Charles Wong

#DORA on the Horizon: Day (15/30)   Let’s jump into the 2nd pillar which is ICT related Incident Reporting and discuss the high level requirements from the regulation (detailed requirements are in the Technical Standards). Refer article 17-21 of the DORA regulation text  https://lnkd.in/dggJEMsq 𝟭. 𝗔𝗿𝘁𝗶𝗰𝗹𝗲 𝟭𝟳: 𝗜𝗖𝗧-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗽𝗿𝗼𝗰𝗲𝘀𝘀 • This section establishes requirements for financial entities regarding ICT-related incident management. Entities must define and implement an ICT-related incident management policy, procedure, roles and responsibilities etc. • Major incidents must be reported to senior management and the management body, with explanations of impact, response, and additional controls.   𝟮. 𝗔𝗿𝘁𝗶𝗰𝗹𝗲 𝟭𝟴: 𝗖𝗹𝗮𝘀𝘀𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗜𝗖𝗧-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 𝗮𝗻𝗱 𝗰𝘆𝗯𝗲𝗿 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 • This section lists down the 6 major criteria for classification of incidents. Along with this, the regulation lists criteria for classifying cyber threats as significant.  • European Supervisory Authorities (ESAs) are required to create a technical standard specifying the materiality thresholds for each criterion to classify incidents and specifying materiality thresholds for each criterion to classify cyber threats. We will discuss this in great detail tomorrow as part of RTS on Criteria for the Classification of ICT-Related Incidents, it is very specific and interesting. 𝟯. 𝗔𝗿𝘁𝗶𝗰𝗹𝗲 𝟭𝟵: 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗼𝗳 𝗺𝗮𝗷𝗼𝗿 𝗜𝗖𝗧-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 𝗮𝗻𝗱 𝘃𝗼𝗹𝘂𝗻𝘁𝗮𝗿𝘆 𝗻𝗼𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝘀𝗶𝗴𝗻𝗶𝗳𝗶𝗰𝗮𝗻𝘁 𝗰𝘆𝗯𝗲𝗿 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 • Here the regulation explains the types of reports to be submitted in case of major incidents and significant cyber threats. There are 𝟯 types of reports for reporting major incidents: an initial notification, an intermediate report and a final report.  • Keeping the national laws in mind, entities can outsource the incident reporting obligations. However, the entity remains fully responsible for the fulfilment of incident reporting requirements. 𝟰. 𝗔𝗿𝘁𝗶𝗰𝗹𝗲 𝟮𝟬: 𝗛𝗮𝗿𝗺𝗼𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗰𝗼𝗻𝘁𝗲𝗻𝘁 𝗮𝗻𝗱 𝘁𝗲𝗺𝗽𝗹𝗮𝘁𝗲𝘀 • Here the regulation asks ESAs to create reporting templates so that entities can provide information to ESAs in case of major incidents and significant cyber threats. We will discuss the format in detail when we get to technical standard. The timelines are also clarified here 𝟱. 𝗔𝗿𝘁𝗶𝗰𝗹𝗲 𝟮𝟭, 𝟮𝟮: 𝗖𝗲𝗻𝘁𝗿𝗮𝗹𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗼𝗳 𝗺𝗮𝗷𝗼𝗿 𝗜𝗖𝗧-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 • No requirements as such for financial entities. Here regulation is providing guidance to ESAs on further centralisation of incident reporting through the establishment of a single EU Hub

7

Data protection officer responsibilities reach beyond traditional IT, legal and security roles to provide a holistic view of data privacy, security and education. Join our panel discussion 1 and learn from our data privacy expert - Vincent Ng at 中港网络安全协会 HKCNSA Symposium on 26th June! #hkcnsasymposium2024

