Alan Broadhead

A tad late posting about this. But the #McPartlandReview into Cyber Security as an enabler of Economic Growth has been released. It was great to be a part of this through the ISC2 roundtable. The UK has some serious potential to become a leader in Cybersecurity across a number of domains, this doesn't just start with private businesses but the education sector and public sector. #Cybersecurity #CyberRisk #CyberResilience #Cloud #UK

5

Cyber Assessment Framework (CAF) 3.2 Released! 🚀 This week, NCSC announced the latest update to the Cyber Assessment Framework (CAF), Version 3.1, which continues to support and enhance cyber resilience across the UK's Critical National Infrastructure (CNI), organisations adhering to the Network and Information Systems (NIS) Regulations, and those dedicated to cyber-related public safety. Here's your whistle-stop tour of the CAF, and the changes released this week: ❓ What is the CAF? The CAF is a set of guidelines developed to help UK organisations (usually CNI or within the NIS scope) improve their cyber resilience. It provides principles, outcomes, and indicators of good practice for organisations to assess and improve their cybersecurity measures, promoting a risk-based approach to managing cyber threats. 🔍 What’s New? Language Enhancements: NCSC has made revisions to improve clarity and consistency across the Framework’s Principles, Contributing Outcomes, and Indicators of Good Practice. Significant Updates: In alignment with the new Government Cyber Security Strategy, which places the CAF at its core, they have introduced a "Partially Achieved" level for the IGP concerning Media/Equipment Sanitisation. This update recognises the unique data confidentiality risks managed by public sector organisations. 💡 NCSC's Pro Tip: Always use the supporting guidance alongside the Framework. The added context is invaluable for interpreting and applying the Framework effectively. #CyberSecurity #CAFUpdate #CyberResilience #UKCNI #PublicSafety #NISRegulations #RiskManagement #CyberAssessmentFramework

30

2 Comments

The ICO has launched a new Data Protection Audit Framework designed to enhance compliance and improve data protection practices across organisations in the UK. Key features include: ✅ Comprehensive assessment approach ✅ Flexibility for all organisation sizes ✅ Focus on continuous improvement ✅ Valuable guidance and resources This framework empowers businesses to better safeguard consumer data, enhance security, and build trust. Check out our latest article for a deeper dive! 🔍💼 https://lnkd.in/eSfAEreq #ConsumerCreditCompliance #DataProtection #ICO #GDPR #Compliance #CyberSecurity #Privacy #GDPR

4

THE IMPACT OF THE COMPUTER MISUSE ACT ➡ The CyberUp Campaign is running a short survey on the impact of the Computer Misuse Act 1990 (CMA) on UK cyber professionals and businesses ➡ They would greatly appreciate your views on this issue 🙏 ➡ CyberUp is the UK’s leading cyber coalition calling for an update to the CMA, which blanketly prohibits all unauthorised access to computer material, irrespective of intent or motive ⛔ ➡ With the help of legal experts, the campaign has drafted a robust 'statutory defence' to protect cyber professionals from unjust prosecution from the state for conducting legitimate cyber defensive activities, while still ensuring that malicious actors are unable to defend their illegal activities 🔝 Have your views heard by the Government on this issue 🚀 Here’s the survey 👉 https://lnkd.in/d6-2Mq_B #computermisuseact #cma #cybersecurity #cyberlondon #cyber #london Izak Oosthuizen Mark Child Simon Newman Paresh Deshmukh Raj Rajarajan Lucindi Storme

25

2 Comments

Cyber threats don't take a break for the holidays... give yourself the gift of a strategy to help your organisation this holiday season 🎁👇 Our latest Cyber Threat Report 2025 offers insights on the evolving cyber risks to your organisation. Insight from 300 UK IT leaders. Learn about common threats, popular strategies, and what they predict will have the biggest impact on cyber security in 2025. Download your copy now! 👉 https://bit.ly/3ZGKzSz

