Rob Schuurman

Hi BCM, Resilience Professionals In April 2024, there were 35 mentionable BCM-related incidents and 10 recalls/safetywarnings in the Netherlands. I made also a page with headlines. Some organisations had to activate their Safety & Health plan, other their crisis management and crisis communication plan maybe their recovery plans. Perhaps organisation had to activate the full BCP containing the 3 mentioned plans. What if when they did'nt have any plan? Be prepared for the futere and mitigate BCM-related incidents with an up to date and tested BCP.  You it know practice makes perfect. https://lnkd.in/e9q3FBKC

1

Always good to learn more about complex matters. Martin and Richard have gathered a lot of knowledge on the subject. Interesting session!

1

ISO 27001:2022 Introduction for Vrije Universiteit Amsterdam (VU Amsterdam) IT Audit students Last week I had the privilege to deliver a lecture at VU IT Audit, Compliance and Advisory (ITACA) for 2nd year students and impart ISMS implementation and audit knowledge for these upcoming IT auditors. ISMS provides a strong foundation to learn basics of Information Security and we discussed about some of the common pitfalls and mistakes organizations make while implementing and getting audited against ISO 27001:2022... here are the top 5 key messages that were discussed in the class: 1. ISMS Context is extremely important. If you get this wrong, you end up building a wrong foundation for your information security programme. 2. Know your Stakeholders. As an auditor I often ask: "Who are you implementing ISMS for" and many organizations cannot answer this correctly. 3. Don't follow a BIG BANG approach, you are setting yourself up for a failure (with a large scope) to begin with. Keep your ISMS scope short and simple for the first iterations and expand it as you mature. 4. Its not Continuous improvement but Continual improvement. Hence follow a Start-Stop approach than thinking of a never ending tedious ISMS operational cycle. 5. Internal Audits (third line of defense) and external audits are extremely valuable in identifying gaps in your ISMS programme. Hence encourage your auditors to explore more and provide positive and not so positive findings. A good audit is not a clean report but one that provides a lot of findings and recommendations. Reza Khalesi it was a pleasure delivering this session together with you. Request you to please provide your top 5 key take aways from the session. Abbas ShahimNathalie Steenvoorden MSc REAicha Rahali thanks for inviting me to be a guest speaker in your IT Audit course.

196

6 commentaren

Threat modeling in Dutch organizations involves systematically identifying and assessing potential threats to an organization’s assets and operations, with the goal of improving overall security posture. Dutch organizations employ threat modeling to understand potential vulnerabilities in their systems and processes, considering specific national and industry-related risks. By analyzing various threat vectors, such as cyber-attacks, insider threats, and physical security breaches, organizations can prioritize their security measures and implement targeted defenses. This proactive approach helps in designing resilient systems that align with Dutch regulations and standards, ensuring robust protection against evolving threats and enhancing overall risk management strategies.

6

Coming Soon. A series of bitesize presentations to show how to create a business focussed Security Strategy. It will show you what to do in the first 30, 60, 90 days of joining an organisation, what to include in your strategy, how to plan, prepare and present it to the Board and how to report progress through implementation and beyond.

42

5 commentaren

Stay ahead in the evolving world of cyber risk! Download our Cybersecurity Resilience 2024 report for a comprehensive analysis and key insights. Proud of so many experts colleagues at Allianz Commercial, who put together such an essential report to support to safeguarding the future. #Cybersecurity #RiskManagement #Resilience #CyberResilience #2024Insights #ExpertCollaboration #FutureReady #allianz

21

1 commentaar

Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus The Dutch National Police, along with international partners, have announced the disruption of the infrastructure powering two information stealers tracked as RedLine and MetaStealer. The takedown, which took place on October 28, 2024, is the result of an international law enforcement task force codenamed Operation Magnus that involved authorities from the U.S., the U.K., Belgium, Portugal, and Australia. urojust, in a statement published today, said the operation led to the shut down of three servers in the Netherlands and the confiscation of two domains. In total, over 1,200 servers in dozens of countries are estimated to have been used to run the malware. As part of the efforts, one administrator has been charged by the U.S. authorities and two people have been arrested by the Belgian police, the Politie said, adding one of them has since been released, while the other remains in custody. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

1

I’m thrilled to be back on stage! This time, I’ll be discussing the Risks of AI in the ever-evolving landscape of cybersecurity, exploring both the blue and red oceans. Expect an engaging presentation filled with live demos and interactive discussions. A big thank you to ISACA NL Chapter for the invitation and to Northwave Cyber Security for investing in AI to enhance our services and deliver even greater value to our clients. QUESTION: What risks would you like me to talk about?

