Simarjit Ronak

When was the last time you updated your software? Regular updates are crucial for cybersecurity. Here’s why: Let's be friends! Follow Me Ikechukwu Enuosa #Cybersecurity #SoftwareUpdates #Canada #DigitalSafety #CyberTips

2

DORA: Impact of the Digital Operational Resilience Act on the Internal Audit Function Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance, & join our exclusive infosec group for early access to creative infosec content PS: Infosec Community Link shared in Comments Section 🔍 Introduction: The Digital Operational Resilience Act (DORA) is reshaping the financial sector's approach to operational resilience. This document dives deep into how DORA impacts the internal audit function and the necessary adjustments organizations need to make. 📑 What’s in the document: 1. Overview of DORA’s key provisions 2. Insights into how DORA strengthens operational resilience 3. Specific requirements for internal audit teams under DORA ✅ Conclusion: As organizations prepare for DORA’s full implementation, it’s critical for internal audit functions to align with its expectations. Download the document to stay ahead in the compliance journey! #DORA #InternalAudit #OperationalResilience #DigitalResilience #Compliance #resilience #finance #infrastructure #business #continutiy #BIA #BCMS #disaster #recovery #operations #impact #governance #risk #internal #audit #infosec #informationsecurity #cybersecurity

126

10 Comments

🚨Cybersecurity Alert for Canada🚨 A recent investigation has uncovered a potential cybersecurity threat aimed at the Canadian Government. During an OSINT session, a suspicious domain was identified that mimics the official government website, likely intended to harvest sensitive data from Canadian residents. 🔹 **Domain Name:** `www.canadaembassy.co` 🔹 **Hosted in:** India 🔹 **IP Address:** 46.28.45.170 This finding is crucial for our community to be aware of as it poses significant risks. I urge everyone to stay vigilant and share this information widely to help prevent potential cyberattacks. Let's work together to keep our digital environment safe! #CyberSecurity #Canada #DigitalSafety #InfoSec For more details on this alert,👎 New Threat Targeting the Canadian Government](https://lnkd.in/g9yGwWdG)

35

What is #PAM and #IAM, where do you get #SSO and where #JIT access? #identityaccessmanagement #iam #identitymanagement #cybersecurity #security #identityaccessmanagement #fortune #technology #accessmanagement #tiiam #it #technews #informationtechnology #companies #identitygovernance #issquared #dataprotection #sailpoint #iag #cti #ti #iiam #ethicalhacking #futureofsmartlife #globalcost #cybercrime #threathunting #orsus #decentralizedidentity #threatintelligence  #stayaheadofbreaches #iamcloud #itnews #cybersecuritynews #threatvector #cryptojacking #riskassessment #cloud #zerotrust #iamwithzerotrust #ginfrastructure #datasecurity #tech #iga #cloudsecurity #workfromhome #pechakucha #remotejobs #usermanagement #microsoft #distributiongroups #activedirectory #education #identitysecurity #software #access #iampam #groupmanagement #itupdate #iamtechnology

1

🚀 Excited to announce that I will be attending the upcoming Operation: Defend the North event, organized by siberX in Toronto from June 10-12, 2024! This unique three-day cybersecurity readiness exercise will bring together public and private sector stakeholders along with the Canadian Cybersecurity community to enhance our collective response strategies against cyber threats. 💡 Why Attend? Simulated Cyber Attacks: Experience firsthand how experts navigate and respond to a live cyber breach, gaining real-time insights into strategies and decisions. Expert-Led Sessions: Learn from industry leaders about best practices and the latest insights in cybersecurity. Networking Opportunities: Connect with fellow participants through the siberXchange platform and during dedicated networking breaks. A big thank you to Mahdi Raza and the entire siberX Team for organizing this incredible event. Your efforts in strengthening Canada's cybersecurity readiness are truly commendable. 🎟 Have you got your tickets yet? Don't miss out on this opportunity to be part of an engaging and impactful cybersecurity readiness exercise. 🔒 Operation: Defend the North: 3 Days of Defending Against a Live Cyber Attack. Join us and discover how leaders from across Canada will keep us safe amidst a simulated attack on our power grids. ✅ Register and learn more at siberx.org/defendthenorth Let's come together to build a more secure and resilient cyber environment. See you there! #wearecyber #ohcanada #canada #operationdefendthenorth #readinessexercise #cybersecurity #event #cybersecurityconference #defence #defendthenorth #hack #training #cybersecuritytraining #gamification #cyber #tabletop #gaming #eSportsCyber #cybersecuritytalks #threatintelligence #virtual #conversation #event #online #privacy #datasecurity #databreach #security #technology

