Jamie Rose

Compliance doesn't have to be a painpoint! We've recently closed out and delivered a handful of ISO 27001 internal audits and vCISO support for ISO 27001 and the feedback is in! Below is an example of some awesome Trustpilot feedback from an awesome customer we helped get ready for their ISO 27001 audit. 👇🏼 Each business is a unique rubiks cube of challenges and opportunities. Getting to understand them in a finite amount of time to advise on the effectiveness and efficiency of security controls is an art as much as a science. At Steel FYI we pride ourselves in giving practical, friendly, and commercially-minded advice on how to achieve compliance and prevent material breach, without tying the business up in red-tape. If you want some support in making ISO 27001 work for your business, not the other way around, drop me a message 📨

21

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

The problem isn’t the “hackers” but the leadership within companies that sit in the supply chains of critical national infrastructure who merely strive to tick boxes. If they can be bothered, of course. High profile attacks often show that the target of the attack doesn’t have the minimum certification they should have to be in that supply chain. Synnovis weren’t certified to the minimum standard of Cyber Essentials on the day of attack. Nor did they have Cyber Essentials Plus. If they can’t attain or maintain Cyber Essentials as a bare minimum, how can they actually remain a supplier to critical national infrastructure? By NOT being certified to the standard on the day of the attack, shouldn’t that make the leadership of the supplier culpable in some way? If directors were held personally liable, rather than the company being liable wouldn’t that be a mechanism to pull heads out of the sand and actually tackle this problem? This is a war we’re not winning.

9

Need help with #NIST, or #ISO27001 compliance? I've seen a rapid rise in businesses demanding these accreditations from their suppliers and Punk Security Limited has a lot of experience in performing Gap analysis and implementation for both.

8

Where is your data? Who hosts that data? What contracts are in force to protect your data being "handed over" to third parties at a whim? If Police Scotland struggle to get their head around the implications of their actions, how are SMEs supposed to cope? Do SMEs have the legal wherewithal to understand the Cloud Act? (Do SMEs even know where their data is? Much of it is likely lurking in the shadows, after all). I know I'm asking questions rather than answering them. Cloud services were meant to make our lives easier, but do they? #cloudsecurity #ico #shadowdata https://lnkd.in/eetuxeQZ

8

1 Comment

The Nikki-Universal ransomware attack shows how quickly things can spiral when cybercriminals strike—and why the stakes are higher than ever for businesses worldwide. Attacks like these aren’t just about encrypted files; they’re about leaked secrets, operational chaos, and reputation damage. With hackers using tactics like double and triple extortion, it’s clear: defense strategies must evolve. For more insights and analysis, check out the detailed post on Matisoft’s LinkedIn page. Follow Matisoft Cyber Security Labs for more insights and updates on this and related topics. #MatisoftLabs #Cybersecurity #RansomwareAttack #DataSecurity #RiskManagement #IncidentResponse #CyberResilience

1

Are you looking to improve your leadership skills? I had the pleasure of meeting Andy Ellis at RSA last week and have been digging into his book ever since. Being one of the most well-known and experienced cybersecurity leaders, he shares dozens of lessons and observations that anyone, at any stage of their career, can use to create a work culture of continuous improvement and strong leadership Andy Ellis is a graduate of MIT and former US Air Force officer. In his 20-year tenure, he designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1,000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business.  Andy is now the founder of leadership development firm Duha, where he teaches his leadership philosophy not only to other executives, but strives to make leadership training more accessible to people at all career levels. My takeaways so far: ✅Focus on the present, worrying about failure can make it happen! ✅Consistency matters ✅Performance development is for EVERYONE in your team. Grab a copy if you’re looking to improve your leadership skills, I’m glad I did. #leadership #cybersecurity

30

New regulations that came into effect on April 29, 2024 (#1007) aim to improve consumer protection by requiring stricter security measures for internet-connected products like smart TVs, speakers, air-friers, coffee machines and wearables. ❓What you need to know: - Applies to any business producing, selling, or distributing these products in the UK. - Requires risk assessments, security measures, and clear communication of those measures. - Regular security updates and a point of contact for reporting vulnerabilities are mandatory. 💸Non-compliance can be costly: Fines up to £10 million or 4% of global turnover. Product removals and potential liability for damages.