6

4C Strategies FREE Cyber Security Maturity Assessment When delivering a Cyber Security Maturity Assessment, two questions always come up, understanding how they compare to similar organisations within the sector is the first and secondly what is deemed “good enough”, as justification on how much to invest is always challenging. Unquestionably budgets, and the resources to achieve cyber security are finite, therefore how do you prioritise investment to maximise your security posture, and in what order do you prioritise the remediation. Possibly the biggest issue however, is the people within your organisation, always has been, always will be. The fact is, securing your organisation is a journey that never ends. You need to accept that there is never going to be a point in time when your measures will be “secure”, whatever that really means. The mission is to determine the weak points, address them, and repeat. Our FREE Cyber Paper will help you understand how we go about delivering our Cyber Maturity Assessments, in order to highlight where the organisation is exposed, how to set practical targets for improvement, and finally create the roadmap to get you there. https://lnkd.in/esEwZrMc #cybersecurity #cybermaturity #freesecuritypaper

3

Following reports of a data breach at Synnovis, The UK’s National Cyber Security Centre (NCSC) has issued a statement that reminds us of the helpful resources they have available. Guidance for data breaches can be found here: 🔗https://lnkd.in/dmZnKNF Guidance for ransomware can be found here: 🔗 https://lnkd.in/dd3T5k7r With increasing cyber threats targeting healthcare organisations, adopting strong and effective cyber security measures is imperative. Here are some best practices to start with to fortify your defences: 🟢 Implement Multi-Factor Authentication (MFA): Ensure that all access points to patient data systems require multiple forms of verification. 🟢 Conduct Regular Security Training: Educate your staff on the latest phishing techniques and cyber security protocols. 🟢 Perform Routine Risk Assessments: Regularly evaluate your systems for vulnerabilities. 🟢 Encrypt Sensitive Data: Use strong encryption for all patient data, both in transit and at rest. Encryption ensures that even if data is intercepted, it remains unreadable to unauthorised users. 🟢 Maintain Updated Software: Keep all software and systems up to date with the latest security patches. 🟢 Establish Incident Response Plans: Prepare for potential breaches with a well-defined incident response plan. 🟢 Monitor Network Activity: Continuously monitor your network for unusual activity. 🟢 Limit Access to Sensitive Information: Apply the principle of least privilege by granting employees access only to the data necessary for their role. 🟢 Backup Data Regularly: Ensure that critical data is backed up regularly and stored securely. Regular backups can significantly reduce downtime and data loss in the event of a cyber incident. 🟢 Compliance and Regulations: Stay compliant with healthcare regulations such as GDPR and HIPAA. For more detailed information about the Synnovis breach and NCSC's ongoing efforts, read their full statement here: 🔗 https://lnkd.in/ec2PktNc At Secon, we are here to support you in helping you stay vigilant and proactive in your cyber security practices to safeguard your data. For further support, please get in touch. #CyberSecurity #DataBreach #HealthcareSecurity

9

Data Protection Legislation: Is your organisation compliant? Join our data privacy experts on this webinar on the 22nd of May where we will consider a range of fundamental concerns and issues that may cause you to question your organisation’s compliance and commitment to data privacy, and whether a review of your practices might be long overdue. https://lnkd.in/eNjxbeuE #dataprivacy

10

How could your business benefit from Internal Audit as a Service?   ✅ Highly experienced, talented auditors ✅ Audit resource available when you need it ✅ Avoid expensive training fees ✅ Better quality audits   Read more: https://lnkd.in/eTRw__RM   #InternalAudit #CyberSecurity #InfoSec #Spritzmonkey

11

We are breaking down important cyber security principles of each of the #IASMECyberBaseline themes. ✅ IASME Cyber Baseline is the IASME certification tailored specifically for international organisations. If you are based in the UK, #CyberEssentials is the recommended minimum certification. Find out more about the theme 'Technical Intrusion', and how technical configurations to your devices make up the layers of protection that prevent unauthorised access 👉 https://lnkd.in/eZEb37tn

19

Finally, someone has thought to link up Parts 1 & 2 of the PCI Security Standards Council's PCI DSS v4.0 ROC template. This should save the QSAs even more time and, more importantly, help them to save their sanity! If the components in Part 1 have a dependency on the input into Part 2's Assessment Findings, then a link will be very useful. QSAs, it's time to embrace the 'Digital Revolution'! #pcidss #pcidssv4 #timesaving #stressbusting

