Ahmet Gökhan Yalçın

Like #ISO26262 for Functional Safety ASIL levels, we have an interesting standard coming up for #ISO21434. With ISO PAS 8475, #Cybersecurity Assurance Levels look for a good starting point. Join János Kovács at the SOS2024 ASRG conference. #AutomotiveECU #CAL #AutomotiveCybersecurity

3

🔐 Teamwork Makes the Dream Work: NIST CSF GV.SC-08 🔐 Cybersecurity isn’t just a solo mission—it’s a team sport! That’s what NIST CSF Subcategory GV.SC-08 is all about: getting your suppliers and third-party partners in on the action when it comes to incident planning, response, and recovery. Why is this important? Imagine your organization is a superhero squad. You wouldn’t leave your sidekicks in the dark during a crisis, right? By involving your suppliers in your security game plan, you ensure that everyone’s ready to leap into action together when it counts. This not only helps squash potential threats faster but also keeps your business (and theirs) running smoothly. For those just tuning in, the NIST Cybersecurity Framework is like a playbook for managing and reducing cybersecurity risks. GV.SC-08 reminds us that when it comes to security, we’re all in this together—so let’s make sure our partners are ready to join the fight. 🌐 Strong partnerships and a coordinated defense? That’s how you win the cybersecurity game and keep your customers cheering. #Cybersecurity #NISTCSF #Teamwork #IncidentResponse #SupplyChainHeroes

2

⛔ EU ICT Service Providers – Your Link in the Chain⛔ DORA categorizes ICT third-party service providers based on the criticality of their services to financial entities, ensuring proportional risk management and oversight. By differentiating between critical and non-critical providers, DORA applies controls and governance to providers whose services pose the highest risk to financial stability, while still ensuring comprehensive resilience across the supply chain. 1. Critical vs. Non-Critical ICT Third-Party Service Providers ➡ Critical ICT Third-Party Providers:  - These are service providers that offer essential services crucial for the financial entity's operational continuity and resilience. - Financial entities must perform rigorous oversight and risk assessments, as disruptions in these services could have systemic impacts. - Regulation and Oversight: DORA mandates that critical providers be subject to strict regulatory oversight by competent authorities under the Union Oversight Framework, which includes direct engagement by a lead overseer responsible for monitoring and conducting inspections of these providers. ➡ Non-Critical ICT Third-Party Providers:  - These providers are important but do not pose systemic risks. Financial entities apply standard ICT risk management practices, including performance monitoring and reviews, but with less stringent regulatory demands. 2. Risk Categorization Criteria The criteria for categorizing ICT third-party service providers as critical or non-critical are based on factors such as: - The potential impact of a service disruption on the financial entity. - The level of dependency on the provider’s services. - The complexity and substitutability of these services. 3. Risk Management and Governance Requirements DORA requires financial entities to implement tailored governance frameworks based on the criticality of their service providers, which includes: - Enhanced monitoring and control for critical providers. - Requirements for contractual agreements to include provisions for data protection, business continuity, and termination rights. 4. Oversight Framework for Critical Providers The Union Oversight Framework applies specifically to critical ICT providers. It outlines the responsibilities of the lead overseer and includes provisions for inspections, reporting, and potential sanctions in case of non-compliance. Critical providers must establish an adequate business presence in the Union if they are based outside of it. 5. Subcontracting and Concentration Risk DORA also emphasizes the importance of monitoring subcontracting arrangements, particularly when they involve critical functions. The concentration of critical providers within the Union is monitored to avoid systemic risks, ensuring that financial entities maintain control over key services even when subcontracting. For help getting started, please reach out! A-LIGN #DORA #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

12

2 Yorum

An *outstanding* report by the IOCTA. Helping protect our day-to-day routine. The Internet Organised Crime Threat Assessment (IOCTA) this year's report highlights relevant trends in crime areas such as cyber-attacks, child sexual exploitation, and online and payment fraud schemes. Recent law enforcement operations have prompted ransomware groups to splinter and rebrand under different guises. Furthermore, continuous takedowns of forums and marketplaces on the dark web have shortened the lifecycle of criminal sites. This instability, combined with the surge of existing scams, has contributed to the fragmentation and multiplication of cyber threats. Thank you @Catherine De Bolle and the team #Europol #Cybercrime #ransomware #darkweb https://lnkd.in/gxAVYepj

