John Lauderdale

Sharing some insights from the recent ANAO audit on the security authorisation of ICT systems within the Department of Defence. The findings highlight crucial areas for improvement in our approach to cyber security, which is vital for safeguarding our national interests. Key Findings: - Partly Effective Arrangements: Defence's management of ICT systems security authorisations has been inconsistent, leading to delays and compliance issues. - Policy Deficiencies: Many policies are outdated or internally inconsistent, failing to align with current security requirements. - Defence’s arrangements for system authorisation have not been regularly reviewed and do not reflect current PSPF requirements. - Defence’s reporting did not comply with DSPF requirements, omitted key system authorisation data, and indicated a more optimistic outlook than was reflected in other Defence documentation. - Defence did not comply with the PSPF and DSPF system authorisation requirements for the five case studies examined in the audit. Lessons Learnt and Way Forward applying to all industries - Personal Perspective: 1. Continuous assessment and authorisation of our systems are paramount to ensure they operate securely. It’s not enough to treat these processes as a tick-and-flick exercise; we need ongoing management and active implementation. Establishing a proactive approach to security assessments is crucial to maintaining operational integrity and timely authorisation of systems. 2. We must maintain a central record of all systems because we cannot protect what we don't know about. This visibility is essential for effective risk management and safeguarding our operations. Knowledge is power in cybersecurity. 3. Policy Alignment is Essential: Regularly updating policies to reflect current security standards is vital. Consistency across all sections of the organisation ensures everyone is on the same page and reduces confusion. This alignment should also encompass all applicable laws, regulations and industry standards. 4. Continuous education and awareness for external/internal assessors and personnel is imperative. Cultivating a culture of awareness where employees are encouraged to follow processes, report suspicious activities and understanding their roles in maintaining security. 5. Communication and Collaboration is key to a unified posture for monitoring the status of system authorisations. I hope these insights help shape your security assessment and authorisation processes within your organisations. I’m keen to hear thoughts from others on this paper or more generally about system assessment and authorisations and how we could improve the current processes in place in industry. Your perspectives could contribute to refining our approaches and fostering a stronger security culture. #LessonsLearned #CyberSecurity #Defence #ContinuousImprovement #RiskManagement #Collaboration #CyberSecurity #SecurityAuthorisation #Securityfundamentals #Accountability

33

1 Comment

Building on the below insights from my post, I want to highlight how Home Affairs has digitised its process to ensure that relevant security controls are applied and kept up to date for its numerous ICT systems. This initiative is critical in helping the department meet its Protective Security Policy Framework (PSPF) and Essential Eight obligations. This is a great example of how lessons learned can be effectively implemented for maintaining a central record of all systems and continuous assessment/authorisation of our systems For more details - https://lnkd.in/gMGTkS7W.

1

I'm sharing a critical alert from the Singapore Cyber Emergency Response Team (SingCERT) regarding a phishing scam targeting the public. Scammers are impersonating officers from the Cyber Security Agency of Singapore (CSA) and the Police to trick victims into believing they are facing legal action. The Scam: * You receive a fraudulent email claiming a court order has been filed against your IP address due to illegal activities. * The email threatens legal proceedings if you don't respond within 24 hours. Don't Fall for It! Here's How to Spot the Scam: * CSA and SPF will never: * Ask you to transfer money. * Request your banking, SingPass, or CPF information. * Ask you to click on suspicious links. * Request you to download software or apps from unofficial sources. What to Do: * If you receive such an email: * Do not respond or follow any instructions. * Report the incident to SingCERT at [email protected] or SingCERT Incident Reporting Form. * Always verify the authenticity of emails: * Contact the agency directly using official channels (phone numbers or email addresses listed on their website). By staying vigilant and informed, we can protect ourselves from these cyber threats. Let's spread the word and keep our online community safe! #cybersecurity #phishing #onlinesafety #singcert https://lnkd.in/g5iPbvf4

58

Around 13% of scams analysed by the Cyber Security Agency of Singapore (CSA) in 2023 were likely generated by AI – indicating that scams are getting more convincing even as overall cyber threat numbers fell or remained constant, compared with 2022 figures. https://lnkd.in/g4DKz4D9

22

2 Comments

The post below has information around ISMS policies and how many are too many, etc. Must read. Thank you Chris Hall 🙏 However, for ppl who think policies are not required, Gary Hinson has presented a thought that is woven in a timeless wisdom. Thank you both 🙏 for your discussion gives us so much to think, brood, and learn from.