7

Are you ready to enhance your skills as an auditor in information security? Gaining a deep understanding of ISO 27001 is key to helping your organisation maintain the highest standards of data protection.  By mastering the principles of auditing Information Security Management Systems (ISMS), you can contribute to a stronger, more secure approach to managing sensitive information. Our ISO 27001 Lead Auditor course offers in-depth training on planning, conducting, and reporting audits aligned with ISO 27001 requirements.  Whether you're new to auditing or looking to advance your expertise, this course is available both online and in the classroom, offering the flexibility to meet your professional needs. 🔗 Find out more: see the link in the first comment below 👇 #ISO27001 #InformationSecurity #LeadAuditor

2

1 Comment

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐓𝐡𝐫𝐞𝐚𝐭 𝐋𝐚𝐧𝐝𝐬𝐜𝐚𝐩𝐞: 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬 𝐟𝐫𝐨𝐦 𝐭𝐡𝐞 𝐍𝐂𝐒𝐂 𝐚𝐧𝐝 𝐓𝐡𝐫𝐞𝐚𝐭 𝐭𝐨 𝐑𝐢𝐬𝐤 𝐂𝐨𝐦𝐩𝐚𝐬𝐬 The UK's National Cyber Security Centre (NCSC) offers a comprehensive approach to threat modelling that enhances an organisation's ability to identify and mitigate risks. Alongside this, Elemendar's Threat to Risk Compass provides an innovative solution to manage cyber threats effectively. https://lnkd.in/edzUcfc6 𝐍𝐂𝐒𝐂'𝐬 𝐀𝐩𝐩𝐫𝐨𝐚𝐜𝐡 𝐭𝐨 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐨𝐝𝐞𝐥𝐥𝐢𝐧𝐠 The NCSC emphasises a structured process to identify potential threats, assess risks, and implement appropriate controls. Their guidance involves several key steps: • 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐲 𝐀𝐬𝐬𝐞𝐭𝐬: List critical assets, including data, systems, and infrastructure. • 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐲 𝐓𝐡𝐫𝐞𝐚𝐭𝐬: Determine potential attackers and their motivations. • 𝐀𝐬𝐬𝐞𝐬𝐬 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬: Identify system weaknesses through scanning and testing. • 𝐃𝐞𝐭𝐞𝐫𝐦𝐢𝐧𝐞 𝐭𝐡𝐞 𝐈𝐦𝐩𝐚𝐜𝐭: Assess potential financial and reputational damage. • 𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬: Deploy security measures to mitigate identified risks. Regular updates and reviews are crucial to maintain relevance as new threats emerge. 𝐇𝐨𝐰 𝐓𝐡𝐫𝐞𝐚𝐭 𝐭𝐨 𝐑𝐢𝐬𝐤 (𝐓𝐓𝐑) 𝐂𝐨𝐦𝐩𝐚𝐬𝐬 𝐂𝐚𝐧 𝐇𝐞𝐥𝐩 𝐎𝐫𝐠𝐚𝐧𝐢𝐬𝐚𝐭𝐢𝐨𝐧𝐬 Threat to Risk Compass enhances threat management with comprehensive insights and strategic decision-making, addressing challenges highlighted by the NCSC: • 𝐄𝐱𝐞𝐜𝐮𝐭𝐢𝐯𝐞 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫 𝐑𝐢𝐬𝐤𝐬 𝐚𝐧𝐝 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬: TTR Compass translates complex threat scenarios into risk management insights, facilitating communication between cybersecurity teams and non-technical executives. • 𝐏𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐬𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬 𝐚𝐧𝐝 𝐆𝐫𝐨𝐮𝐩𝐢𝐧𝐠 𝐔𝐧𝐝𝐞𝐫 𝐑𝐞𝐥𝐞𝐯𝐚𝐧𝐭 𝐑𝐢𝐬𝐤𝐬: The tool aligns with frameworks like NIST or ISO, allowing organisations to group controls by risk type, aiding in effective organisation and communication of efforts. • 𝐃𝐲𝐧𝐚𝐦𝐢𝐜 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐟𝐨𝐫 𝐈𝐦𝐩𝐚𝐜𝐭 𝐚𝐧𝐝 𝐋𝐢𝐤𝐞𝐥𝐢𝐡𝐨𝐨𝐝 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭: TTR Compass integrates updated threat intelligence to provide dynamic risk assessment updates, ensuring accurate and relevant impact scoring. • 𝐂𝐮𝐬𝐭𝐨𝐦𝐢𝐬𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲-𝐑𝐞𝐥𝐞𝐯𝐚𝐧𝐭 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬: TTR Compass offers customisable insights prioritising threats and controls relevant to specific sectors and geographical locations. By combining the NCSC's structured threat modelling approach with the innovative features of Threat to Risk Compass, organisations can enhance their ability to anticipate, prepare for, and respond to potential cyber threats, safeguarding their critical assets and maintaining stakeholder confidence. https://elemendar.ai #NCSC #Elemendar #CTI #AI #Innovation #RiskManagement #threatmodelling

