of security awareness, SACCOs can significantly reduce their risk of cyber incidents and enhance their overall resilience.

63

13 Comments

#Day14 #learnwithsikiru Today is the final day of our PCI DSS series, and we'll be covering the twelfth and last requirement. Day 14- Requirement 12 of PCI DSS emphasizes the importance of supporting information security with organizational policies and programs. This requirement mandates that all businesses must establish an information security policy that educates personnel about the sensitivity of payment card data and their roles in safeguarding it. These policies should guide staff on their responsibilities and expected actions. The security policy should be reviewed annually or whenever there are changes in the environment to address emerging security threats and updated protection measures. Additionally, maintaining an accurate inventory with proper device labeling is crucial. It helps quickly identify unauthorized installations and ensures approved installations are easily verifiable. A policy must also be in place to restrict the copying, transferring, and storing of cardholder data on local hard drives and removable electronic media, except when explicitly authorized for specific tasks. That concludes our overview of PCI DSS V4.0. Feel free to share any additional insights or questions in the comments, as I'm keen to learn more. To read more- https://lnkd.in/d922E4CV Thank you for your time!

6

How does GRC impact organizations? GRC (Governance, Risk, and Compliance) significantly impacts organizations by structuring governance, managing risks, and ensuring regulatory compliance. This unified approach enhances business performance, fosters a culture of integrity, and mitigates financial and reputational risks. Web search results on Governance, Risk, and Compliance impact organizations. https://lnkd.in/dCKXRr7S

3

While being in the Information Security is great on its own, the most challenging requirement in it is continuous learning. To achieve it, the security practitioner needs to be intentional about it, dedicated to learning and acquiring new knowledge, as well as sacrifice time and financial resources into it. This challenging aspect of this career path is equally rewarding though, when the positive outcomes are received. For those that formalise learning through regular certifications will confirm that the minutes/seconds just after finishing a certification exam, but just before receiving the exam outcome, are filled with anxiety and palpitations. At this moment, the mind journeys away to every time prior and during the exam where you should have done things another way. With all that said, I punished myself with registering, preparing and taking the ISC2's Information Systems Security Management Professional (ISSMP) exam today, Saturday 5th October 2024. Those few anxious minutes were rewarded with a congratulatory message, indicating a provisional pass of the exam. Wasn't I relieved!! I will await the final confirmation and then deservedly busk in the glory of this achievement. That, ladies and gentlemen, is how I officially start the 2024 Cybersecurity Awareness Month activities. It is my contribution in inspiring those that belong to the Eswatini Information Security practitioner community into committing to this continuous learning journey, affirming that it is a journey that you can indeed walk.

66

18 Comments

🔐 Understanding the Roles of Data Custodian vs. Data Owner in CISSP 🔐 In the world of cybersecurity, especially for those pursuing or holding the CISSP certification, understanding the distinction between a Data Custodian and a Data Owner is critical to effective security management. Each role has unique responsibilities that support data protection and organizational resilience. Let’s break it down: 🌐 Data Owner: The Data Owner is typically a senior leader within an organization, responsible for classifying and determining the value of data. They play a strategic role, in setting policies and making critical data access, classification, and retention decisions. In other words, they define what needs to be protected and why. 🛠 Data Custodian: The Data Custodian is responsible for the day-to-day management of data security tasks. Their duties include implementing and maintaining data controls, ensuring data backups, and applying the security policies defined by the Data Owner. Essentially, they focus on securing and maintaining data integrity. 📖 Why It Matters for CISSP: In the CISSP Common Body of Knowledge (CBK), understanding these roles ensures a solid foundation for managing data security and compliance. Effective alignment between Data Owners and Custodians can prevent unauthorized access, data loss, and other security incidents. 🔍 Takeaway: For those pursuing #CISSP, or involved in #Cybersecurity, knowing the distinction and collaboration between these roles is key to building a robust data governance framework. #DataGovernance #CyberSecurity #CISSP #DataCustodian #DataOwner #InformationSecurity

9