Stephen Gani

𝗔 𝗻𝗲𝘄 𝗽𝗮𝗿𝗮𝗱𝗶𝗴𝗺 𝗳𝗼𝗿 𝗰𝘆𝗯𝗲𝗿 𝗱𝗲𝗳𝗲𝗻𝘀𝗲?     I have been posting about the past sponsors of the PCI Asia Pacific Community Meeting (APCM), namely, LGMS Berhad and ControlCase.    This post will cover an interesting report by our Bronze Sponsor, SISA and it was co-authored with the Data Security Council of India (DSCI), an industry body that protects data in India by driving cybersecurity and privacy best practices, standards and initiatives.    The author(s) captured my attention as soon as I started reading by highlighting:   “𝘈𝘭𝘦𝘳𝘵 𝘰𝘷𝘦𝘳𝘭𝘰𝘢𝘥 𝘵𝘳𝘢𝘯𝘴𝘧𝘰𝘳𝘮𝘴 𝘢 𝘸𝘦𝘭𝘭-𝘪𝘯𝘵𝘦𝘯𝘵𝘪𝘰𝘯𝘦𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘴𝘵𝘳𝘢𝘵𝘦𝘨𝘺 𝘪𝘯𝘵𝘰 𝘢 𝘴𝘦𝘭𝘧-𝘥𝘦𝘧𝘦𝘢𝘵𝘪𝘯𝘨 𝘰𝘯𝘦.”   This has been one of my focus areas and related to PCI DSS Requirement 10 i.e. “Log and Monitor All Access to System Components and Cardholder Data”.  With more systems getting deployed, it can only get more complex with more logs and alerts generated. This is overwhelming the cybersecurity heroes tasked to detect and defend against attacks in the midst of an avalanche of false positive alerts.  SISA quoted from Statista that organizations take around 204 days to detect a data breach!   Since the publication of PCI DSS v4.0, a new requirement has been added for organizations to use automated mechanisms to perform audit log reviews. This is a future dated requirement and will be effective from 1 April 2025, however you are strongly encouraged to consider adopting this requirement soon given current threats.   Back to the document co-authored by SISA... it introduced me to a new acronym, MXDR (Managed Extended Detection and Response).  To over-simplify, this approach provides a comprehensive view and control across an organization with better identification of threats, an ability to respond more effectively and most importantly, the ability to perform monitoring continuously.  Amazing!   Get the report from the SISA website: https://lnkd.in/gpbfWHA8   SISA will be a sponsor and exhibition partner at the North America CM in Boston and they will be back as an exhibition partner at the APCM in Hanoi in November!  Thank you Dharshan Shanthamurthy and team for your support!  This will be a good opportunity to find out more about MXDR from the SISA experts who will be present at the events.    Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. If you have an interest in payments, cybersecurity, compliance, risk management and technology, do consider joining us in either Boston (Sep), Barcelona (Oct) or Hanoi (Nov).  Find out more at the PCI Events link below or drop me a message: https://lnkd.in/g7rBGdSf   #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.

28

1 Comment

The webinar on PCI v4.0.1 March 2025 requirements is now live on our YouTube channel! Dive into the New Requirements with insights from our special guest, Yew Kuann CHENG (YK) from the PCI Security Standards Council. Watch now to stay updated:   #ControlCase #PCIDSSv4 #PCISSC #webinar

12

Register now https://lnkd.in/gaPbMTgP to learn how advanced penetration testing can uncover and identify vulnerabilities in your IT Security infrastructure before hackers can attack! Our featured speaker will be Ashritha Alva - Vice President & Head of Penetration Testing Services, Accorian People often ask: - What is Continuous Penetration Testing - Why does a company need continuous penetration testing? - Who should be involved in the Pen test? - How will the security team perform the intrusive test? - Will the test team exploit vulnerabilities or simply identify them? - How long will it take to perform the pen test? - What valuable information will be included in the report? and more....

3

Singapore is cranking up the heat when it comes to AI in cyber. The Cyber Security Agency (CSA) is planning on releasing a draft of the Technical Guidelines for Securing AI Systems for public consultation, offering "practical measures" to bolster AI security. The CSA has stated that it will include: - Voluntary Guidelines: These can be adopted alongside existing security processes to address potential AI risks. - Adversarial Machine Learning: Techniques that allow attackers to compromise AI models. - Public & Private Sector Collaboration: Essential for understanding and mitigating evolving AI threats. AI is everywhere now, exposing new risks and expanding the attack surface for data exposure, so the more available resources like this, the merrier. ---------------------------------------------------------------------------------- If you're interested in cybersecurity for your organization, connect with me or click the link for the Proofpoint Voice of the Ciso Report. https://lnkd.in/gUhxKKi2

14

2 Comments

Singapore Sets High Bar in Cybersecurity Preparedness The Cyber Security Agency of Singapore's (CSA) Cybersecurity Health Report 2023 highlights the need for proactive measures and education to address evolving threats.