7

A recent case in Singapore underscores the critical importance of vigilant system access control. A former employee of NCS managed to illegally access the company's systems and delete 180 test servers, causing a staggering $678,000 in damages. This revenge-driven breach occurred because his login was not deactivated immediately upon termination, a mishap that allowed him months of unchecked access, resulting in significant financial and operational disruptions. Here’s what we can learn: Immediate Access Revocation: Always ensure that an employee’s access credentials are deactivated right after they leave the company. This should be an integral part of your offboarding protocol. Regular Access Audits: It’s crucial to periodically review who has access to specific data and systems. Even current employees should only access resources essential to their roles. Stringent Security Controls: Implement robust security measures like multi-factor authentication, which requires a verification code sent to another device. This adds layers of protection, making unauthorized access much harder. Continuous Monitoring and Updates: Always keep a vigilant eye on your systems and regularly update your security measures to align with the latest practices. Remember, overlooking small details can lead to significant losses. When was the last time you reviewed your access control measures? If it's been awhile, now is the time to act. Need assistance? My team is here to help. Send us a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eHrVbk54

1

Singapore updated its cyber security regulations, granting more power to its Cyber Security Agency (CSA) and expanding the definition of critical information infrastructure (CII) to include cloud infrastructure. The amendment requires CII operators to report cyber security incidents to the government and holds third-party and cloud providers accountable. Senior Minister Janil Puthucheary highlighted the need to adapt the 2018 Act to new technologies and business models to ensure CII remains secure. This move aligns with broader regional efforts, such as Malaysia's new Cyber Security Bill and a trilateral information-sharing agreement among Japan, the Philippines, and the US. The updated regulations, which have broad support, aim to address growing cyber threats and the evolving digital landscape. The amendment categorises businesses into five types, imposing requirements like audits and incident reporting, potentially increasing compliance costs. As Singapore remains a target for cyber attacks, the focus on cultivating a cyber-literate population and securing stakeholder buy-in is crucial for future resilience.

7

1 Comment

𝗔 𝗻𝗲𝘄 𝗽𝗮𝗿𝗮𝗱𝗶𝗴𝗺 𝗳𝗼𝗿 𝗰𝘆𝗯𝗲𝗿 𝗱𝗲𝗳𝗲𝗻𝘀𝗲?     I have been posting about the past sponsors of the PCI Asia Pacific Community Meeting (APCM), namely, LGMS Berhad and ControlCase.    This post will cover an interesting report by our Bronze Sponsor, SISA and it was co-authored with the Data Security Council of India (DSCI), an industry body that protects data in India by driving cybersecurity and privacy best practices, standards and initiatives.    The author(s) captured my attention as soon as I started reading by highlighting:   “𝘈𝘭𝘦𝘳𝘵 𝘰𝘷𝘦𝘳𝘭𝘰𝘢𝘥 𝘵𝘳𝘢𝘯𝘴𝘧𝘰𝘳𝘮𝘴 𝘢 𝘸𝘦𝘭𝘭-𝘪𝘯𝘵𝘦𝘯𝘵𝘪𝘰𝘯𝘦𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘴𝘵𝘳𝘢𝘵𝘦𝘨𝘺 𝘪𝘯𝘵𝘰 𝘢 𝘴𝘦𝘭𝘧-𝘥𝘦𝘧𝘦𝘢𝘵𝘪𝘯𝘨 𝘰𝘯𝘦.”   This has been one of my focus areas and related to PCI DSS Requirement 10 i.e. “Log and Monitor All Access to System Components and Cardholder Data”.  With more systems getting deployed, it can only get more complex with more logs and alerts generated. This is overwhelming the cybersecurity heroes tasked to detect and defend against attacks in the midst of an avalanche of false positive alerts.  SISA quoted from Statista that organizations take around 204 days to detect a data breach!   Since the publication of PCI DSS v4.0, a new requirement has been added for organizations to use automated mechanisms to perform audit log reviews. This is a future dated requirement and will be effective from 1 April 2025, however you are strongly encouraged to consider adopting this requirement soon given current threats.   Back to the document co-authored by SISA... it introduced me to a new acronym, MXDR (Managed Extended Detection and Response).  To over-simplify, this approach provides a comprehensive view and control across an organization with better identification of threats, an ability to respond more effectively and most importantly, the ability to perform monitoring continuously.  Amazing!   Get the report from the SISA website: https://lnkd.in/gpbfWHA8   SISA will be a sponsor and exhibition partner at the North America CM in Boston and they will be back as an exhibition partner at the APCM in Hanoi in November!  Thank you Dharshan Shanthamurthy and team for your support!  This will be a good opportunity to find out more about MXDR from the SISA experts who will be present at the events.    Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. If you have an interest in payments, cybersecurity, compliance, risk management and technology, do consider joining us in either Boston (Sep), Barcelona (Oct) or Hanoi (Nov).  Find out more at the PCI Events link below or drop me a message: https://lnkd.in/g7rBGdSf   #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.