8

*Salaries & Spending Priorities in Security* The NHS & Defence spending are big talking points here in the UK as we ramp up to the election, yet this major story has got little to no traction nationally? From a recruitment perspective one of the issues around the public sector is one shared by a lot of those in the private sector currently... pay. Specifically salaries and the short termism that surrounds these decisions. I once worked with one of the UK’s 5 great offices of state on hiring contractors for thier security programme. The permanent CISO was on around £65K as per civil service salary banding (I know not all of them are). The de-facto deputy who was contracting and running the re-org? Over £1,000 per day. The contracters going in? £450 - £550. The money was there, the allocation of it? Mindboggling. I don’t even want to think about what the total consultancy spend was. It’s a false economy at play. It always seems very expensive to pay good salaries (sector will dictate what good looks like). But it’s always more expensive to hire cheap, or poorly and have to clean up afterwards! (To be clear there’s absolutely a place for top consultants and contract talent!) I feel incredibly sorry for the NHS teams affected here in this story because there is no way they are properly resourced to cope with the aftermath of a state-sponsored attack. This is much less pronounced in the US as well (though UK - US salary comparison is whole other discussion). So what’s the answer? Higher salaries (Very politically controversial in a cost of living crisis) A more centralised UK Cyber Security function under the MOD or GCHQ as part of a national defence strategy? Increased remote work to hire more senior candidates in more remote locations or to better attract more technical talent in general? Innovative solutions on a postcard please (Increased personal allowance, ability to allocate more pension to salary?) More pertinent to the private sector (though pay is an issue in some cases!) is talent pipeline and tenure in role, but more on that tomorrow. https://lnkd.in/eZSUMmvY #securitybreach #cybersecurity #ukcyber #informationsecurity

12

🚨 Attention Business Owners! 🚨 A recent cybersecurity breach has exposed the personal data of nearly 70,000 Welsh Rugby Union supporters' club members. Names, addresses, phone numbers, emails, and payment details were all leaked. 😱 This incident highlights the critical importance of robust cybersecurity measures. Here are a few takeaways: 🔒 Secure Your Data: Ensure your data protection strategies are up-to-date. Encrypt sensitive information and regularly update your security protocols. 🛡️ Employee Training: Educate your team about cyber threats and safe practices. Human error is often the weakest link in security chains. 📈 Regular Audits: Conduct frequent security audits to identify and address vulnerabilities before they can be exploited. 📞 Incident Response Plan: Have a clear action plan for potential breaches to minimise damage and restore trust swiftly. Cybersecurity isn't just an IT issue—it's a business imperative. Protect your business, your data, and your reputation. Don't wait for a breach to take action! #CyberSecurity #DataProtection #BusinessSafety #TechNews #StaySecure https://lnkd.in/egW_i32Z

3

Another attack; another breach; and the same advice to those impacted - change your passwords and adopt a hygienic approach to password management. I have 452 credentials stored in my own personal password safe/vault. I don't think I'm that much of an outlier, but that is a lot of passwords and that means my "person attack surface" is already frightening. And it's not just passwords. I couldn't tell you off the top of my head what information is being held about me in a lot of those systems/platforms/apps/sites - are their credit card details on file, PII, preferences, other information they have "inferred"? As consumers, we put our trust in these suppliers of services that they will look after our information. It's not good enough that they say: "sorry, would you mind changing your passwords". They shouldn't let it happen in the first place! #breach #attacksurface #password #passwordhygiene https://lnkd.in/eHMsG5Qb

15

Time for a rant! Boy, haven't I read this piece of utter BS from almost any "political" body. Whether UK / US / Germany ... doesn't matter. ALWAYS the same friggin idiocy. Let's put in some sense into this blabber. About not enough candidates in universities: Well, as "cyber, cyber, cyber" is first and foremost a software, then a complexity and then a configuration problem, it would be so INCREDIBLY AWESOME if those building this dire heap of shit we nowadays call software- or tech-stack would learn "how-to-build-software-securely" IN THE FIRST PLACE! Can't be that hard, can it? There're literally hundreds of books dealing with just that. How to actually build software - AND TEST IT THEN !! - securely. Developing software is NOT an IT-Sec Pro job! Same goes for "IT-professionals": Why don't they learn how our biggest attack surface ever - aka MS - can be administered securely? (Possible, indeed duh!) Yes, it's a huge, extremely overcomplex, monstrous hydra to be tamed. So, what? That's what businesses went for. Deal with your decisions consequesces and stop whining! Administering is NOT an IT-Sec Pro job! High attrition rate: No shit sherlock! IT-Security pros these days need a complete other skill set than trained! They need the capacity to deal with the harbingers of chaos -> humans! Because "humans" are the root cause for this incredibly shitty landscape of operated "days of open doors for anyone"! No, I don't mean normal office staff. Clicking on mail will hardly do any harm nowadays ... anymore -> IF you actually run a patched up, up-to-date Microsoft stack. ... and pay the money, of course. (Welcome to the golden cage.) Those posing the biggest threat are Managers and C-Levels in NOT allowing absolute basics to be done properly and demanding "Cyber,cyber, cyber" to clean up the mess they created. The job of a cyber-sec Pro is ACTUALLY to get "people" to either do the right things OR at least not stand in the way. Therefore you need the following skills: - Communication (happy nerding as a mole is no more! Learn business lingo.) - Psychology (You're dealing with THE most diffucult NI there is!) - Leadership skills (YOU're the expert! You tell them what to do.) - Influencing (They need to do what you want them to ...) - Self-confidence (shaking in front of C-Level decinding on your budget doesn't help) That's for starters. These very simple steps would close this "gap" already considerably!

