Colin Cassidy.

This week I've been mulling over planning timescales for information risk and security management - a pertinent topic as we plummet towards the new calendar year and, for many, the new financial year. How's it going with your 2025 budget? Do you have an eye towards 2026 and beyond? https://lnkd.in/gUFiKpyZ

8

6 Comments

The more I read about the extensive PII leak from NPD the more I’m frustrated. At this point in time countless companies want your PII but there are no laws, incentives, regulations etc in place to ensure they are doing right with their cybersecurity to ensure your data is safe. NPD managed to leak 237 million individuals PII because they had a clear text zipped up document hanging on their website that listed usernames and passwords (many using the same default password issued across the board that was only 6 characters). This is 100% unacceptable and people shouldn’t continue to be victims to companies that can’t or won’t pay for proper cybersecurity.  What has to take place for companies to take this seriously? Is it immense fines per individuals data? Jail time? What are your thoughts? https://lnkd.in/eTG_ksWq

12

7 Comments

New regulations that came into effect on April 29, 2024 (#1007) aim to improve consumer protection by requiring stricter security measures for internet-connected products like smart TVs, speakers, air-friers, coffee machines and wearables. ❓What you need to know: - Applies to any business producing, selling, or distributing these products in the UK. - Requires risk assessments, security measures, and clear communication of those measures. - Regular security updates and a point of contact for reporting vulnerabilities are mandatory. 💸Non-compliance can be costly: Fines up to £10 million or 4% of global turnover. Product removals and potential liability for damages.

8

#Crowdstrike has released its Root Cause Analysis - 12 pages of details which ultimately boils down to inadequate testing, in other words a systemic issue. Perhaps not surprising, but we can't depend on our service providers putting in place adequate quality assurance processes, we need to consider doing more testing prior to deployment - or consider alternative solutions. #testing #qualityassurance #cyber

22

1 Comment

The Nikki-Universal ransomware attack shows how quickly things can spiral when cybercriminals strike—and why the stakes are higher than ever for businesses worldwide. Attacks like these aren’t just about encrypted files; they’re about leaked secrets, operational chaos, and reputation damage. With hackers using tactics like double and triple extortion, it’s clear: defense strategies must evolve. For more insights and analysis, check out the detailed post on Matisoft’s LinkedIn page. Follow Matisoft Cyber Security Labs for more insights and updates on this and related topics. #MatisoftLabs #Cybersecurity #RansomwareAttack #DataSecurity #RiskManagement #IncidentResponse #CyberResilience

1

Where is your data? Who hosts that data? What contracts are in force to protect your data being "handed over" to third parties at a whim? If Police Scotland struggle to get their head around the implications of their actions, how are SMEs supposed to cope? Do SMEs have the legal wherewithal to understand the Cloud Act? (Do SMEs even know where their data is? Much of it is likely lurking in the shadows, after all). I know I'm asking questions rather than answering them. Cloud services were meant to make our lives easier, but do they? #cloudsecurity #ico #shadowdata https://lnkd.in/eetuxeQZ

8

1 Comment

Any of my recent ramblings caught your attention? Considering a BSides London submission after some time. Topics I've been exploring include measuring and categorising resilience, ATT&CK, Linux, security engineering, and regulatory changes. #BSidesLondon #CyberSecurity #SecurityEngineering #RegulatoryChanges

22

4 Comments

ISO 27001:2022 transition challenges and how to use ISO 27002 Matthew Peers from IT Governance Ltd once again offers his practical expert insight, this time into ISO 27001:2022 transition challenges. Also, I love how he refers to ISO 27002: the “good ideas book” :) As Matthew explained: “If you’re struggling with how to implement a given control, look at the guidance in ISO 27002. It’ll jog your memory, or spark some ideas to get you on the right track. “Or you might come at it from the other direction: ‘This is how we’ve previously done it; is there a better way of achieving that?’ Then you’d refer to ISO 27002 to see if you can borrow ideas. “It can also trigger ideas by reminding you of things you need to achieve, even without being specific about how to achieve them.” Read the full interview 👇 https://lnkd.in/gxdxBXS6