6

Most critical infrastructure organisations have a nicely formated policy that says they apply MFA (multi-factor authentication) - to mitigate the risk of compromised credentials being used for password-spraying attacks, which are currently being linked to a hostile campaign. Job done? Unfortunately, in Deloitte's experience, one of the more common findings in our post incident reviews is that the attackers got initial access via an interface where the MFA is absent (or configured in a way that can be bypassed). Given how complex organisations can be it has never been more important to get certainty around this control, especially on Internet-facing interfaces.

21

1 Yorum

Secure by Design Pledge, a voluntary program for software manufacturers. The program outlines a set of goals that manufacturers can agree to work towards in order to improve the security of their products. I believe this program is a positive step towards improving the overall security posture of the software we use every day. By encouraging software makers to prioritize security from the design phase, we can collectively create a more secure digital environment. Software makers pledged to make measurable progress in applying secure by design principles to their organization and publicly document how they achieved it within one year. #cybersecurity #softwaredevelopment #pledge #securebydesign #microsoft #aws #github #qualys #fortinet #google

12

Over 22k unpatched Palo Alto Network devices (PANs) exposed to the internet. The time to patch these has passed as exploitation attempts have been detected, with more expected. Patch your PANs and sign up for Shadowserver reports to get alerts as to whether or not there are vulnerable PANs in your networks.

93

5 Yorum

I just registered for #InfosecurityEurope 2024! 🚀 Join me at Europe’s leading #cybersecurity event to: ✔️ Explore the latest advancements in #infosec technology ✔️ Engage with industry experts for invaluable insights ✔️ Connect with peers to enhance your security strategy ✔️ Upgrade your skills in security #governance Save the date: ExCeL London, June 4-6. Register today and stay ahead of emerging threats and trends! 🛡️ #cybersecurityevent #cybersecurity

10

2 Yorum

The Government of #Malta have finally decided to start discussing legal protection for #whitehat hackers (a.k.a. ethical #hackers or #security researchers) which is definitely a step in the right direction and I'm extremely happy that this is high enough on the agenda to get special mention. However, I think a proper #legal framework is required for not only the protection of these individuals, but also for the responsible disclosure of #vulnerabilities and encouraging organisations to design and implement #bugbounty programs, or utilise the services of third-party bug bountry platforms. Self-regulation is not always the best way and sometimes we need other people with more hunting experience and a different perspective to call us out and find issues that we may have missed. This is one of the most effective way of detecting issues and resolving them. https://lnkd.in/d7pwsZ3Y #ethicalhacking #infosec

4

If you join the round table I will facilitate around « Aligning AI governance with Data governance for a smooth AI journey », here is a great resource to think about and share your feedback during the discussion : « Keeping artificial intelligence real », a McKinsey podcast: https://lnkd.in/dmXkW8Ts

26

Empowering the Future Through Knowledge Sharing As professionals, one of the most impactful ways we can give back is by sharing the knowledge and experience we've gained over the years. This not only contributes to the growth of our industry but also helps shape a safer, more secure future for everyone. With that in mind, I'm excited to offer a free course to the IT/InfoSec/Privacy community: "Privacy Program Management: A Practical Approach." This course is designed to enhance your understanding and hands-on skills in the field of Privacy and Cybersecurity. Whether you're just starting out or looking to deepen your expertise, I believe this course will be valuable for you. Access the course here: https://lnkd.in/dPVDFPGy If you find the course helpful, I’d greatly appreciate it if you could take a moment to give it a 5-star rating (★★★★★). Your feedback helps others discover and benefit from this resource as well! https://lnkd.in/dPVDFPGy #Cybersecurity #PrivacyManagement #InfoSec #CyberAwareness #OnlinePrivacy #DataProtection #KnowledgeSharing #FreeCourse #ProfessionalDevelopment #CybersecurityTraining #PrivacyProgram #TechCommunity #ContinuousLearning #DigitalSecurity #CISO #CBBApproved #HeadInfoSec

