Kieran Grieve Combes

New regulations that came into effect on April 29, 2024 (#1007) aim to improve consumer protection by requiring stricter security measures for internet-connected products like smart TVs, speakers, air-friers, coffee machines and wearables. ❓What you need to know: - Applies to any business producing, selling, or distributing these products in the UK. - Requires risk assessments, security measures, and clear communication of those measures. - Regular security updates and a point of contact for reporting vulnerabilities are mandatory. 💸Non-compliance can be costly: Fines up to £10 million or 4% of global turnover. Product removals and potential liability for damages.

8

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

What's in a Name? Having led the response to major reliability and cyber incidents over the last 15 years, I am fascinated by how the names of incidents often starkly contrast with those of projects. Projects typically bear grand titles, invoking historic milestones or badges of greatness 🏆, while incidents are given more mundane, boring names. Take the recent CrowdStrike incident, for instance, named "Channel File 291." In contrast, consider project names like "Apollo" or "Titan," which evoke a sense of grandeur and ambition. Even the actual sensor in question, Falcon, symbolizes agility and precision. Unfortunately, these attributes were not evident in the incident a few weeks back. And no, "Blue Screen of Death" was not a contender ☠ . This naming convention highlights how incidents, despite their significant impact, are often treated as routine problems to be managed and resolved. In contrast, projects are celebrated endeavors aimed at achieving major milestones. #IncidentManagement #ProjectManagement #CyberSecurity #TechLeadership

2

https://lnkd.in/eEZXMTH4 !!Analysts claim cyber attacks contribute to business failure!! I was going to do a post on BGP hijacking as I have seen some "imaginative" comments about recent events but this is more relevant. A small bonus that comes with being "on the bench" is that I get a chance to listen to the business news in the morning, where I heard that this longstanding retailer is going under administration. My heart goes out to those that may lose their jobs -- but I want to highlight the economic analysts comments: "that a recent cyber attack had damaged trade and cash-flow", this was echoed by the article attached. These days even traditional businesses are digital businesses - yet I find even "Digital", "no-brick only clicks" firms often treat the digital platforms & infrastructure plus the regulations+laws that govern them that "are the means of profit generation" as something other than important. Other things always hold their focus. Here is another example of something as fundamental as malware precipitating a business black-swan event - something a jobbing CISO or HofS is reminded of everyday. An example I will use Perhaps NIS2 and DORA will cause a shift in mindset

8

4 Comments

From October, UK banks will be 💯% liable for #scam losses - even when the payment is authorised by the customer. (It doesn’t mean you can all go and get scammed now! 😅) Authorised Push Payment fraud is where a victim is tricked into making a large bank transfer to an account posing as a legitimate organisation. But in a few months, people will be fully reimbursed and the costs will be equally divided between the bank managing the customer's account sending the funds and the bank operating the account receiving them. 🤔 Not only could this force banking costs to rise, I predict we could see an increase in attempts as fraudsters will know the money is available. I also think we may see an uptick in first-party fraud where the actual account holder uses their own credentials for fraudulent means.

328

85 Comments

As is so often the case “simple to implement procedures could have prevented the serious breach” While the PSNI were impacted by this breach, similar breaches are happening on a daily basis, where simple procedures could prevent such breaches. Reach out to NexGen Cyber Limited to protect your business from having a serious data breach.

8

The more I read about the extensive PII leak from NPD the more I’m frustrated. At this point in time countless companies want your PII but there are no laws, incentives, regulations etc in place to ensure they are doing right with their cybersecurity to ensure your data is safe. NPD managed to leak 237 million individuals PII because they had a clear text zipped up document hanging on their website that listed usernames and passwords (many using the same default password issued across the board that was only 6 characters). This is 100% unacceptable and people shouldn’t continue to be victims to companies that can’t or won’t pay for proper cybersecurity.  What has to take place for companies to take this seriously? Is it immense fines per individuals data? Jail time? What are your thoughts? https://lnkd.in/eTG_ksWq

12

7 Comments

Compliance doesn't have to be a painpoint! We've recently closed out and delivered a handful of ISO 27001 internal audits and vCISO support for ISO 27001 and the feedback is in! Below is an example of some awesome Trustpilot feedback from an awesome customer we helped get ready for their ISO 27001 audit. 👇🏼 Each business is a unique rubiks cube of challenges and opportunities. Getting to understand them in a finite amount of time to advise on the effectiveness and efficiency of security controls is an art as much as a science. At Steel FYI we pride ourselves in giving practical, friendly, and commercially-minded advice on how to achieve compliance and prevent material breach, without tying the business up in red-tape. If you want some support in making ISO 27001 work for your business, not the other way around, drop me a message 📨

21

Can a Security Engineer become a CISO? 🤔 When I first started in recruitment 13 years ago, many of the Head Of & CISOs I was placing may have started their career in some form of IT role, but the majority of their security career was more GRC or Audit and very rarely from a very technical, Security Engineering backgrounds. Soft skills and stakeholder management are always important and increasingly in demand. But we are now seeing a shift in what companies want from their Security Leaders with many wanting more for less. More of these companies want a CISO who has come from more of a technical background and understands the finer details of their main technology challenges alongside the ability to communicate at board level. Do you think CISOs are becoming more technical?