2

7 Comments

Questions for NIS Compliance interest... We are helping many organisations with  NIS compliance work and have an interest in other organisations' experiences. Vibert Ltd advises NIS and NIS2 compliance as an ex- NIS Regulator and have many common findings. What do you experience? NIS and NIS2 are driving cyber/resilience improvements across many industries. Some are responding faster than others. Which industries are slowest and how can we all help them better? NIS2 will be a tidal wave starting in 2024 with addition of thousands of organisations, many new sectors, and accountabilities of Essential and Important entities. NIS V1.2.x UK may also do similar in future..... How will CAs and CSIRTs manage this mega wave? Our typical services may comprise, for example: NIS Advisory to CxOs/Boards/Senior Staff and NRO/DNROs etc. on NIS importance. NIS Advisory to OES for Inspection Readiness walk arounds and workshops. NIS Advisory to OES as Dummy Inspections. NIS Advisory regards Regulatory Enforcement. Teams calls with Seniors. Other possibilities.. Suggestions? Our NIS visits offered typically discuss topics like : - The Inspection Schedule across each phase. Interactions with Regulator during Inspections. Site visits: Where, how, and what is looked for. Each day of an Inspection. CAF discussions. Typical topics of an Inspection. What to prepare and how to present. What will be the outcome of each day and each phase. Who will attend from the Regulator and the OES. What will be asked and what won’t be said. Timelines. Outcomes. Information Notices and Fines. How to be best prepared. Etc. What topics are we missing? As an Ex-OFGEM NIS Inspector, we offer customers a unique insight into NIS Inspection preparedness that teams might find a useful differentiator. Some Consultants add us into their CAF programmes, just for a handful of days, which gives them a strong sales boost. We currently assist several OES in preparation for NIS Inspections. We trained many of the other Competent Authorities Inspectors in “our way” as we were leading UK (and probably EU) in NIS Inspections. E.g. OFGEM, ICO, DfT, CAA, HSE, DWI, etc. Suggested USPs… :- "Ex-NIS Regulator Principal Inspector Advisor"!!.. "Led the UKs 1st NIS Inspections"... "Developed the UKs NIS Inspection and Enforcement Programmes".... "Trains NIS Inspectors"... "Covers IT, OT, Cyber, Physical Security, Process, GRC, etc.".... !! We look forward to hearing from Operators and from Consultancies so we can develop the right SOW and Proposal for all our needs. How can we all help to assist more compliance as it will benefit society as a whole. Cevn Vibert CITP CEng FIET FInstMC FBCS 27kLA GICSP Global Director NIS Advisory and OT Industrial Security. [email protected] Vibert Ltd. www.vibert.ltd.uk #QuestionForGroup

6

New Blog! This time focussing on Security Monitoring, this is my background subject really, but this one doesn’t talk about the solutions you could implement for a good reason, because the most important thing is your need. A lot of businesses don’t get value because they listen to the vendor not their own business, having the need nailed down will save unnecessary cost and make your vendor relationship more sustainable. There are some tips in here that you should be aware of when approaching or re-approaching your perfect solution (if there is such a thing).

8

1 Comment

Would you recommend managing your IAM and CIAM within the same or different teams? This is a question that has come up recently and I would be keen to hear peoples thoughts! I would say that around 70% of the companies I speak to have the teams run separately as even though there may be cross over with the tooling they have a very different mission statement. The arguments can change dependent on company size and a single team could ensure consistency across all identity management practices but I would personally say that keeping them run as a separate team would be the better route due to differing user experience priorities. What are your thoughts? #IAM #CIAM

40

11 Comments

learn how VFC has been used successfully in real world scenarios by attending this webinar.

1