44

7 Yorum

Risk Quantification In today’s complex threat landscape, effective cyber risk management is more critical than ever. The challenge lies not only in creating mitigation strategies but also in quantifying risk in business terms that resonate with leadership. Translating technical cyber risks into financial implications has become a crucial skill for securing the necessary resources for cybersecurity programs. The Evolution of Risk Quantification Over the past decade, cyber risk quantification has moved from basic heat maps and color-coded charts to more advanced, financially grounded models. One pivotal change has been the adoption of the Factor Analysis of Information Risk (FAIR) framework. FAIR enables organizations to quantify cyber risks in financial terms, providing a clear picture of potential monetary losses and bridging the gap between cybersecurity teams and business leaders. FAIR and Beyond FAIR breaks down risk into measurable components, such as loss event frequency and impact. It offers a defensible, repeatable approach to help guide decision-making. Meanwhile, emerging frameworks like Continuous Threat Exposure Management (CTEM) paired with Cyber Risk Quantification (CRQ) provide real-time, dynamic risk assessments. These models continuously update organizations’ risk postures and offer precise, actionable insights for the C-suite. Advances in Predictive Analytics Recent advances in predictive and advanced analytics allow for deeper scenario modeling and real-time decision-making. Predictive models simulate potential risk events, giving organizations a comprehensive view of possible outcomes and preparing them for worst-case scenarios. Challenges and Opportunities Despite progress, quantifying risk remains complex, especially with rapidly evolving threats. Data quality and predictive limitations continue to challenge organizations. However, new approaches like CTEM and CRQ are making risk quantification more accurate and relevant, helping teams stay ahead of emerging threats. As cyber threats evolve, so too must risk quantification techniques. Organizations must continue refining their strategies to ensure preparedness in the face of an ever-changing threat landscape. Full Article: https://lnkd.in/dfjtpAGE #CyberSecurity #RiskManagement #FAIR #CTEM #CRQ #PredictiveAnalytics #CISO #BusinessResilience #CyberThreats

39

If you are leading a role such as #CISO, Head Compliance, DPO, or even Head Legal, which covers multiple jurisdictions then "Rationalizing requirements" can be the key to navigating the complex regulatory landscape. By identifying commonalities and overlaps among various regulations, organizations can create streamlined, harmonized policies and procedures that address multiple regulatory requirements simultaneously. It can reduce duplication of effort, minimize compliance costs, and improve efficiency. Embracing a rationalization strategy not only enhances compliance but also strengthens organizational resilience in today's ever-evolving regulatory landscape. #UAEIA #UAENESA #NESA #DPO #CISSP #Laws #CBB #HeadInfoSec #CISO #Trainer #CBBApprovedPerson #Compliance #RegulatoryCompliance #Efficiency #DataProtection #Privacy #BusinessStrategy #CyberSecurity #informaionsecurity #ISO27001 #NIST

41

Is ethical use of AI realistic and viable or a pure myth? This article sheds light on how innocent use of AI could inadvertently contribute to training models, potentially putting you and your organization at risk.

5

How does GRC impact organizations? GRC (Governance, Risk, and Compliance) significantly impacts organizations by structuring governance, managing risks, and ensuring regulatory compliance. This unified approach enhances business performance, fosters a culture of integrity, and mitigates financial and reputational risks. Web search results on Governance, Risk, and Compliance impact organizations. https://lnkd.in/dCKXRr7S

3

#CISOs - are you correctly positioned to take this on? “Ensure that the person responsible and accountable for AI system cybersecurity is the same person responsible and accountable for the organization’s cybersecurity in general [CPG 1.B].” “Evaluate and secure the supply chain for any external AI models and data, making sure they adhere to organizational standards and risk management policies, and preferring ones developed according to secure by design principles. Make sure that the risks are understood and accepted for parts of the supply chain that cannot adhere to organizational standards and policies.”

