Dilbagh Singh

Suggested ISO/IEC 27002:2022 controls for GDPR compliance Aligning ISO 27002 and GDPR for Comprehensive Data Protection As organizations strive to comply with the EU's General Data Protection Regulation (GDPR), many are looking to established security frameworks like ISO/IEC 27002 to guide their efforts. A recent briefing outlines how the latest 2022 version of ISO 27002 can provide a robust foundation for addressing GDPR requirements. GDPR focuses on safeguarding "personal data" - any information that can identify a natural person. It mandates principles like lawful, fair and transparent processing, data minimization, accuracy, and strong security measures to protect the integrity and confidentiality of this sensitive information. The ISO 27002 standard takes a broader view, providing a comprehensive management system for mitigating information risks across an organization. But its controls around areas like access management, encryption, logging, and incident response align closely with GDPR's technical and organizational requirements. By implementing relevant ISO 27002 controls, companies can satisfy many GDPR obligations - from obtaining valid consent to facilitating data subject rights like access and deletion. The standard's emphasis on accountability and documentation also supports GDPR's principle of being able to demonstrate compliance. Of course, organizations still need to carefully review the nuanced details of GDPR. But aligning their information security program with ISO 27002 can give them a strong foundation to build upon. It's a practical way to tackle data protection in a holistic, risk-based manner - meeting both regulatory mandates and broader business needs. Ibrahim

23

4 Comments

Discover how Cyberfort Penetration Testing services can help your organisation to identify threats and enable a best practice cyber security strategy. Empower your organisations cyber security strategy by choosing Cyberfort as your professional penetration testing company. Our team brings specialised expertise, cutting-edge tools, and a comprehensive approach, ensuring a thorough assessment of your security vulnerabilities.   #PenTesting #AppsTesting #Networkinfrastructure #Compliance #Cyberreview

20

Applying ISO/IEC 27001/2 and the ISA/IEC 62443 Series for Operational Technology Environments

12

Data protection meets Cloud security in this two day course 👇 Become a Certified ISO 27018 Cloud Privacy Specialist with our training course where you'll be able to learn how to protect Personally Identifiable Information in the Cloud. Save 25% on training in Cloud security this autumn https://ow.ly/gpFN50TOw2K #CloudSecurity #DataProtection #ISO27018 #CloudPrivacy #CyberSecurityTraining #CloudComputing

4

**Upcoming New Cyber Security Legislation** The UK government is rolling out the Cyber Security and Resilience Bill to strengthen defences against cyber threats. This new legislation aims to close existing security gaps, empower regulators, and enforce stricter reporting requirements, keeping UK businesses resilient in an increasingly hostile cyber environment. Wondering how this will impact your business and what steps you should take? Read our recent blog and get the views of our cyber security experts on the legislation: https://lnkd.in/eeXC9Kyt #cybersecurity #securitypartner #itcompany #gov

6

Government of Ireland, National Cyber Emergency Plan (NCEP) National Cyber Emergency Plan (NCEP) Purpose: This plan outlines the national approach for responding to serious cyber security incidents that affect nationally important IT and operational technology systems and networks. It aims to ensure an effective, coordinated government response to cyber emergencies. Key Points: - The NCEP is aligned with the Strategic Emergency Management National Structure and Framework, which sets out how the government prepares for and responds to national crises. - It establishes an architecture for coordinating a "whole of government" approach to cyber emergencies. - It defines a "cyber emergency" as an incident that causes or threatens death, injury, property/environmental damage, economic impacts, or significant disruption to critical sectors. - The plan outlines three cooperation modes: Permanent Mode, Warning Mode, and Full Activation Mode, which dictate the level of coordination and response. - It defines the roles and responsibilities of various government entities, victim organizations, law enforcement, and other stakeholders during a cyber emergency. - It covers communication protocols, both domestically and internationally, as well as the process for transitioning incident management. - The plan also includes several appendices providing additional details on incident categories, threat types, communication protocols, and sample agendas. The National Cyber Emergency Plan serves as a comprehensive framework to ensure Ireland is prepared to effectively manage and respond to major cyber incidents that could significantly impact the country.

