Laura Galyer

Five first steps for cyber security. Lots of noise and technology chatter masks that security is a process for any business to own and succeed with.

5

So good to see Michael Murphy's experience and intel expand to advise on the risks cyber criminals pose to the nation's critical infrastructure and the motivations behind hackers' actions beyond financial gain. Michael and Ross discussed how detrimental a cyber attack can be when a hacker shuts off access to a certain system, with this disruption leading to downtime, which can result in revenue loss and irreversible brand damage. Watch the interview or read more on Sky News Australia https://ftnt.net/6044gKCdE #Cybersecurity #OperationalTechnology #CriticalInfrastructure

35

75% of UK’s medium and large businesses faced a security incident last year, highlighting the urgent need for robust cyber defenses. With 30+ years of expertise, NetUtils is equipped to fortify your business against sophisticated cyber threats. Act now—secure your operations with our proven security solutions. #Cybersecurity #BusinessSecurity #UKBusinesses

7

Most information security-related writing has a ‘cyber’ emphasis. But information security is about physical equipment and hard-copy data, too. With that, this was a very refreshing interview with Matthew Peers from IT Governance Ltd! Matthew gave wonderfully simple, straightforward answers. For example, I queried whether making ‘physical’ a separate control theme in ISO 27001:2022 and ISO 27002:2022 was an acknowledgement that physical security could be overlooked. His response? “I’d say that the separate category just filters out those controls better. “Since COVID, many organisations operate remotely. So, for the purposes of control selection, many physical security controls can be justifiably excluded if all staff work from home. “Having a separate category for those controls makes this more practical to do.” Read the full Q&A 👇 https://lnkd.in/e39nTF95

5

An interesting & insightful policy paper from the Chatham house proposing principles for state behavior with commercially-available cyber Intrusion products and services. The topic is complex & the objective set by the writers - a set of agreed principles for governments to follow - is ambitious. However, it’s clear that the paper is a result of a multi-stakeholder discussion. Every suggested principle is presented with sometimes contradictory impacts. Author is not shy to describe “corner cases” where principles face a tough reality. Its a coolheaded analysis calling for solutions rather then moratoriums; acknowledges that while technologically challenging, CCIC’s are here to stay; and that states, not only companies, should take responsibility. As the UK-French Pall Mall Process on responsible cyber behavior reconvenes, we can expect more policy papers to set the stage, and terms of reference.

7

Leicester city council suffered an IT breach and #ransomware attack in March and its effect on their IT systems are still ongoing. Council said that the attack was sophisticated (nation state?) and from a known ransomware group. #Cybersecurity solutions and technology are becoming more and more advanced but same is the case with attackers. How far and long will this race go? We say that cybersecurity is a team game but individual organisations are still meant to fight alone. Is there something amiss here? What happened to the managed cybersecurity model (#MSS) and collective protection? Isn't an analyst sitting in vendor #SOC aggregating and analysing data for multiple customers more likely to identify and mitigate threats than individual companies trying to do it on their own. I think with the rise of EDRs, MDRs, #XDRs a decade ago, we again went into the drive of acquiring shiny new tools rather than looking at solving the cybersecurity problems hollistically. I would be interested in knowing from my fellow cybersecurity colleagues, especially in the #MSSP space on what's happening there and why growth in this space seems to have slowed down (or is it only my observation)? https://lnkd.in/g3E-Ahxn

6

5 simple measures every organisation can do to help prevent cyber incidents 👇 We spoke to Cyber Incident Responder, Vanessa Horton, on her top tips: Very basic controls can get you a long way: 🟢Strong passwords and MFA [multifactor authentication] 🟢Anti-malware software 🟢Secure configuration 🟢Regular patching 🟢Firewalls Not doing these types of things just makes you a more likely target. I don’t like using the word ‘easy’, but that’s what you’re making yourself if you don’t patch or you use passwords like ‘Password123’: an easy target. You’re leaving the door wide open to threat actors. This also underlines the importance of prevention and detection. Cyber incident response planning doesn’t start with the response – any response is only triggered if you detect abnormalities. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/7Ym150S452g #CyberSecurity #IncidentResponse #CyberIncident #Infosec