25

Had the privilege of sharing with Senior Minister of State for the Ministry of Communication and Information & Ministry of Health, Dr Janil Puthucheary and industry leaders how SailPoint, the Leader in Identity Security, is leveraging AI to power our intelligent, unified Identity Security Cloud Platform, helping organizations manage and secure real-time access to critical data and applications for all enterprise identities. https://slpnt.co/45Tkj8R #SailPoint #IdentityManagement #IdentitySecurity #DigitalTransformation #ZeroTrustSecurity #Cybersecurity #DigitalIdentities #AI #Automation #NonEmployees #MachineIdentities #JoinerMoverLeaver #IdentityLifecycle #NonEmployeeRiskManagement #AccessRiskManagement #sailpointatlas #MaintainCompliance #ImproveEfficiency #ImproveSecurityPosture #NonEmployeeManagement #ThirdPartyRisk #3rdPartyRisk #DataAccessSecurity #adaptiveIdentity

29

According to the first Singapore Cybersecurity Health Report by the Cyber Security Agency of Singapore (CSA), over 80% of the 2,036 organisations surveyed in 2023 faced cyber security incidents, with 99% experiencing negative impacts such as business disruptions, data loss, and reputational damage. The rapid digitisation of Singapore’s economy has increased its vulnerability to sophisticated cyber attacks and scams, resulting in substantial financial losses. To combat these threats, the report recommends enhancing public awareness and education programs, and strengthening cybersecurity frameworks and regulations. Key recommendations include conducting regular online cyber security and anti-scam education courses and implementing the CSA’s Cyber Essentials by a set deadline to ensure organisations are well-equipped to handle cyber threats. https://lnkd.in/eP25kGzU Cyber risk must be addressed directly, utilising comprehensive coverage and holistic cyber risk management solutions. For this reason, Pandamatics cyber underwriters work alongside Blackpanda cyber security professionals, bringing together the best of international experience and local fieldwork to create bespoke solutions for APAC clients. Learn more here: https://lnkd.in/gRU7FRzU

5

New Report on Cyber Recruitment Difficulty reveals 58% Asia-Pacific Firms face difficulty recruiting Cyber Full Report=  https://lnkd.in/gG_tk_fH Bravo all to Fortinet including DAVO LUCIEN - Consultant en Cybersécurité for their great work on #CyberSecurity

2

In our continuing #cybersecurity series for Check Point Software, I am looking forward to a rare opportunity to learn from global thought leaders Dr Dorit Dor, Global CTO, and Moti Sagey מוטי שגיא, Global Chief Evangelist about strengthening digital trust in the #BFSI sector. Finance is highly regulated around the world even in developing countries. That puts the #CISO teams under a lot of pressure with changing regulation. But is simply chasing compliance sufficient? How can BFSI companies be proactive with a focus on their customers' experience in mind? Let's learn together with Dr Dorit and Moti! Do register at the link below. Frost & Sullivan Ruma B. David Tiong Vanessa Ng https://lnkd.in/gUzAR7dk

16

2 Comments

\\Enhancing Cybersecurity with Preventative Strategies\\ Number of well-known organizations and corporates in Hong Kong fell victim to cyber attacks recently. Hong Kong police recorded 18,758 cases of cybersecurity attacks in the first quarter of 2024, with 8,592 cases (45.8 percent) related to phishing, and 5,482 cases (29.3 percent) involving malicious software. Cybersecurity is vital as it safeguards data across all categories, including confidential business information, personal information, and intellectual property, from theft and damage. IaaS, a powerful cloud platform, collects vast public data from cyberspace and transforms it into actionable intelligence for intellectual property protection, cybercrime investigation, and strategic analysis, enabling organizations to stay informed, secure, and competitive. IaaS is the proprietary product of C&T subsidiary CISC Limited, a research spinoff company carrying the technology and innovation from the Center for Information Security and Cryptography (CISC), Engineering Faculty of the University of Hong Kong (HKU). Empower your organization's cybersecurity and stay ahead of evolving threats. Start your intelligence-driven cybersecurity journey with IaaS today! Know more about IaaS: https://lnkd.in/gk4MqvXA #Cybersecurity #IaaS #CyberAttack #DataBreach #CTIL

