Rachael Greaves

Cyber Assessment Framework (CAF) 3.2 Released! 🚀 This week, NCSC announced the latest update to the Cyber Assessment Framework (CAF), Version 3.1, which continues to support and enhance cyber resilience across the UK's Critical National Infrastructure (CNI), organisations adhering to the Network and Information Systems (NIS) Regulations, and those dedicated to cyber-related public safety. Here's your whistle-stop tour of the CAF, and the changes released this week: ❓ What is the CAF? The CAF is a set of guidelines developed to help UK organisations (usually CNI or within the NIS scope) improve their cyber resilience. It provides principles, outcomes, and indicators of good practice for organisations to assess and improve their cybersecurity measures, promoting a risk-based approach to managing cyber threats. 🔍 What’s New? Language Enhancements: NCSC has made revisions to improve clarity and consistency across the Framework’s Principles, Contributing Outcomes, and Indicators of Good Practice. Significant Updates: In alignment with the new Government Cyber Security Strategy, which places the CAF at its core, they have introduced a "Partially Achieved" level for the IGP concerning Media/Equipment Sanitisation. This update recognises the unique data confidentiality risks managed by public sector organisations. 💡 NCSC's Pro Tip: Always use the supporting guidance alongside the Framework. The added context is invaluable for interpreting and applying the Framework effectively. #CyberSecurity #CAFUpdate #CyberResilience #UKCNI #PublicSafety #NISRegulations #RiskManagement #CyberAssessmentFramework

30

2 Comments

#OSINT and #disinformation journalism has developed rapidly in the last few years but there are still big gaps in analytical and technical skills. One manifestation of this is the readiness with which "disinformation" is attributed to foreign state activity with little or no evidence. Social media platforms are then blamed for not responding but the reality is that these claims about hostile state info ops need more proof than researchers frequently offer. We've seen this in the UK in both the recent election and the Southport riots. 👇 "This over-vigilance and reductive thinking extended to responses to the UK riots. Mainly poorly researched articles claiming—without nearly enough evidence—that disinformation about the Southport attacker’s ethnicity was part of a Russian-linked IO. More holistic research that contradicted these claims came shortly after, which showed that better research is possible, but that there is nothing forcing journalists to do so. The lack of a consensus in public reporting about standards of attribution, methodology, and evidence when writing about digital harms, means that the quality of reporting on digital threats is going to vary hugely. This wouldn’t be too much of a problem if the quality of public media wasn’t such an important pillar of wider societal digital resilience and threat awareness."

24

Labour's Cyber Security and Resilience Bill announced earlier this year seeks to fortify the UK's critical infrastructure in an age of ever-evolving and escalating cyber threats. Our recent blog post, "New Cyber Security Bill to Fortify UK’s Critical Infrastructurenpieces together the key objectives, and implications, of the proposed legislation: https://lnkd.in/evJGbHeF... Here are the highlights: 🔐 The Bill seeks to facilitate a more effective and coordinated response to cyber threats by fortifying communications and collaboration between government, industry, and law enforcement. 🔐SMBs will face increased regulatory requirements, including enhanced incident reporting and increased compliance burden. This could lead to potential cost increases through investment in additional security measures. 🔐 The new Bill emphasises the need for the adoption of a proactive approach to cyber security, especially for SMBs. This includes conducting regular risk assessments, investing in training, and implementing strong security measures. #WeAreBabble #Babble #CyberSecurity #UK #Legislation #CyberThreats #DataProtection #SMBs #BusinessSecurity #Technology #RiskManagement #CyberResilience

13

This week I've been mulling over planning timescales for information risk and security management - a pertinent topic as we plummet towards the new calendar year and, for many, the new financial year. How's it going with your 2025 budget? Do you have an eye towards 2026 and beyond? https://lnkd.in/gUFiKpyZ

8

6 Comments

ICO launches new data protection audit framework The Information Commissioner’s Office (ICO) has launched a new audit framework designed to help organisations assess their own compliance with key requirements of data protection law. It said the framework enables public bodies and third sector organisations to identify necessary steps to improve their data protection practices and create a culture of compliance, and provides them with a starting point to evaluate how they handle and protect personal information. https://lnkd.in/eBBBPckB #cybernews #cybersecurity #audit #framework #ico #dataprotection #data