1

What do Lady Gaga and the Ding Ding song have to do with cybersecurity? Well for starters they are catchy and attract attention, but also there is talent and culture behind this (yes some of you will debate this). Most of all, THEY ARE MEMORABLE. We don't have cyber anything that is memorable or catchy. We do training/marketing in the worst possible away for the masses through powerpointless videos, and extensive text. Nobel prize winning nudging behavioural economics approaches are nowhere to be seen (or minimally done). I had the privilege of viewing the Cyber Police real case online tv series (produced for industry and people by Metacompliance) to learn recently. It is SO good and how we should be doing cyber. It's so good that Line of Duty and Blue Line have borrowed from it. How would you bring cyber to the masses?

9

1 Comment

Another case of Ransomware in Hong Kong, this time with Hong Kong College of Technology (https://lnkd.in/gwKmudBg) "RansomHouse" claims to have ransomed HKCT. Why are we getting more ransomware attacks in Hong Kong? 1) Low level of security 2) Easy targets 3) Low repercussions 4) Wealthy targets Get rid of low hanging fruit and know your weaknesses by performing a Red Team exercise. Get in touch with me today to learn more. #redteam #hongkong #ransomware #cyberattack

32

4 Comments

I'm sharing a critical alert from the Singapore Cyber Emergency Response Team (SingCERT) regarding a phishing scam targeting the public. Scammers are impersonating officers from the Cyber Security Agency of Singapore (CSA) and the Police to trick victims into believing they are facing legal action. The Scam: * You receive a fraudulent email claiming a court order has been filed against your IP address due to illegal activities. * The email threatens legal proceedings if you don't respond within 24 hours. Don't Fall for It! Here's How to Spot the Scam: * CSA and SPF will never: * Ask you to transfer money. * Request your banking, SingPass, or CPF information. * Ask you to click on suspicious links. * Request you to download software or apps from unofficial sources. What to Do: * If you receive such an email: * Do not respond or follow any instructions. * Report the incident to SingCERT at [email protected] or SingCERT Incident Reporting Form. * Always verify the authenticity of emails: * Contact the agency directly using official channels (phone numbers or email addresses listed on their website). By staying vigilant and informed, we can protect ourselves from these cyber threats. Let's spread the word and keep our online community safe! #cybersecurity #phishing #onlinesafety #singcert https://lnkd.in/g5iPbvf4

58

⚠️The order has changed for MSPs. Embrace it and rise to the challenge. 🏰Time for Defensibility is Now 🫡We need to Rally the #MSPs to Protect Our Clients 🐲Just like House of the Dragon (#hod) taught us about defending key strongholds. 🪜MSPs must now step up to safeguard our clients in the cybersecurity landscape. 🔥For years, hackers have attacked behind the scenes, exploiting every gap we left open. 👉Now, it’s time to rally, build our defenses, and raise an army of #MSPs ready to protect our clients 🔥 Here’s how we start to #shiftLeft 1️⃣ Fortify Core Infrastructure 👉Build robust defenses for your clients, securing data centers, cloud environments, and critical systems, end users and “all the things”. 2️⃣ Strategic Alliances 👉Partner with key cybersecurity leaders and vendors to strengthen your arsenal. 3️⃣ Proactive Documentation 👍Start by getting your policies, procedures, and compliance in place. Don’t wait for the incident—prepare for it. Build your defenses by ensuring that everything is documented and tested. 4️⃣ Proactive Risk Management 👉 conducting regular risk reviews and gap analysis, defining business outcomes, and tracking those outcomes. 💪Defending our clients isn’t just about reacting to threats; it’s about being proactive and building your defenses now. #CyberDefense #ShiftLeft #MSPCommunity #DigitalProtection #ProactiveSecurity #

10

2 Comments

According to the Singapore Cybersecurity Health Report 2023 launched by CSA, "8 in 10 organisations in Singapore encounter at least one cybersecurity incident in a year. Almost all of these organisations that encounter cybersecurity incidents suffer a negative business impact," shared Reynard Neo, Senior Consultant at the Cyber Security Agency, in his presentation. Here's a #throwback video to Ricoh Singapore's 16 April 2024 Cybersecurity event featuring the Cyber Security Agency. Check it out now at https://lnkd.in/g_hsMazj If you want to learn how to protect your organisation against cyberattacks, contact us at [email protected]. Let us be the first line of defence against cyber threats by building your organisation's cyber resilience. #CSASingapore #RicohSg #Cybersecurity #TrendMicro #CiscoMeraki #RansomWare