13

1 Comment

🤔 Is your organisation doing enough to close the cyber security skills gap? Download our 2024 global report: https://lnkd.in/eK7SMsGM The paper, ‘Beyond traditional cyber talent’, contains: 📢 Results from our survey of 1,000+ cyber security leaders 🤝 Advice on attracting, developing and retaining top talent 📊 Expert analysis and commentary

15

Understanding Data Loss Prevention (DLP) Data Loss Prevention (DLP) is a critical framework for organizations aiming to safeguard sensitive information from accidental deletion, breaches, or unauthorized exposure. Authored by Aastha Verma, Ministry Of Security (MOS), the document delves into the complexities surrounding DLP, highlighting its role in security strategies. DLP solutions encompass a blend of technologies, processes, and people, including data owners, security analysts, and privacy officers. Effective DLP requires accurate data classification, continuous monitoring, and a robust understanding of privacy regulations like GDPR. However, DLP is often viewed as a "gray area" for security professionals due to challenges such as balancing data protection with user privacy, managing false positives, and navigating evolving regulatory landscapes. The document provides insights into these challenges and offers strategies for organizations to enhance their DLP efforts, emphasizing the need for cross-functional collaboration and ongoing adaptation. As data protection becomes increasingly vital in today’s digital landscape, understanding and implementing effective DLP measures is essential for organizational security. Ibrahim

74

4 Comments

Cyber Essentials+ remains one of the main UK standards for businesses to demonstrate good levels of cyber hygiene. With changes to the standard happening frequently, one challenge that is omnipresent is patching vulnerabilities quickly. Join us for insights from industry experts on the latest changes in Cyber Essentials+, common pitfalls in the accreditation process, and strategies for effective configuration management and patching. Don’t miss this exclusive webinar featuring Katherine Chipdey from Automox and Elly B. from Pentest People on Wednesday October 9th at 4pm, "Making Patching Easy." If you're interested, register for your spot today! https://lnkd.in/eYNkYWeE

33

UK government to introduce new cyber security bill UK government introduces a new Cyber Security and Resilience Bill to enhance national cyber-defences.

5

1 Comment

The most efficient Cyber Risk Quantification exercise ever? We were doing a security program assessment and design engagement for which we had scoped-in quantifying cyber risk associated with a few critical scenarios. It was the first time this organization had endeavored to quantify cyber risk.   We included this exercise as a means to:   - increase cross-functional executive engagement in cyber decision-making; - provide justification for what we assumed would be a recommended increase in, and certainly a re-allocation of, the organization’s cyber security program budget. We call this approach Minimum Viable Cyber Risk Quantification (MV-CRQ for short) - I will post more on this in the future. We started collecting the data we needed to build the out loss event magnitude for the target scenario. Not surprisingly this involved working with the finance executive on some standard operational and financial data. Much like collecting data for a business impact analysis, you could see what we were driving as we collected the data. The CEO, who had signed off on the engagement, stepped in and discontinued our data collection. He said something to the effect of: “Just make your recommendations and we can argue about the cost later if we have to.” We reallocated the hours to technical findings. Fast forward several weeks, and the CEO signed off on and approved funding for all of the important program recommendations. Hiring us in the first place was an indication that these folks were predisposed to take their program to another level. That said, I can’t help but think that Phil Venables is right when he says: “As with other areas of risk there’s a Heisenberg-like quality to much of the approaches. That is the act of measuring often changes the situation, often positively.”