4

Compliance doesn't have to be a painpoint! We've recently closed out and delivered a handful of ISO 27001 internal audits and vCISO support for ISO 27001 and the feedback is in! Below is an example of some awesome Trustpilot feedback from an awesome customer we helped get ready for their ISO 27001 audit. 👇🏼 Each business is a unique rubiks cube of challenges and opportunities. Getting to understand them in a finite amount of time to advise on the effectiveness and efficiency of security controls is an art as much as a science. At Steel FYI we pride ourselves in giving practical, friendly, and commercially-minded advice on how to achieve compliance and prevent material breach, without tying the business up in red-tape. If you want some support in making ISO 27001 work for your business, not the other way around, drop me a message 📨

21

You know, I really do wonder. It seems we almost always need multiple investigations, 'expert' opinions, analysis, reports, and then even more reports.. to conclude something that is (bleeding) obvious. Ask any affected parent, SEN child, teacher or care professional, and they'll tell you the same thing they've been saying for years. Yes, the SEN system really is broken. Very broken. But what we will see, of course, isn't the practical planning and action needed to make worthwhile changes. Oh no. It'll be more time and resources frittered away on further reports and investigations, finger pointing and scapegoating, handwringing, apologies (unlikely), empty rhetoric and promises. And then.. the cycle will repeat. https://lnkd.in/dYXGjzZs

3

1 Comment

The UK government’s Research Institute in Trustworthy Inter-Connected Cyber-Physical Systems (RITICS) (that's a mouthful!) has just released a document offering guidance in securing operational technology (OT) and industrial control system, (ICS) hardware. It's a quick 20-page guide and a good reference to prepare for ICS/OT incidents. Organisations should be treating ICS/OT separately from other IT assets, with specific incident response plans and playbook targeting these systems. You can access it here: https://lnkd.in/gkyWBhzg #ics #ot #cybersecurity #bestpractices #ritics #danweis #nexon #hackproofyourself

7

1 Comment

What's in a Name? Having led the response to major reliability and cyber incidents over the last 15 years, I am fascinated by how the names of incidents often starkly contrast with those of projects. Projects typically bear grand titles, invoking historic milestones or badges of greatness 🏆, while incidents are given more mundane, boring names. Take the recent CrowdStrike incident, for instance, named "Channel File 291." In contrast, consider project names like "Apollo" or "Titan," which evoke a sense of grandeur and ambition. Even the actual sensor in question, Falcon, symbolizes agility and precision. Unfortunately, these attributes were not evident in the incident a few weeks back. And no, "Blue Screen of Death" was not a contender ☠ . This naming convention highlights how incidents, despite their significant impact, are often treated as routine problems to be managed and resolved. In contrast, projects are celebrated endeavors aimed at achieving major milestones. #IncidentManagement #ProjectManagement #CyberSecurity #TechLeadership

2

This is a fantastic article by John Althouse. It does a deep dive on new security research into TCP Fingerprinting - JA4T. This builds tremendously on the previous research into TLS fingerprinting, JA4, which you now see being implemented in WAF solutions, such as AWS WAF. Fingerprinting TCP allows you to gain visibility into what devices are being used, whether the traffic is proxied, or even what cellular provider the device is on. This will enable firewalls to build more robust logic to protect against TLS as well as non-TLS traffic https://lnkd.in/ehtSxP8d

12

More about the DORA Registers of Information - Check out the ICTTF DORA Blogs https://lnkd.in/eU2JbWSK ICTTF - Cyber Security Community, Academy and Events