13

1 Yorum

IoT Security: Challenges and Best Practices Analyze the unique security challenges posed by IoT devices and recommend best practices to mitigate risks. The proliferation of Internet of Things (IoT) devices presents unique cybersecurity challenges, as these interconnected devices often lack robust built-in security measures. Understanding the challenges and implementing best practices are crucial for safeguarding IoT environments. Challenges in IoT Security: IoT devices typically have limited processing power and memory, making them vulnerable to attacks such as botnets and distributed denial-of-service (DDoS) attacks. Moreover, many IoT devices are deployed with default or weak credentials, making them easy targets for exploitation by cybercriminals. IoT devices' sheer volume and diversity further complicate security management, as each device represents a potential entry point into the network. Best Practices for IoT Security: To enhance IoT security, organizations should implement the following best practices: Inventory and Asset Management: Maintain an updated inventory of all IoT devices, including their specifications and associated risks. Secure Authentication: Implement strong authentication mechanisms such as unique passwords and multifactor authentication (MFA) for accessing IoT devices. Network Segmentation: Isolate IoT devices into separate network segments to minimize the impact of a compromised device on the entire network. Regular Updates and Patch Management: Apply security patches and updates promptly to mitigate vulnerabilities exploited by attackers. Data Encryption: Encrypt data at rest and in transit to protect sensitive information exchanged between IoT devices and the network. Monitoring and Logging: Implement continuous monitoring and logging of IoT device activities to detect anomalous behavior and potential security incidents. Future Directions in IoT Security: Looking ahead, advancements in IoT security are expected to focus on automated threat detection and response and integrating security measures directly into IoT device designs. Industry collaboration and adherence to IoT security standards will also play a critical role in mitigating emerging threats. In conclusion, while IoT devices offer unprecedented convenience and efficiency, addressing their security challenges requires proactive measures and a holistic approach. .

11

1 Yorum

Mapping Controls for Keyless Car Theft 🚗🔐 When addressing keyless car theft, it's crucial to distinguish between different types of controls: deterrent, preventive, detective, and corrective controls. Here's a comprehensive mapping: 1. Deterrent Controls 🚫 These controls discourage thieves from attempting theft in the first place. Visible Steering Wheel Lock 🔒: Thieves are less likely to attempt stealing a car if they see a physical lock. Warning Stickers 🚨: Placing stickers on windows indicating the presence of alarm systems or tracking devices. Security Lighting 💡: Bright outdoor lighting can deter thieves from approaching vehicles. 2. Preventive Controls 🛡️ These controls aim to prevent the theft from happening. Disable Keyless Entry System 🔕: Temporarily turning off the keyless entry function when not in use. Faraday Pouch/Bags 📡: These pouches prevent signal relay. 3. Detective Controls 👁️ These controls help in detecting the theft attempt in progress. Car Alarms 🚔: Sound alarms when unauthorized access is attempted. Surveillance Cameras 📷: Installing cameras to monitor and record suspicious activities around your vehicle. Proximity Alerts 📲: Some systems alert owners when the car is moved or tampered with while parked. 4. Corrective Controls 🛠️ These controls help in recovering from a theft or thwarting it mid-progress. Vehicle Tracking Systems 🛰️: GPS-based tracking systems that can help locate and recover stolen vehicles. Kill Switches 🛑: Manual or remote-activated switches that disable the vehicle’s engine. Immediate Reporting Procedures 📞: Knowing the steps to quickly report the theft to authorities and insurance companies. Practical Example Scenario 🏡 Imagine a neighborhood implementing these controls: Deterrent 🚫: Residents install visible steering wheel locks and place security stickers on their windows. Security lights are added to all driveways. Preventive 🛡️: All households use RFID-blocking cases for their key fobs and disable keyless entry systems when cars are parked overnight. Detective 👁️: Surveillance cameras are installed around homes, and car alarms are active on all vehicles. Corrective 🛠️: All cars have GPS tracking systems installed, and residents are educated on how to quickly activate kill switches and report thefts. By employing a combination of these controls, the neighborhood significantly reduces the risk of keyless car thefts and is better prepared to handle incidents if they occur.

1