28

1 Comment

Vincent Scott, earlier today, made an post that prompted a very interesting and (IMO) important exchange about what may SEEM to be arcane details about #CMMC implementation. The particular focus of the post is on how to assess Security Protection Assets (SPA) which draws in a related question of how the expected CMMC Final Rule will require organizations to safeguard Security Protection Data (SPD). Here, I break the dialogue out as a separate post. Don’t think, please, that these are subjects relevant only to assessors and other experts in security practices. Not so. This discussion exemplifies high-level issues about CMMC implementation that merit consideration by the Office of the DoD Chief Information Officer and the CMMC Program Office, the DIBCAC unit of Defense Contract Management Agency (DCMA), as well as The Cyber AB and many in the CMMC ecosystem. From my earlier Comment on Capt. Scott’s post: “Everywhere you look, in -171, -171A, and in the L2 (or other) Assessment Guides, there are terms with significant implications for cost and performance but which are susceptible to different while reasonable interpretations. Great caution is important. While it may always be true that the more demanding interpretation will produce higher security, the cost/benefit relationship may not be worthwhile and, for many organizations, “more” equates to “too much” and that means “not achievable.” CMMC is a foundational framework with a baseline set of requirements (SP 800-171 R2). The program succeeds if it motivates many DIB companies to improve their security to meet the baseline from which enhancements can follow over time. The program fails if it is applied in a way that is unaffordable or unachieveable by all but a few DIB suppliers. My concerns apply, frankly, to the DoD rule drafters and to assessment and advisory communities. DoD may have great reasons to add “SPA” or “SPD” to the CMMC rule, but neither have any relationship any form of Controlled Unclassified Information and it is that, CUI, which the DFARS -7012 clause is supposed to protect. Grafting wished-for elements on to the necessities risks FAIL.” There is a risk that overwrought interpretation of SPA and SPD assessment requirements will force companies to abandon use of commercial security protection tools and services. On this, I said that it “would be nothing less than folly to force companies to abandon or disable use of commercial security protection tools as many of these (most?) represent the ‘best’ of available technology and are affordable.“ We should not assume that DoD will set this right by giving us better definitions or setting standards. Which/who or what of DoD will do this, and when? The CMMC assessor community, now working on the revised CAP, needs to contribute. You should present to DIBCAC what you think is sufficient (for security), acceptable (for DoD), and achievable (by DIB suppliers). Don’t wait for others to decide. Personal opinion.

71

44 Comments

Best Practices for Event Logging and Threat Detection: Executive Summary This publication defines a baseline for event logging best practices to mitigate cyber threats. It was developed by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) in cooperation with the following international partners:  * United States (US) Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA). * United Kingdom (UK) National Cyber Security Centre (NCSC-UK). * Canadian Centre for Cyber Security (CCCS). * New Zealand National Cyber Security Centre (NCSC-NZ) and Computer Emergency Response Team (CERT NZ). * Japan National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and Computer Emergency Response Team Coordination Center (JPCERT/CC). * The Republic of Korea National Intelligence Services (NIS) and NIS’s National Cyber Security Center (NCSC-Korea). * Singapore Cyber Security Agency (CSA). * The Netherlands General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD). Event logging supports the continued delivery of operations and improves the security and resilience of critical systems by enabling network visibility. This guidance makes recommendations that improve an organization’s resilience in the current cyber threat environment, with regard for resourcing constraints. The guidance is of moderate technical complexity and assumes a basic understanding of event logging. An effective event logging solution aims to: * Send alerts to the network defenders responsible for monitoring when cyber security events such as critical software configuration changes are made or new software solutions are deployed. * Identify cyber security events that may indicate a cyber security incident, such as malicious actors employing living off the land (LOTL) techniques or lateral movement post-compromise. * Support incident response by revealing the scope and extent of a compromise. * Monitor account compliance with organizational policies. * Reduce alert noise, saving on costs associated with storage and query time. * Enable network defenders to make agile and informed decisions based on prioritization of alerts and analytics. * Ensure logs and the logging platforms are useable and performant for analysts. There are four key factors to consider when pursuing logging best practices: * Enterprise-approved event logging policy. * Centralized event log access and correlation. * Secure storage and event log integrity. * Detection strategy for relevant threats. To access the PDF version of this report, visit here. Introduction The increased prevalence of malicious actors employing LOTL… https://lnkd.in/gBe_Bji7