8

1 Comment

Understanding the intricacies of modern cyber threats is crucial for security professionals.🔒 GBHackers On Security offers detailed insights into the latest cybersecurity developments. Their recent articles highlight: 1. **SSLoad Malware**: Using MSI installer to initiate delivery chains. 2. **Criminal IP & Quad9 Collaboration**: Exchanging domain and IP threat intelligence. 3. **Global Threat Intelligence**: A SOC/DFIR team guide. 4. **Acoustic Keyboard Attacks**: New side-channel attacks stealing sensitive data. These insights remind us that staying informed is essential for robust cybersecurity strategies. I've often found that diving deep into case studies and news helps keep my response tactics updated and effective. 👀 Have you come across any new threats or vulnerabilities recently? Share your experiences! #cybersecurity #infosec #dataprotection #NextGenCISO

2

Data Security and Protection Policy Template Data Security and Protection Policy Template: A Comprehensive Framework for Safeguarding Sensitive Information The "Data Security and Protection Policy Template" is a valuable resource for GRC (Governance, Risk, and Compliance) professionals looking to develop robust data security policies within their organizations. This draft policy document, outlines a comprehensive framework for protecting sensitive data from unauthorized access, use, disclosure, alteration, or destruction. Key highlights of the policy template include: 1. Clear statement of purpose and scope, covering all types of data and applying to all employees, contractors, and third-party vendors. 2. Commitment to ensuring the confidentiality, integrity, and availability of data, while complying with relevant regulations and industry best practices. 3. Detailed goals and objectives, such as preventing unauthorized access, ensuring data integrity, protecting against loss or damage, and maintaining a secure data environment. 4. Definitions of key terms, including "data," "data security," "data protection," "data controller," and "data processor," to ensure a common understanding. This policy template can serve as a valuable starting point for organizations looking to develop or update their data security and protection policies. GRC professionals are encouraged to review the document, provide feedback, and adapt it to their specific organizational needs and requirements. Remember, as this is a draft version, it is crucial to verify the information carefully before implementation and to seek professional guidance as needed.

20

1 Comment

Yesterday we announced the renewal of our 𝗖𝘆𝗯𝗲𝗿 𝗘𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹𝘀 Certificate of Assurance. Cyber Essentials, A UK Government-backed scheme to help organizations improve cybersecurity defenses against common internet-based attacks. Here are 5 controls you can implement today: - Use a firewall: Create a buffer zone between your IT network and external networks. - Use secure settings: Configure devices and software with secure settings to reduce vulnerabilities. - Control access: Limit data and service access to essential personnel only. - Protect against malware: Use antivirus software and regular updates to prevent harmful software. - Keep devices and software updated: Regular updates patch vulnerabilities and protect against new threats. Our renewed certification highlights our commitment to top-notch cybersecurity. Learn more about how we can help protect your business by booking a demo at the link below ⏬ https://lnkd.in/g_5wtScu #CyberEssentials #CyberSecurity #Certification #DigitalSafety #PrivilegedAccessManagement #ZeroTrust #RemoteAccess #AdminByRequest

13

In their 2024 annual cyber threat defence report , CyberEdge Group found that 82% of UK businesses experienced a cyber attack in the previous year. With such attacks proving to be increasingly frequent and more sophisticated, Managed Vulnerability Scanning allows you to take a proactive approach and protect against potentially damaging threats by bringing with it five advantages. Read our latest blog to find out what they are 👉 https://ow.ly/tH1950RquGy #vulnerabilityscanning #cybersecurity #cyberresilience

9

1 Comment

Stephen Essery, Technical Director of Method Cyber Security Ltd. will be discussing "Cyber Security Risk Management – The Fundamentals" with delegates at =Method's Free Live Online CPD Seminar in October. He, will look at the fundamental controls organisations should aim to have in place to protect their OT estate, irrespective of industry vertical, regulatory status, or size. This will then be followed by a 40 minute discussion with delegates. =Method's increasingly popular free seminars are open to anyone who works in the industry and who is interested in increasing their understanding of this and other important topics. To book your place see the link in the comments. #otcybersecurity #csrm #cybersecurityriskmanagement #methodcysec

2

1 Comment