19

It's already tomorrow! Looking forward to giving the second masterclass for Singapore FinTech Association (SFA). If you have not yet registered but want to make it at the last moment, send me a direct message, and I will check whether there are still available slots. I hope it would be a very useful session where we present together with Pasi Koistinen so I can share our Bitdefender broad view from work with multiple clients and Pasi Koistinen will deep dive with his experience executing handson internal audit for their company. #cyber #security #compliance #mas #trm

21

Hacktivists turn to ransomware in attacks on Philippines government. Why it matters: 1. Hacktivist operations, using leaked ransomware builders like LockBit and Vice Society, are increasingly targeting the Philippines' critical infrastructure, aiming more to sow disruption and grab attention than to negotiate ransom, reports cybersecurity firm SentinelOne. 2. The Southeast Asian nation, a key player in China’s maritime expansion, saw a significant surge in malicious cyber activity in Q1 2021 with a 325% spike observed. Hacktivist groups and misinformation tactics nearly tripled during the period, potentially destabilizing the country's critical infrastructure. 3. The line between hacktivism and official state-backed activity remains blurred in the Philippines, with reports of the China-linked group Mustang Panda launching information warfare campaigns. Using hacktivist monikers helps threat actors evade attribution while stoking perceptions of homegrown social conflict. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/eXbAdrrS

9

Are Your GRC Strategies Ready for AI Threats? AI is disrupting the risk landscape more than ever before. Deepfakes, data breaches, and other AI threats can devastate your business. Risk and compliance officers, you cannot be left in the dark. Join our webinar hosted by Kerushan Govender, a contributor to the IRMSA Risk Report 2024. He’ll be joined by GRC expert Tichaona Chitsinde (CRISC) (CAMS) (MICA) and IT Lawyer Kevin Hoole. We’re offering insights from every angle, so don't miss this essential session. Click the link to register: https://lnkd.in/dMDbHTv6 #GRC #CURA #RiskManagement #Webinar

7

Around 13% of scams analysed by the Cyber Security Agency of Singapore (CSA) in 2023 were likely generated by AI – indicating that scams are getting more convincing even as overall cyber threat numbers fell or remained constant, compared with 2022 figures. https://lnkd.in/g4DKz4D9

22

2 Comments

🌐 Understanding Singapore's Cybersecurity Landscape: Insights from the 2023 Cybersecurity Health Report 🌐 The recently released Singapore Cybersecurity Health Report 2023 provides a detailed overview of the nation's #cybersecurity landscape, offering critical insights into key findings and emerging trends. 📊 This report not only highlights Singapore's current cybersecurity posture but also underscores the importance of robust strategies to enhance cyber resilience in our increasingly digital world. 🚀 🛡️ As we delve into the implications of these findings, it's clear that proactive measures and continuous improvements are essential to safeguard our digital infrastructure. 🔍 Discover the report's key insights and learn about effective strategies to bolster your cyber defences. 👉 Click to read the full article and gain a deeper understanding of Singapore's cybersecurity landscape! https://lnkd.in/gaiake-c #Singapore #CyberResilience #DigitalTransformation #TechNews #Infosec #CyberHealthReport #SecurityTrends #StaySafe #ProtectYourData

3

The latest release from Check Point's External Risk Management team covers the emerging trends and tactics used by malicious actors in the Philippines. From #ransomware to #phishing to DDoS attacks, the report covers the rising threats and how to combat them. Have a read: https://lnkd.in/g8CWqrXc

1

The Cyber Security Agency of Singapore (CSA) released its first #Singapore Cybersecurity Health Report, revealing that while local organisations have adopted around 70% of essential #Cybersecurity measures on average, full adoption is needed to avoid unnecessary #CyberRisks. Challenges include lack of knowledge/experience and resource constraints. Despite awareness of cyber security standards, only one in three organisations has fully implemented key measures. To support organisations, CSA offers initiatives like free cybersecurity resources, Cybersecurity Health Plans, and certifications. CSA urges organisations to prioritise cybersecurity and utilise available support to enhance their cyber resilience. https://lnkd.in/gdrWgaaU Minimise the impact of cyber incidents on your business. Discover the benefits of cyber insurance with us: https://lnkd.in/dVR8c3-Q

14

Join us as Check Point’s cyber experts share how conventional Data Loss Prevention (DLP) tools perform when it comes to accurate protection of proprietary assets. When: December 11th, 10:00 AM CT 30 minute session. RSVP: https://lnkd.in/g3TzFtEy #cybersecurity #datalossprevention

4