12

❗𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗹𝗲𝗿𝘁 𝗳𝗼𝗿 𝗟𝗮𝘄 𝗙𝗶𝗿𝗺𝘀: 𝗔𝗰𝘁𝗶𝗼𝗻𝗶𝗻𝗴 𝘁𝗵𝗲 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗡𝗖𝗦𝗖 𝗟𝗲𝗴𝗮𝗹 𝗦𝗲𝗰𝘁𝗼𝗿 𝗧𝗵𝗿𝗲𝗮𝘁 𝗥𝗲𝗽𝗼𝗿𝘁 ❗ Recently the UK National Cyber Security Centre (part of GCHQ) issued a threat report regarding targeted attacks against the UK legal sector. This is an excellent report and contains great advice on how to protect against such attacks. It’s 24 pages long, and quite dry, but here’s our take on it. 1. It’s not just the UK legal sector being targeted – this is a global issue affecting other sectors including Accounting, Healthcare, Engineering, Construction, Hospitality, and Education. 2. The advice isn’t anything new or specific to the legal sector. 3. Confidentiality (therefore trust) and money is at stake. Our friends at Cyber Warden have summarised the advice from the report, and how cybersecurity experts like Cyber Warden and their partners can help. #cybersecurity #consulting #technology #cyberwarden #cjaconsulting #muhami

1

We are breaking down important cyber security principles of each of the #IASMECyberBaseline themes. ✅ IASME Cyber Baseline is the IASME certification tailored specifically for international organisations. If you are based in the UK, #CyberEssentials is the recommended minimum certification. Find out more about the theme 'Resilience' and the importance in being able to respond to an incident, keep operating through it, and eventually recover 👉 https://lnkd.in/ePCCbFmU

22

2 Comments

Our team of experts are here to help you assess your current cyber security measures and help you build a resilient, future-ready security framework. 📩 Get in touch to discuss how we can help strengthen your defences and stay ahead of emerging threats. #CyberSecurityExperts #DataProtection #RiskManagement #CyberResilience #CyberEssentials #ImpactITSolutions

5

🔒 Module 1: Understanding Cyber Risk 🔒 In the first module of our new online course "Cyber Risk Resilience for Directors", we explore the cyber vulnerabilities facing businesses today and the critical impacts of a cyber event. Learn how to analyse specific risks so you can focus your organisation's risk management activities where they matter most. Plus, discover why cyber governance is a board-level issue and how to make cyber risk everyone’s responsibility in your organisation. Start building a stronger foundation for managing cyber risk now. Enrol here: https://lnkd.in/gpBAUjN4 #CyberRisk #CyberGovernance #RiskManagement #BusinessResilience #Leadership

3

New Research on Cyber Oversight in Big Firms in UK reveals 83% say their Bosses understand Cyber Risks.     Full Report = https://lnkd.in/e4M_Uxa9     Bravo all to UK Government for their great work on #CyberSecurity

3