17

1 commentaar

𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐀𝐜𝐭 (𝐃𝐎𝐑𝐀) The Digital Operational Resilience Act (DORA) is an EU regulation focused on strengthening the ICT (information and communication technology) security of financial institutions to bolster resilience across the European financial sector. It entered effect on January 16, 2023, with enforcement starting on January 17, 2025. 𝐆𝐨𝐚𝐥: DORA creates a comprehensive ICT risk management framework for the EU financial sector. Banks, insurance companies, and investment firms must implement measures to identify, assess, and mitigate ICT risks. 𝐇𝐚𝐫𝐦𝐨𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧: DORA replaces varied regulations across EU member states with a uniform set of rules, ensuring consistent ICT security standards. 𝐒𝐜𝐨𝐩𝐞: DORA applies to numerous financial entities and critical third-party service providers (like cloud platforms and data analytics providers) that offer ICT-related services. 𝐊𝐞𝐲 𝐑𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭𝐬: 𝐈𝐂𝐓 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐅𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤: Institutions must establish a framework to pinpoint and manage potential ICT threats. 𝐈𝐂𝐓 𝐓𝐡𝐢𝐫𝐝-𝐏𝐚𝐫𝐭𝐲 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: Assess and manage risks associated with third-party ICT vendors. 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐓𝐞𝐬𝐭𝐢𝐧𝐠: Regular testing to ensure preparedness for ICT disruptions. 𝐈𝐂𝐓-𝐑𝐞𝐥𝐚𝐭𝐞𝐝 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: Institutions need a plan for reporting and handling ICT-related incidents. 𝐒𝐮𝐩𝐞𝐫𝐯𝐢𝐬𝐨𝐫𝐲 𝐎𝐯𝐞𝐫𝐬𝐢𝐠𝐡𝐭: Authorities in EU member states will oversee implementation and enforcement. 𝐈𝐦𝐩𝐚𝐜𝐭: DORA aims to significantly enhance the cybersecurity of the European financial sector, promoting greater resilience against digital threats and safeguarding consumers and the financial system. Thank You PECB, Thank You 🔐 Peter GEELEN. Community, as usual, look out for my PECB Digital Operational Resilience Act (DORA) Lead Manager Certificate!!!

105

11 commentaren

ISMS, PDCA, SoA, internal audit, management review, clause, annex A controls, context of the organization, risk management, GRC, desire, demanding, responsibilities, commitments, support, awareness, assets, vulnerabilities, threats, etc. All are essential for creating a healthy management system and promoting continual improvement. These elements help organizations identify and manage risks, ensure compliance with regulations and standards, and maintain the security and integrity of their operations. Last week I had the opportunity of co-presenting with Jatin Sehgal on Management Systems and ISO 27001:2022 for VU IT Audit, Compliance and Advisory (ITACA) students, and sharing our knowledge on ISMS implementation and audit with these future talented leaders. Very an interaction session and interesting one .We discussed some of the typical errors and oversights that companies encounter while implementing or undergoing audits for this standard based on our experiences. Here are the top five crucial points that we discussed during the session: 1- It all begins with the question, "Why do I want to be certified, or why do I need this certification?" 2- ISO is not a framework but a standard that provides a framework for managing your risks. 3- Prepare your people, processes, and technology throughout your organization to face technology-based risks and other threats. 4- Risk Assessment and Management is at the heart of an ISMS. 5- The importance of understanding ISMS (especially clauses) for business by creating proper awareness helps organizations and interested parties to gain trust. Abbas Shahim Nathalie Steenvoorden MSc RE & Aicha Rahali Thank you for having us and for the fantastic hospitality. #ITACA #ISO27001 #ISMS #Managmentsystem

60

8 commentaren

While the Council of the European Union aims at providing guidance and setting the principles towards building a more cybersecure and more resilient Union, the role of enterprises become more vital. This is an immense opportunity towards a cybersecure society! #cybersecurity #secureeurope #regulation #cyberstrategy