1

CNAPP, DevSecOps, and what a better future for cloud security looks like. I finished reading the excellent analysis from Francis Odum and James Berthoty, and although they categorize Gomboc.ai (and Resourcely) as CSPM (rather then true remediation), it really includes some of the critical elements that drove me to start Gomboc.ai to begin with. I highly encourage reading the whole thing, but here's a few snippets for you: 1. Increased spending, decreased satisfaction. Platforms are becoming expensive and end up not delivering value. You end up paying for a brand name (or an an overinflated valuation of a cool startup), while not having any impact on your security. 2. Developer vs. Security Analyst persona’s. Who do you cater for? Can a security product help bridge the gap between security engineers and developers? Can you move on from throwing over tickets that generate more work, and actually work in the trenches with developers while delivering value (and code)? 3. Practitioners are frustrated by a lack of context, alert fatigue. Back to point 2 above - alerts are old, they become a liability as security doesn't have the capability to do anything about them without closing the knowledge gap or delivering actual fixes to developers. How can you help address issues at the source, rather than the symptoms? 4. CISOs are frustrated with the wasted time and developer complaints. That's why I chose to start Gomboc.ai instead of moving on to another CISO/CSO role. The industry needs a change, and it's not coming from the CNAPP providers. We need to embrace a new practical approach of doing work rather than saying what's wrong. Would love to hear your thoughts on the report, and the market in general! https://lnkd.in/eAVyip2H

19

1 Comment

https://lnkd.in/gWEPNM4a A malware that was allegedly created and disseminated by a Chinese national living in Singapore infected millions of personal computers globally, turning them into a vast network of zombie machines. Wang Yunhe, 35, purportedly charged as little as US$28 (S$38) for users to tap the computers’ internet protocol (IP) addresses – the unique characters that identify each computer – to carry out all sorts of criminal activities. These included viewing child exploitation material. 911 S5 Botnet were promised anonymity, as all activities were traced back to the zombie computers and their clueless owners. Q: How do I know if my device is affected? A: On its website, the FBI says computer users should check for running services by looking at the “Task Manager”. Under the “Process” tab, search for any of the six VPNs – MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN and ShineVPN. If “Task Manager” does not detect any of them, click on the “Start” menu and key in each of the VPN names to check if any of the files are present in the computer. If a file for any of the VPNs is found, right click on it and select “Uninstall”. Alternatively, click on the “Start” menu and type “Add or remove programs”. If one of the VPNs in the list is found, click on its name and select “Uninstall”. The FBI said users can verify that all associated files linked to the VPN have been removed by going into “File Explorer”. “Click on the drive letter ‘C’: – sometimes labelled as ‘Windows (C:)’ – and navigate to ‘Program Files (x86)’. “Then, look for the malicious software application names in the list of files and folders,” it added. If nothing is found, then it is likely that the computer is not affected.

11

As a C-suite executive or board member, your role is to be an enabler of Enterprise Cyber Risk Management (ECRM), not an expert. We achieve this by championing strong governance principles and understanding that cyber risk management is a business issue, not just an “IT problem.” After all, a proactive ECRM program can be a significant business enabler, aligning with your organization’s vision, mission, strategy, values, and services. This integration should feed into your overall Enterprise Risk Management (ERM) framework and shape your cybersecurity strategy. By embedding ECRM into your business operations, you safeguard your organization while driving growth and resilience. Discover more in my book: https://lnkd.in/e2muN5eZ #ECRM #CSuiteLeadership #CyberRiskManagement #ERM

6

Date: Apr 17, 2024 Industry: Oil & Gas Country: Indonesia Threat Actor: threatbear A threat actor claims to have obtained a database dump from an Indonesian oil and gas company. The dump reportedly contained data from around 22,300, including their names, email addresses, and passwords (hashed with MD5), as well as data from 790 admin users, 327 PertaShop users, and other types of users. #DataBreach #ThreatIntelligence #SecurityAnalyst #CyberSecurity #DataLeaks #SecurityAwareness #BreachAlert #PrivacyBreach

6

Holmes: Watson, I have a rather ingenious method for safeguarding our sensitive information. Watson: Indeed, Holmes? What might that be? Holmes: Simply insert commas into your password. Should your credentials ever be misappropriated into a CSV file, the commas will disrupt the format. Watson: Ah, disrupt the format, you say? Quite clever, Holmes! A simple yet effective countermeasure.

1

As a cybersecurity professional, I'm alarmed by the recent surge in phishing scams targeting online marketplace users in Singapore. The Straits Times reports a staggering 594 victims have lost a combined S$13 million since April in these schemes. These scams are increasingly sophisticated, with fraudsters expertly impersonating egitimate sellers and platforms They prey on Insuspecting buyers, often offering too-good-to-be-true deals that lead to fraudulent payment portals and ultimately, financial loss. Here's how you can protect yourself: -Be wary of deals that seem too good to be true. -Always scrutinize the seller's profile and reviews. -Never make payments outside the official marketplace platform -Look for secure website connections (https://). . Report any suspicious activity to the platform and authorities immediately. Let's work together to combat these scams and create a safer online marketplace for everyone #cybersecurity #phishing #onlinesafety #onlinemarketplace #scamawareness

38

1 Comment