32

2 Comments

📘 Introducing the Ultimate Internal Audit Manual! 🔍 Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance. Join our exclusive infosec community: https://lnkd.in/gG_aG5AF 1️⃣ Introduction to the Document: Dive into the comprehensive Internal Audit Manual designed to guide auditors through every step of the audit process. This essential resource is perfect for both novice and experienced auditors aiming to enhance their audit practices. 2️⃣ What's in the Document: The manual provides detailed guidance on audit planning, execution, reporting, and follow-up. It includes methodologies, best practices, checklists, and real-world examples to ensure thorough and effective audits. Additionally, it covers risk assessment, control evaluation, and compliance checks to help auditors navigate complex audit scenarios. 3️⃣ Conclusion: Elevate your internal audit function with our meticulously crafted Internal Audit Manual. Equip yourself with the knowledge and tools needed to conduct efficient and impactful audits. Download the document now and transform your audit processes for greater accuracy and effectiveness. #Audit #Internalaudit #ISMS #ISO #manual #auditmanual #checklist #risk #riskmanagement #infosec #informationsecurity #cybersecurity

60

5 Comments

This one slide was one of the most impactful ones I saw during the August 2024 CyberAB Town Hall. I have been following the CMMC program from Canada since 2019 and became certified in 2021, the first one in Canada even though I would not be able to perform assessments. Why? I have been involved with NIST security frameworks since 2005 starting with NIST 800-53. CMMC is based on many source laws, regulations, and policies as well as NIST 800-171 security control practices. But that does not answer why CMMC caught my attention. I knew that eventually CMMC would be adopted by other countries that provide products services for the US DoD. Canada is one of those countries with over 900 companies and 60,000 jobs involved in the Defense Industrial Base. To my way of thinking, it was only a matter of time and in May of 2023 the government announced that implementation of the Canadian Program for Cyber Security Certification (CPCSC). CPCSC is intended too be the reciprocal CMMC program in Canada. So why did the following CyberAB presentation slide catch my attention? Having been at this for almost five years now we are now only six months away from launch! Only six months. Canadian DIB companies acting as secondary suppliers to US DoD Prime companies are already being told they will need to achieve certification if they are going to continue working on US DoD contracts! This is very significant. And we only have six more months to go. With that said, every one of the 900 DIB companies should seriously consider developing a CMMC/CPCSC Assessment Readiness Plan starting with a CMMC Level 1 Assessment Self-Attestation program, sooner than later! Six months is not a long time and will pass very quickly given we will entering the holidays half way through when not much will get done. If you want to talk about your company's direction for CMMC certification while we are waiting for the CPCSC to be implemented please feel free to reach out.

5

5 Comments

📊 Enhance Your Audit and Risk Assurance Committee's Effectiveness!🔍 Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance. Join our exclusive infosec community: https://lnkd.in/gG_aG5AF 1️⃣ Introduction to the Document: This document is an invaluable resource for organizations aiming to strengthen their governance and risk management practices. 2️⃣ What's in the Document: This tool provides a comprehensive framework for evaluating the performance and effectiveness of your committee. It includes key performance indicators, best practices, self-assessment questions, and actionable insights to help your committee excel in its role. 3️⃣ Conclusion: Elevate your organization's audit and risk assurance functions with this practical and insightful tool. Download now to ensure your committee is operating at peak effectiveness and contributing to robust governance and risk management. #audit #committee #risk #management #infosec #cybersecurity #informationsecurity #isms #information #data #security #governance #checklist #metrix #effectiveness

79

2 Comments

🔍 Unveiling NIST CSF v2.0 Audit Checklist - Part 5: Respond (RS) & Recover (RC) 🔍 Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance, & join our exclusive infosec group for early access to creative infosec content PS: Infosec Community Link shared in Comments Section 1️⃣ Introduction to the Document: Delve into the final stages of the NIST CSF v2.0 framework with our latest checklist, focused on the crucial Respond (RS) and Recover (RC) functions. 2️⃣ What's in the Document: This part of the checklist offers detailed guidance on how to effectively manage and recover from cybersecurity incidents. It includes actionable steps, best practices, and key metrics to ensure your organization’s swift response and recovery. 3️⃣ Conclusion: Enhance your audit preparedness and resilience with this comprehensive guide. Download now to ensure your organization is ready to respond and recover from any security challenge. #NIST #NISTCSF #Respond #Recover #audit #checklist #infosec #cybersecurity #Governance #Risk #Compliance #incident #management #SOC #Disaster #recovery #Guidance #document #free