4

NCSC and insurance industry issues ransomware guidance for UK firms The guidance focuses on reducing attack impacts by offering advice on decision-making, legal considerations, and recovery. Organisations in the UK have been provided with new guidance to handle ransomware incidents, a significant threat in the current cybersecurity landscape. The guidance, developed jointly by the National Cyber Security Centre (#NCSC) and #insurance industry bodies #ABI, #BIBA, and #IUA, aims to assist organisations and their partners in responding effectively to #ransomware attacks. https://lnkd.in/euUUxi2f #cybernews #cybersecurity

1

👉 Quick question: If your organisation had a data breach and the ICO (Information Commissioners Office) asked, could you confidently say ‘yes’ to the following 5 statements? ❓ I can demonstrate what PII (Personal Identifiable Information) is stored, processed and transferred, including suppliers ❓ I can demonstrate where the PII is stored and processed (in the cloud, on-premises etc) ❓ I can demonstrate how access to the PII is controlled by policies, procedures, and other technical controls ❓ I can demonstrate why the PII is being processed (lawfulness) ❓ I can demonstrate my staff are suitably trained in data protection and information security If your answer to any (or all!) of the above is no, here are some actions you’ll need to consider implementing in your organisation: ✅ If you’re new to the topic then check out https://lnkd.in/eKMy_KgE - or get in contact with one of 3VRM’s experts. ✅ Build a data inventory & supplier inventory - try and be as accurate and wide-reaching as possible, bringing in all third party suppliers as well as your everyday data contributors. ✅ Build data privacy into your pre-contract third party risk assessment processes. ✅ Undertake a Data inventory/Data Privacy Impact Assessment (DPIA) Create and implement policies, procedures and assess technical controls with DPIA, including privacy notices. ✅ Maintain register of annual training, including assessment and pass marks. Refresh training content as and when there are any changes in regulations. Think you’re fully compliant to GDPR requirements? Have you factored your third party supplier dependencies into your compliance planning? If you’re in any doubt about any of the above then come and talk to one of the team at 3VRM today. #gdpr #thirdpartyrisk #legalgdpr #businessregs #ico #businessrisk #supplierrisk #gdprregulations

21

Mitigating information security risk 👇 Risk management is fundamental to information security and the international standard for information security management, ISO 27001. In our blog post, we cover: 🛡️Risk appetite 🛡️Addressing high risks 🛡️Risk responses 🛡️Modify the risk 🛡️Share the risk 🛡️How a risk response can introduce a new risk 🛡️Retain a risk 🛡️Monitor and review risks Read the full article 👉 https://ow.ly/SHfm50Tn4sA #InformationSecurity #RiskManagement #ISO27001 #CyberSecurity #RiskAppetite #RiskResponse #CyberRisk

11

Sometimes there is an ulterior motive to our posts. The results were not surprising for me. NIST 2.0 is clearly used within the UK but ISO standards are more common place. ISO 27701 is a great supplement to ISO 27001 but I would encourage all DPOs not to wait for your IT teams, ISO 27701 can be implemented independently and is a great tool for understanding your compliance. The real benefit is that ISO 27001, ISO 27701 and NIST 2.0 are all included within ProvePrivacy so the choice is all yours. Book a demo or PM me. https://lnkd.in/eEPHph8D

8

1 Comment

The UK government has recently unveiled a new code of practice aimed at bolstering software security, but it has received a mixed response from industry experts. This voluntary code, developed by the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT), outlines measures for software developers to enhance the security of their products. The code applies to all types of software, including cloud-based applications, and aims to address vulnerabilities that could be exploited by cybercriminals. While some experts praise the initiative, others argue that it lacks teeth due to its voluntary nature. Critics suggest that without mandatory compliance, the code may not effectively drive change in the software development industry. Emphasis is given to the importance of secure design, development, and maintenance practices, encouraging developers to implement measures such as: - Regular security testing - Timely patching of vulnerabilities - Proper documentation of security features This move aligns with similar efforts in other countries, including the United States, to improve software security standards and reflects growing concerns about software vulnerabilities and their potential impact on national security. However, its effectiveness remains to be seen, given its non-binding nature. As the digital landscape continues to evolve, it's crucial for both developers and users to prioritise software security. While the UK government's initiative is a step in the right direction, it may require further refinement and possibly stronger enforcement measures to achieve its intended goals. #UKCyberSecurity #SoftwareDevelopment #CyberRiskManagement #TechPolicy

1

Thought provoking course ✔️ Keeping up with my CPD ✔️ #dataprotection #cpd #dataprotectionaudit