7

Questions for NIS Compliance interest... We are helping many organisations with  NIS compliance work and have an interest in other organisations' experiences. Vibert Ltd advises NIS and NIS2 compliance as an ex- NIS Regulator and have many common findings. What do you experience? NIS and NIS2 are driving cyber/resilience improvements across many industries. Some are responding faster than others. Which industries are slowest and how can we all help them better? NIS2 will be a tidal wave starting in 2024 with addition of thousands of organisations, many new sectors, and accountabilities of Essential and Important entities. NIS V1.2.x UK may also do similar in future..... How will CAs and CSIRTs manage this mega wave? Our typical services may comprise, for example: NIS Advisory to CxOs/Boards/Senior Staff and NRO/DNROs etc. on NIS importance. NIS Advisory to OES for Inspection Readiness walk arounds and workshops. NIS Advisory to OES as Dummy Inspections. NIS Advisory regards Regulatory Enforcement. Teams calls with Seniors. Other possibilities.. Suggestions? Our NIS visits offered typically discuss topics like : - The Inspection Schedule across each phase. Interactions with Regulator during Inspections. Site visits: Where, how, and what is looked for. Each day of an Inspection. CAF discussions. Typical topics of an Inspection. What to prepare and how to present. What will be the outcome of each day and each phase. Who will attend from the Regulator and the OES. What will be asked and what won’t be said. Timelines. Outcomes. Information Notices and Fines. How to be best prepared. Etc. What topics are we missing? As an Ex-OFGEM NIS Inspector, we offer customers a unique insight into NIS Inspection preparedness that teams might find a useful differentiator. Some Consultants add us into their CAF programmes, just for a handful of days, which gives them a strong sales boost. We currently assist several OES in preparation for NIS Inspections. We trained many of the other Competent Authorities Inspectors in “our way” as we were leading UK (and probably EU) in NIS Inspections. E.g. OFGEM, ICO, DfT, CAA, HSE, DWI, etc. Suggested USPs… :- "Ex-NIS Regulator Principal Inspector Advisor"!!.. "Led the UKs 1st NIS Inspections"... "Developed the UKs NIS Inspection and Enforcement Programmes".... "Trains NIS Inspectors"... "Covers IT, OT, Cyber, Physical Security, Process, GRC, etc.".... !! We look forward to hearing from Operators and from Consultancies so we can develop the right SOW and Proposal for all our needs. How can we all help to assist more compliance as it will benefit society as a whole. Cevn Vibert CITP CEng FIET FInstMC FBCS 27kLA GICSP Global Director NIS Advisory and OT Industrial Security. [email protected] Vibert Ltd. www.vibert.ltd.uk #QuestionForGroup

6

In our latest article, we cover 8 things every business needs to do in 2024 to support overall business resilience!

2

🚨 Flash Briefing: CrowdStrike – What Went Wrong and How to Avoid Being Strike 2 🚨 Join IT Governance Ltd on Thursday, 1 August 2024, from 4:00 – 4:15 pm (BST) for an essential flash briefing on the recent CrowdStrike outage. 🔗 Sign-up here: https://shorturl.at/MMhx1 📉 Agenda: - Analysis of the CrowdStrike outage: What went wrong and lessons learned - Immediate steps and incident response strategies to mitigate similar risks, including avoiding fake recovery resources - Implementing industry-leading frameworks and laws, such as DORA (Digital Operational Resilience Act), ISO 27001, and ISO 22301 to build robust cyber resilience - Best practices for cyber security, disaster recovery, and business continuity - Exclusive teaser of our new product designed to prevent cyber incidents and strengthen business continuity 🎤 Special Feature: Live Q&A Interact with our expert, Alan Calder, Founder and Executive Chairman of IT Governance, and get your pressing questions answered. 🔗 Register now to secure your spot: https://shorturl.at/MMhx1 #CyberSecurity #BusinessContinuity #DisasterRecovery #ISO27001 #ISO22301 #DORA #ITGovernance #CrowdStrike #IToutage #BCMS #ISMS #Live #Webinar #briefing #infosec #infosecprofessionals #ITprofessionals #ITSecurity