255

21 Comments

Dear Connections "Career Crossroads: Seeking Advice from you all As a cybersecurity professional with 24/7 operations experience, I'm feeling the strain of a lack of work-life balance. I'm now considering a move to a new domain, either within the cybersecurity sphere (GRC, compliance audits, data privacy, OT security) or a transition to the economic/financial sector. I'm eager to leverage my skills and experience in a new context, but I'm unsure which path to take. If you've made a similar career pivot or have expertise in these areas, I'd love to hear your thoughts! How can I best prepare for this transition? What skills should I focus on developing? What are the most in-demand skills in these new domains? Share your advice, experiences, and insights in the comments below! Let's explore new possibilities together! #cybersecurity #careeradvice #transition #economics #finance

4

From Aadhaar to Satyam: The CIA Triad in Action 🔐🔍🕒 The CIA triad—Confidentiality, Integrity, Availability—is vital for data security. Here’s how real-life incidents underscore its importance: 🔹Confidentiality: Aadhaar Data Breach (2018) Exposed personal data of over a billion citizens. Preventive measures: 🔒 encryption, 🛡️ access controls, 📂 compartmentalization. 🔹Integrity: Pegasus Spyware Scandal (2021) Compromised data integrity. Solutions: ✅ checksums, 📝 audit trails, 📀 redundancy. 🔹Availability: COVID-19 IT Service Impact (2020-2021) Highlighted the need for robust IT infrastructure. Key actions: 🌐 redundant systems, 📋 disaster recovery plans, 🔧 regular maintenance. 🟦 Satyam Scandal (2009): Showcased the need for rigorous audits and transparency to ensure data integrity. 🔸For more insights, read https://lnkd.in/dQgGPYy6 🔸For security consultations and more information, reach out to Redfox Security - Penetration Testing Services #InfoSec #CIA #DataProtection #AadhaarBreach #PegasusScandal #COVID19 #SatyamScandal #CyberSecurity #ITSecurity #RedfoxSecurity

15

Cybersecurity Executive Brief: Snowflake Hacker Arrested in Canada, Google Discovers Zero Day with AI    Snowflake Hacker Arrested in Canada Canadian authorities have arrested Alexander "Connor" Moucka, suspected of orchestrating a series of data breaches targeting over 165 companies through vulnerabilities in Snowflake's cloud storage services. Operating under aliases like "Judische" and "Waifu," Moucka allegedly accessed sensitive data from major firms, including AT&T and Ticketmaster, leading to significant disruptions and financial losses. His arrest follows extensive investigations by cybersecurity experts and international law enforcement, highlighting the growing threat of cyberattacks on cloud-based infrastructures.    More reading:  https://lnkd.in/esP-JAkd  https://lnkd.in/ePe_hKGQ    Google Discovers Zero Day with AI Google's Big Sleep AI agent has identified a critical memory-safety vulnerability in SQLite, a widely used open-source database engine. This marks the first instance of an AI system autonomously discovering such a flaw in real-world software. The vulnerability, a stack buffer underflow, was promptly reported to SQLite developers and patched before any public release, ensuring users remained unaffected. This achievement underscores the potential of AI in proactively identifying and mitigating software vulnerabilities, enhancing cybersecurity defenses. More reading:  https://lnkd.in/e673HVem    Sophos Pacific Rim Report: https://lnkd.in/emy4-Jm8 

18

2 Comments

Why Data Loss Prevention (DLP) remains a Gray Area: Insights from a Conversation Last week, during an interesting discussion with my friend (Prashanth SrinivasaRaghavan) about data security practices, the topic of Data Loss Prevention (DLP) came up. As we delved deeper, it became clear that DLP is still a gray area for many security professionals and auditors. This conversation inspired me to create a presentation exploring the challenges and complexities surrounding DLP implementation. In today’s digital landscape, safeguarding sensitive information is paramount. The prevention of data loss incidents directly impacts an organization’s financial well-being and customer trust, extending to even compliance requirements. Enter, Data Loss Prevention - a critical mechanism that identifies and prevents unauthorized sharing, transfer, or misuse of sensitive data. DLP acts like a security guardian for your organization’s valuable information. It operates behind the scenes, tirelessly monitoring data flows and enforcing policies to keep your data safe. Despite its importance, DLP remains a gray area. Why? Because its scope and interpretation can vary significantly from one professional to another. What one expert views as a violation might seem harmless to someone else. These subtle differences of perspectives create challenges for implementation and enforcement of DLP solutions. It's crucial to have open discussions and share perspectives to address these gray areas effectively. I invite you all to share your thoughts and experiences regarding DLP challenges and best practices. Have you encountered DLP challenges? What strategies have worked for you? Let’s build a stronger defense against data loss together. #DataSecurity #DataLossPrevention #DLP #DataProtection #GRC #CyberSecurity #InformationSecurity #InfoSec