5

Is your business interested in achieving Cyber Essentials? Cyber Essentials Users have been surveyed as part of an Impact Evaluation of Cyber Essentials carried out by the UK Government (DSIT) https://lnkd.in/e5kjRu4Y. After going through and analysing the findings I have collected together some interesting statistics that highlight the benefits businesses have found with achieving Cyber Essentials. 🔐 😎 Greater Confidence: 91% of Cyber Essentials users say that the scheme has directly improved their confidence at being able to consistently implement steps to reduce cyber security risks. 📖 Improved knowledge - 88% of Cyber Essentials users believe that the scheme has directly improved their understanding of the steps they can take to reducing those risks. 💲 Commercial Benefits: 80% identify a commercial benefit that being certified can reduce the financial cost to their organisation of a common, unsophisticated cyber attack. IT Governance are one of the founding certification bodies with a team of experienced assessors. You can view our Cyber Essentials packages using the following link: https://lnkd.in/ep5ecPmg If you have any questions feel free to message me on LinkedIn 📩 #CyberEssentials #CyberEssentialsPlus #CyberSecurity #IASME

2

Another supply chain cyber attack. This time on the NHS potentially with live threatening consequences and blood transfusions and tests are impacted. It is yet another reminder that due diligence on suppliers must include their cyber security and data protection. Many companies are either open to audit or will provide their accreditations or auditor supplied reports, such as: - Cyber Essentials - ISO 27001/2 - NIST (US National Institute of Standards and Technology) cyber security framework - ISAE3402 SOC I or II reports I may do a later post into the nuances of these various reports and accreditations. What is interesting in the NHS case is that Synnovis are a joint venture between Synlab UK & Ireland and Guys, St Thomas’s and Kings NHS trusts. I ask the question were they subject to third party risk management as a supplier not connected to the NHS would be? If this has given you a cause for concern about your supply chain contact us. #cyberattack #dataprotection #infosec

13

1 Comment

If you are considering ISO 27001 for your organisation, please either: - Do lots and lots of reading and research on how to do it; or - Use a GOOD consultant to help you Please DO NOT use a toolkit. Think it through... Organisations needing/using ISO 27001: - Range from one-person through to behemoth multi-nationals - Are from all manner of industries - Have distinct (and often unique) security requirements - Have varying amounts of resources to support it ...and so on. You simply cannot make an off-the-shelf toolkit that will fit every size, shape or need of every organisation that wants ISO 27001. You will, guaranteed, end up doing: - more than you need; and/or - the wrong things; and/or - having a system that hurts you more than it helps you As an auditor, I can tell the systems that have been implemented using a toolkit. The organisations don't understand why they have large chunks of the system, and they don't perceive any value from the system beyond having the certification. A GOOD consultant, on the other hand, will help you to implement a system that works for the organisation, delivers tangible value and improvement to the organisation's operations and ultimately saves you money alongside improving security. If you'd like to talk about that last paragraph, feel free to get in touch :) Thanks for reading!

29

🔥🔥Hot off the press: UK registered organisations can apply for a share of up to £1.3 million targeting cyber skills and innovation for the growth of the cyber security sector. This funding is from the Department of Science, Innovation and Technology (DSIT). Competition opens: Monday 16 September 2024 Competition closes: Wednesday 9 October 2024 11:00am https://lnkd.in/e57tDZBf The aim of this competition is to develop impactful regional activities and events that focus on supporting the growth of the cyber security sector and the development of cyber security skills. These will be to resolve geographical disparities in the development and growth of the cyber security sector and to reduce the skills gap in the sector. #Cybersecurity #cyberlocal #security #skills

8

Every small business should consider Cyber Essentials certification as a critical step in their cybersecurity journey! Take a look at LP Networks Ltd's blog for more info and drop me a message if you want to discuss this for your business - https://lnkd.in/eUA_rXmk #iasme #ncsc #cyberessentials #assessor

4

🔒 Tip: Create Strong Passwords the NCSC Way! The NCSC advises that strong passwords are critical for securing your accounts and should be: At least 12 characters long to resist brute force attacks. Complex but memorable, using three random words to avoid simple patterns. Avoid using common phrases or easy-to-guess information like birthdays or pet names. Consider using a password manager to generate and store complex passwords safely. Remember, a strong password is your first line of defense. #CyberEssentials #NCSC #PasswordSafety #CyberSecurityTips #IQinIT

1