11

Interested in Cybersecurity Compliance/Standards in the EU region?? Make sure you grab a bit on the below GDPR: Data protection regulations of EU region giving more stress on information privacy. Covers all core aspects on how data is identified, collected and processed. Makes clear demarcation on data owner, processors, controllers roles. NIS: Stands for Network and Information Systems with the latest version 2. This directive is a key item practiced in the EU region aimed at enhancing the cybersecurity posture among EU member states. They follow some key aspects or canons that forms the basis of any organization's cyber security stand. Aims to strengthen resilience against cyber threats and helps protect your digital infrastructure DORA: Digital Operational Resilience Act. Aims to enhance the IT security of mainly financial entities. Ensures operational resilience. Enhances on ICT risk management, third party risk amanagement TPRM, resileince testing and incidence reporting. CyClone: Cyber Crisis Liasion Organization NEtwork forms a cooperation network for EU member states national authorities in charge of CyberCrisis Management. Aims to collaborate and develop timely information sharing and situational awareness in CyberSecurity  👁

8

Happy to share that I am now certified in Cyber Risk Quantification (CRQ) by Open FAIR™ (Factor Analysis of Information Risk). If you manage a cyber security function, can you answer these questions? 1. What is the single most significant cyber security risk your organisation faces? 2. How much risk reduction did your organisation get from its most recent cyber security initiative? 3. If your organisation had to reduce security cost, what would you cut from the program and how much more risk would there be? "You can't manage what you can't measure. And you can't measure what you haven't clearly defined. FAIR helps you to clearly define cyber security risk." Jack Jones, Founder of FAIR and Chairman Emeritus of the FAIR Institute I look forward to collaborating with other professionals to share knowledge and experience on this topic. Please feel free to reach out to me! And as always in #securityriskmanagement: If you put (cyber) in brackets you could and should apply this model to your converged cyber-physical security risk management approach! https://lnkd.in/e6JmcjVK FAIR Institute #OpenFAIR #Certification #FAIR #Opengroup #CRQ #cyberriskquantification #Opengroup #cybersecurity #physicalsecurity #securityconvergence #SRQ #security #CISO #Dubai #UAE #MiddleEast

113

22 commentaren

'Per May 2024 per BZK SSC-ICT CISO-office it's advised to use https://signal.org/ instead of WhatsApp' 'Sirs, we Advise Partners and stakeholders in formal communications to inform regarding any relevant actionable future state opportunities, that are relevant for our business partners network updates and Secure and solid communications, to make use of signal #Secure and aware #Policy for °formal° #preferred messenger services, hereto subsequently go to app via your mobile device (Android or IOS) and install; ○●●●●●: Acts: 1. its not prohibited to make use of other chat functions or messenger services 2. we strongly recommend to use Signal for formal business communications for messenger purposes 3. our mobile numbers are same/same and always on #Availablity plus #Online 4. or via text message or e-mail. 5. °Sirs: "Sirs" in ways of work (wow) used gender neutral te NLSERVICES Technologie Ecology Steer 5a. eTrust Resilience Steer Technologie Ecology OT-OT NLSERVICES' Signal : https://signal.org/install NLSERVICES public announcement [email protected]

1

Boards are to lead by example, also in relation to Cyber Security

2

My week ending with a good vibration, another certificate renewal stays in my pocket - Microsoft Certified: Security Operations Analyst Associate. Big pleasure to refresh knowledge in my passions - Microsoft Cloud and Cyber Security Operations with Defenders and Sentinel. Thank you Microsoft, Microsoft Learn, Microsoft Security 💪 😎 ⚔ 🛡 🔒 #microsoft #microsoftazure #azurearchitect #microsoftcloud #microsoftsecurity #microsoftlearn #alwayslearning

16

Seize this opportunity to learn from industry experts and develop a risk management strategy that aligns with your business goals, securing the long-term success of your organization.

13

1 commentaar

🛑 𝗡𝗲𝘄 𝘁𝗼 𝘁𝗵𝗲 𝗷𝗼𝗯? 𝗬𝗼𝘂 𝗯𝗲𝘁𝘁𝗲𝗿 𝘄𝗮𝘁𝗰𝗵 𝗼𝘂𝘁 𝗳𝗼𝗿 [...] 𝗶𝗻 𝘁𝗵𝗲 𝗳𝗶𝗿𝘀𝘁 𝗱𝗮𝘆𝘀 & 𝘄𝗲𝗲𝗸𝘀! 🛑 What are the most common pitfalls for starting a new job in Information/Cyber Security? Are there things in the first days, weeks etc. that you should absolutely avoid doing? 😂 😇 #cybersecurity #informationsecurity #infosec #governance

1

1 commentaar