1

𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐑𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭𝐬: 𝐓𝐡𝐞 𝐟𝐨𝐮𝐧𝐝𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐒𝐒𝐃𝐋𝐂 A few years ago I was brought in to help with security for a project at a large retailer in the UK. They were building out some web APIs that listed which products a customer might want to buy, based on previous orders they’d made. One of the first questions I asked was “How are we managing GDPR requirements?”. A look of concern came across everyone’s faces. The team had done a lot of work on setting up functional requirements and tests but didn’t know security and regulatory requirements were a thing. A couple weeks of rejigging the architecture and a few late nights later, the API was updated to include “right to be forgotten” functionality. This was hard evidence that the “shift left” mantra that security folks have been banging on about has some merit. Those late nights could have been avoided if we included security in the requirements phase of software development. Yes, that includes Agile! The goal here is to identify risks early and embed security requirements into the project from the very start. 𝐖𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐬 𝐢𝐧 𝐭𝐡𝐢𝐬 𝐩𝐡𝐚𝐬𝐞? 𝘐𝘥𝘦𝘯𝘵𝘪𝘧𝘺 𝘚𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘙𝘦𝘲𝘶𝘪𝘳𝘦𝘮𝘦𝘯𝘵𝘴 Whether you use Scrum, Kanban, Waterfall, something else… it doesn’t matter. They all have steps where security requirements can be injected early on in the software development lifecycle. Examples of security requirements: - All requests to the API must be authenticated. - Unauthenticated requests will be redirected to the login page. - Each API method must restrict access only to users who require access for their job role.R3All traffic to and from the app must be over TLS 1.2. - There must be a mechanism to permanently delete PII data from the database. - Every login/logout event must be sent to the SIEM. One thing I like to do is write my requirements so that they can be tested programmatically. 𝘋𝘦𝘧𝘪𝘯𝘦 𝘚𝘶𝘤𝘤𝘦𝘴𝘴 𝘔𝘦𝘵𝘳𝘪𝘤𝘴 "If you can’t measure it, you can’t manage it" In addition to testing your security controls against the requirements, we also need to understand what success looks like. It helps to set quantifiable goals during this phase of the SSDLC, so everyone knows what to work towards. Eg: - SAST tool shows zero vulnerabilities. - DAST tool shows zero vulnerabilities. - Penetration test results with all Critical, High and Medium issues remediated. - App is onboarded to our bug bounty program. - Compliance checklist: Ensure every requirement is tested and reviewed. Metrics like these will guide the team throughout development and act as criteria for release approval. 𝐎𝐮𝐭𝐩𝐮𝐭𝐬 By the end of this phase, you should have: - A comprehensive list of security requirements and their associated tests (in text form) - Clear metrics for success to track throughout the lifecycle. - Buy-in from all stakeholders, ensuring security isn’t just a side task but part of the plan from day one. More at

3

Thanks for commenting in Chasing Cyber on the QRNG Framework we published last week (https://lnkd.in/etETiMGZ), Duncan Jones. As my colleague, Itan Barmes, Quside's Carlos Abellan, and I worked through the drafts we did indeed strive to make the point that you highlight: that such frameworks can help provide a degree of assurance and market differentiation. I look forward to seeing how this type of activity evolves as industry requirements for quantum cyber readiness continue to crystallize. As Itan Barmes consistently points out, topics like this are, of course, more broadly applicable than the quantum threat. Adnan Amjad, Mark Nace, Emily Mossburg, Scott Buchholz, Deborah Golden, Clare Harding, Duleesha Kulasooriya, Robert Hillard, Dana Spataru, Marc Verdonk, Niels van de Vorle, Itan Barmes, Casper Stap, Ben Shapiro, Vikram M., Rita Gatt, Julie Gleeson #Deloitte #CyberRiskManagement #QuantumCyberReadiness https://lnkd.in/eNiQaMxN

28

3 Comments

The PCI DSS v4.0.1 update provides much-needed clarifications that can help us all strengthen our cybersecurity measures. With clearer guidelines on MFA and payment scripts, we can better protect sensitive data. How is your organization adapting to these changes? Reach out to Arbure for a deep dive into these updates. #PCIDSS #Cybersecurity #Compliance #PCIUpdate

4

This is a fascinating and informative article from Bitdefender. Based on personal experience, they did have their bad releases last time. It is crucial to understand how software release cycles are managed and to control the quality to minimise potential outages caused by bugs. 1. How software features/functions and bugs/vulnerabilities fixed are planned, quality control and its impact on long-term maintainability. Because the features/functions released are not a one-time bespoke tailored suit but require long-term maintainability for bugs/vulnerabilities. This is often overlooked by many in the IT Industries 2. Software release quality control is not only the supplier's responsibility; the user must also have an almost identical environment to test before rolling out to their field production. The reason is that no supplier can thoroughly test all various setups with other software residing in the same system. Users are required to at least do some basic testing before rolling out to their production, even if the most critical vulnerabilities need to be fixed. It is a balance between time to fix any bugs that slip through QA and caused outages. But this is again often overlooked because it is expensive to maintain a test team and environment. This outage is a good learning lesson for many. #softwarelease #sqa #crowdstrike #microsoft #cybersecurity #qualitycontrol Pure Storage Nirav Sheth Yishuen Chin Kelvin Tuan Hock Leng Chua Jenson Chong June Tay Mike Tang Alicia Sim Sylvia Tong Pratyush Khare Kekin Lim

16

1 Comment