8

Cyber Risks Associated with GenAI - Monetary Authority of Singapore (MAS) This paper aims to raise FIs’ awareness by providing an overview of key #cyber and #technology related threats arising from GenAI, the associated risk implications, and some of the mitigation measures that FIs could take to address the #risks. Specifically, section 2 details how GenAI can be used by threat actors, in the form of #deepfakes and GenAI-enabled phishing, as well as malware generation and enhancement. Section 3 covers the threats and risks on GenAI deployments, namely, #unauthorised #information disclosure and #data #leakage, as well as GenAI model and output manipulation. 🌐 GenAI-Enabled #Threats - #Deepfakes and GenAI-Enabled #Phishing - #Malware Generation and Enhancement 🌐 Threats Targeting GenAI Deployment - #DataLeakage from GenAI #Deployment - #GenAI Model and Output #Manipulation Centro de Investigación de Ciberseguridad IoT - IIoT

144

1 Comment

AWS Blueprint for Ransomware Defense - Amazon Web Services (AWS) ☁ Know your environment (NIST CSF – #Identify) ☁ Secure configurations (NIST CSF – #Protect) ☁ Account and #access #management (#NIST CSF – Protect) ☁ Vulnerability management planning (NIST CSF – Protect) ☁ Data recovery and #incident #response (NIST CSF – #Respond) ☁ #Malware #defense (NIST CSF – #Protect) ☁ #Security #awareness and skills training (NIST CSF – Protect) ☁ #Data #recovery and incident response (NIST CSF – #Recover) Centro de Investigación de Ciberseguridad IoT - IIoT

38

2 Comments

Our CEO, Shane Chiang, was recently featured in The Straits Times, where he highlighted the importance of structured cybersecurity frameworks and shared examples of common vulnerabilities organizations face. As quoted: "Another vendor, Momentum Z, takes firms calling on CISOaaS through a three-pronged assessment of employees’ cyber-security basics, company processes and policies, and cyber-security infrastructure such as firewall, antivirus, backup data use and end-point security. CEO Shane Chiang said he has had clients that have not changed passwords for six years, or who had been granting external vendors remote access to their network with no inkling. “Clients are often surprised to learn the vulnerabilities in their systems, which reinforces the importance of having a Ciso to bring structure and foresight into cyber security.” https://lnkd.in/gmh2G8Mr #cybersecurity Cyber Security Agency of Singapore (CSA) #cyberattack

2

APIs are a growing cybersecurity risk, and basic protection isn’t enough. Gartner’s Market Guide for API Protection reveals key insights on securing APIs, from advanced tools to market trends. Learn more by downloading the guide and stay ahead of emerging threats. https://lnkd.in/gSXbTVNZ #Cybersecurity #APIProtection #GartnerInsights #CloudSecurity #APISecurity #TechInnovation #CyberThreats #WAAP #CybersecAsia

7

1 Comment

𝗔𝗰𝗰𝗲𝗽𝘁𝗮𝗯𝗹𝗲 𝗨𝘀𝗮𝗴𝗲 𝗣𝗼𝗹𝗶𝗰𝘆: Free Download (As per ISO 27001: 2022) Credit : Ministry of Security Dont forget to follow Cyber Security Champion for more such insightful contents. 🔒 𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻: In today's digital age, ensuring responsible and secure use of IT resources is critical for protecting an organization's data, reputation, and operations. Our Acceptable Usage Policy (AUP) outlines the expectations for employees, contractors, and third-party users when accessing and utilizing company systems, data, and networks. 📄 𝗪𝗵𝗮𝘁’𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁?: This document covers: 1. Permissible and prohibited activities for the use of company IT systems. 2.Guidelines for using email, internet, social media, and personal devices at work. 3. Security practices to follow, such as protecting passwords and avoiding malware. 4. The consequences of policy violations to maintain accountability. ✅ 𝗖𝗼𝗻𝗰𝗹𝘂𝘀𝗶𝗼𝗻: The Acceptable Usage Policy helps foster a secure, productive environment for all team members by defining clear boundaries and best practices. By adhering to these guidelines, employees can protect company assets while maximizing their own efficiency and maintaining trust. Have questions or insights on IT usage policies? Drop them in the comments, and let's discuss them! 👇 #acceptable #use #policy #security #governance #risk #compliance #infosec #informationsecurity #cybersecurity #ISO27001 #ISMS #guide