7

#InfoSec2024 Day 1 ✅ Vendor Risk Management is a super hot topic and our workshop this morning was full house, with questions coming from attendees non-stop! Our experts Simon Jones and Adam Denyer-Hampton shed light on framework of a successful vendor risk management and how context matters when setting priorities. Come visit us at Stand D109 to discuss more! #securityrating #threatintelligence #supplychainrisk

51

1 Comment

In an exclusive interview with Computing last week, our CISO Neil shared his insights on the latest security trends and developments. With his recent nomination for CISO of the Year, Neil's expertise and forward-thinking approach have earned him well-deserved industry recognition. 🏆 During this in-depth discussion Neil delves into the key shifts and innovations that organizations should be aware of in 2024. You can also see what he's been up to here at NGS | Next Generation Security over the last 12 months! Read the full article here to hear more from Neil and get some detailed insights! ➡ https://lnkd.in/eed9ktM2

16

At Remora, we believe that staying one step ahead of threats is crucial. Here we look at the importance of pen tests and how they help fortify your digital assets, adapts to evolving threats, and builds trust with your clients and partners. www.remora.co.uk #Cybersecurity #PenetrationTesting #DigitalSecurity #CyberThreats #ProtectYourAssets 

5

Cyber Essentials is a Government-backed scheme that focuses on helping organisations protect themselves against the most common online threats. If you’re a supplier planning on bidding for UK government contracts involving handling certain sensitive and personal information, it's a mandatory requirement. However, even if you are not planning on working as a government supplier, the Cyber Essentials certification aims to provide businesses with a baseline of cybersecurity controls. At Lucid, we can help you to put the controls and measures in place that will allow you to secure cyber essentials certification, and maintain it in the future. To find out more or to discuss how we can help, please feel free to drop me a message or get in touch with our team at lucidgrp.co.uk #LucidGroup #CyberEssentials #CyberSecurity #TechSupport

2

🚀 Join our LIVE Webinar: How to transition to ISO 27001:2022 and maintain certification Hosted by Andrew Pattison, Head of GRC Consultancy at IT Governance Europe Ltd, this live session will dive into the key updates of ISO 27001:2022 and ISO 27006. Discover the latest standards and ensure your organisation stays compliant and resilient against cyber threats. 📅 Date: Tuesday, 7 May 2024 ⏰ Time: 3:00 PM GMT 🔗 Sign-up: https://shorturl.at/bdzNX What You Will Learn: - The key updates in ISO 27001:2022 & ISO 27006 and their implications for your certification. - Effective strategies for transitioning from ISO 27001:2013 to 2022. - Practical tips to plan for and meet crucial ISO 27001 deadlines. - Enhance your compliance and audit management with CyberComply. 🤝 Interactive Q&A: Engage directly with our ISO expert, Andrew Pattison, in a live Q&A session to address all your uncertainties and strategise your ISO 27001 implementation journey. 🔖 Special Offers: Webinar attendees will gain exclusive access to training courses and essential resources to accelerate your ISO 27001 projects. 🎓 CPD Points: Attend and earn CPD points to boost your professional credentials in information security. #ISO27001 #CyberSecurity #InformationSecurity #InfoSec #Webinar #Compliance #ITGovernance #GRC #ExpertAdvice #CyberResilience #DataProtection #SecurityStandards #CyberRisk #ProfessionalDevelopment #CPD #CyberProfessionals #CyberCareer #Cyberexperts #ISOStandards

11