114

11 Comments

Demystifying Governance: A Simple, example to understand better Prabh Nair to the community of infosec #CISSP #CyberSecurity #ITGovernance #InfoSec #Governance #RiskManagement #Compliance #CyberSecurityExam #InfoSecCommunity #CISSPPrep #SecurityGovernance

74

"Is your organization prepared to face a Business Email Compromise attack?" Arm yourself with our comprehensive BEC Incident Response Playbook! Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance, & join our exclusive infosec group for early access to creative infosec content PS: Infosec Community Link shared in Comments Section In this Business Email Compromise (BEC) Incident Response Playbook – your ultimate guide to detecting, containing, and recovering from sophisticated email-based attacks. This playbook is designed for both tabletop exercises and real-world incident response, Don't wait for an attack to test your readiness – download our playbook now and stay one step ahead of cybercriminals! Credits - Ministry of Security #cybersecurity #incident #response #business #email #compromise #playbook #free #download #guide #handbook #infosec #informationsecurity #ISMS #Data #protection

63

3 Comments

Testing a company's internal security isn't a new concept, but it has become extremely important in today's digital landscape driven by #cloud environments and #AI tools. This recent article in Canadian Security Magazine does a great job of outlining how exactly offensive security, like #pentesting, can help organizations put their security to the test and identify potential vulnerabilities: https://spr.ly/6040dqdOG #IWorkAtBell

1

The Rising Threat of Business Email Compromise (BEC) In today’s fast-paced digital landscape, Business Email Compromise (BEC) continues to be one of the most devastating cybersecurity threats organizations face. Hackers use deceptive tactics to impersonate executives or trusted partners, tricking employees into transferring funds or sharing sensitive information. 🔍 Key Facts: ✔️BEC attacks caused losses of over $50 billion globally between 2016 and 2023 (according to the FBI). ✔️Attackers often exploit weak email security configurations, untrained employees, or poorly implemented controls. ✔️Small- and medium-sized businesses are increasingly being targeted alongside large enterprises. ▪️What can you do? ✔️Enable Multi-Factor Authentication (MFA): Protect email accounts with an extra layer of security. ✔️Educate Your Team: Conduct regular training to recognize phishing attempts and unusual email requests. ✔️Verify Requests: Always confirm wire transfer or sensitive data requests through a secondary communication channel. ✔️Implement DMARC, SPF, and DKIM: Strengthen your domain’s email security to reduce spoofing risks. ✔️Monitor and Respond: Deploy tools to detect and respond to unusual account behaviors in real time. Risk management is not just a process; it’s a culture we must embrace to protect our organizations from these growing threats. By staying informed and proactive, we can collectively reduce the impact of such attacks. #Cybersecurity #RiskManagement #BEC #SecurityAwareness #InformationSecurity

7

Does ZTA reduce attack surface or not?   Numerous sources say a Zero Trust Architecture (ZTA) reduces attack surface because it has more rigorous controls than legacy architectures do. E.g.: “Least privilege means that users and devices are only granted the permissions they need to perform their tasks. This helps reduce the attack surface and makes it more difficult for attackers to gain access to sensitive data.” https://lnkd.in/eRqQnUja   OK, I agree that stronger implementation of least privilege makes penetration harder but the surface that ZTA protects is still there. In fact, since ZTA has its own elements [policy engine, administrator, and enforcement point(s)] it has MORE surface to attack.   To my way of thinking, ZTA did not reduce the attack surface at all.   What are people’s thoughts?

5

1 Comment

🔒 Taking Cybersecurity Seriously: A Call to Action for British Columbia and Beyond 🔒 In light of recent cybersecurity incidents affecting both BC government's network and private businesses like London Drugs, it's crucial for us to recognize the ever-growing importance of cybersecurity in today's digital landscape. Premier David Eby's acknowledgment of these incidents and the proactive steps being taken to address them highlight the seriousness with which British Columbia is approaching this issue. From working with the Canadian Centre for Cyber Security to implementing safety measures, the government is prioritizing the protection of sensitive information. The concerns raised by experts regarding the potential ramifications of these breaches remind us of the vast amount of sensitive data held by government agencies and businesses alike. Collaboration, transparency, and a commitment to robust cybersecurity measures are paramount in safeguarding against cyber threats. Let's continue to prioritize cybersecurity, not just in British Columbia, but across all sectors and regions. Together, we can build a more resilient digital infrastructure and protect the integrity of our data and networks. #Cybersecurity #DataProtection #DigitalSecurity #BCGovernment #LondonDrugs #CyberThreats #Collaboration #Transparency #StayVigilant 💻🔒 https://lnkd.in/gDRZpBCQ

6