59

2 Comments

🚧 Beware of Cyber Security Threats: Enterprise Browsers are the Next Investment Strategy 💻 ⁉ 📈 Hong Kong has seen a surge in cybersecurity incidents, with a 50% increase in system intrusions in 2023, leading to HK$2.1 million in losses according to the news of HKET yesterday. The rise of AI-driven threats like deepfakes necessitates a focus on identity security — ensuring only authorized users have access. Traditional web browsers pose a significant risk, often overlooked in the identity security framework. This calls for Hong Kong businesses to invest in enterprise browsers, which are designed with identity security at their core, addressing three critical issues: ♦ Enhanced SaaS Security... ♦ Seamless User Experience... ♦ Centralized Security Control... 📲 Scan Code to know how to fortify their network and identity security while maintaining user convenience and regulatory compliance for businesses with AISecurius International from the comprehensive defense solutions. 🤝💡 Contact Cloud Ocean Technology Company - Hong Kong Sole Distributor 👉 Get a quote and FREE trial now! 📩 Inquiry: [email protected] 📞 Tel: +852 2260 7143 #AISecurius #CloudOceanTech #frauddetection #AI #enterprisebrowser #antifraud #SaasSecuirty #CriminalFraud #RealtimeFraudDetection #MobileAppSecurity #AntiAI 

2

1 Comment

🚨Alert: The Rise of Deepfake Scams🚨 The recent deepfake heist in Hong Kong, resulting in a loss of approximately $26 million, underscores a significant shift in cyber threats. Fraudsters used deepfake technology to impersonate senior executives in a video call, deceiving an employee into making substantial financial transfers. Hong Kong Police Says: https://lnkd.in/ehNsQqCH At TerraEagle, we're ahead of these emerging challenges. Our advanced AI-driven security solutions are designed to identify and mitigate such sophisticated threats. We incorporate: - Real-time anomaly detection that can flag unusual patterns of behavior or requests, potentially indicative of deepfake impersonation. - Enhanced authentication protocols that go beyond traditional verification methods to ensure the digital identity of individuals in critical communications. - Employee training and awareness program tailored to help staff recognize and respond to signs of AI-facilitated fraud. In the wake of evolving AI threats, partnering with TerraEagle means securing your digital interactions against the most sophisticated attacks. Stay one step ahead of cyber criminals with our cutting-edge technologies. Connect with us to learn how our solutions can protect your organization from deepfake scams and other cyber threats. #CyberSecurity #Deepfake #AI #FraudPrevention #DigitalIdentity #HongKongScam #TerraEagle Aditya Champion Amit

7

1 Comment

According to the Singapore Cybersecurity Health Report 2023 launched by CSA, "8 in 10 organisations in Singapore encounter at least one cybersecurity incident in a year. Almost all of these organisations that encounter cybersecurity incidents suffer a negative business impact," shared Reynard Neo, Senior Consultant at the Cyber Security Agency, in his presentation. Here's a #throwback video to Ricoh Singapore's 16 April 2024 Cybersecurity event featuring the Cyber Security Agency. Check it out now at https://lnkd.in/g_hsMazj If you want to learn how to protect your organisation against cyberattacks, contact us at [email protected]. Let us be the first line of defence against cyber threats by building your organisation's cyber resilience. #CSASingapore #RicohSg #Cybersecurity #TrendMicro #CiscoMeraki #RansomWare

19

📕 Guide of Responsible Use of #Biometric Data in Security Applications by Personal Data Protection Commission (PDPC) and Security Association Singapore (SAS) Guide is intended to help organisations to use security cameras and biometric recognition systems responsibly and safeguard individuals’ biometric data where it is collected, used or disclosed. #dataprotection #personaldata

144

5 Comments