167

64 Comments

Are roles being open for 6 months+ putting candidates off applying to your company? 🤔 I spoke to candidate I am working with last week who was approached by a company for a Cyber Security Manager role - one he would be a really good fit for. I’ve seen so many roles readvertised this year that seem to have 100s of applicants and have also spoken to candiates who have been contacted about roles they’ve seen open for 6 months+. The candiates I speak to are out off these roles as they feel the companies aren’t serious about hiring or don’t know what they are looking for. Companies with job postings open for 6 months+ who aren't willing to change strategy or work with specialist agencies like Cyber Spring will miss out on the best candidates. Over the last 5 years, I have helped companies reduce their average time to hire great security talent to 27 days. If you want to make sure your brand is viewed positively in the industry and don't want to miss out on the best candidates - it may be time to rethink your hiring strategy.

32

12 Comments

The problem isn’t the “hackers” but the leadership within companies that sit in the supply chains of critical national infrastructure who merely strive to tick boxes. If they can be bothered, of course. High profile attacks often show that the target of the attack doesn’t have the minimum certification they should have to be in that supply chain. Synnovis weren’t certified to the minimum standard of Cyber Essentials on the day of attack. Nor did they have Cyber Essentials Plus. If they can’t attain or maintain Cyber Essentials as a bare minimum, how can they actually remain a supplier to critical national infrastructure? By NOT being certified to the standard on the day of the attack, shouldn’t that make the leadership of the supplier culpable in some way? If directors were held personally liable, rather than the company being liable wouldn’t that be a mechanism to pull heads out of the sand and actually tackle this problem? This is a war we’re not winning.

9

The Nikki-Universal ransomware attack shows how quickly things can spiral when cybercriminals strike—and why the stakes are higher than ever for businesses worldwide. Attacks like these aren’t just about encrypted files; they’re about leaked secrets, operational chaos, and reputation damage. With hackers using tactics like double and triple extortion, it’s clear: defense strategies must evolve. For more insights and analysis, check out the detailed post on Matisoft’s LinkedIn page. Follow Matisoft Cyber Security Labs for more insights and updates on this and related topics. #MatisoftLabs #Cybersecurity #RansomwareAttack #DataSecurity #RiskManagement #IncidentResponse #CyberResilience

1

What skill set should you hire as Security employee number 1? 🤔 This is a question I get asked regularly and the answer I always give... It depends. It depends on the organisation, the business objectives, the budget and so much more. Without knowing all the details it can be difficult to answer. I see a lot of fast-paced tech companies initially hire 2-3 Security Engineers that embed into their existing Engineering org which works really nicely. Other companies look to hire a Head Of Security first that is going to be responsible for building out a function. I think the most important thing is that you set your objectives for the Security org early and build a plan based on those objectives - whether that be a full team build out or embedding security into existing teams. What do others think? Is one way more efficient than the other?

3

14 Comments

Top 10 Cybersecurity Predictions for 2025 In summary, 2025 is poised to be a pivotal year for cybersecurity in Europe, characterized by the integration of advanced technologies, stringent regulatory measures, and a heightened focus on education and supply chain resilience. Organizations and individuals will need to remain vigilant and proactive to navigate the evolving cyber threat landscape effectively.

1

New Blog! This time focussing on Security Monitoring, this is my background subject really, but this one doesn’t talk about the solutions you could implement for a good reason, because the most important thing is your need. A lot of businesses don’t get value because they listen to the vendor not their own business, having the need nailed down will save unnecessary cost and make your vendor relationship more sustainable. There are some tips in here that you should be aware of when approaching or re-approaching your perfect solution (if there is such a thing).

8

1 Comment

Check out our latest Q&A with Michael Hensley, Head of Security at Modern Health here: https://hubs.la/Q02Ws7gC0 This feature is designed to offer insights for security professionals that are either transitioning into first-founding security engineer roles or are tackling the challenges associated with growing a security function in a startup environment. You’ll get access to practical advice and learnings from Michael Hensley, Head of Cyber Security at Modern Health, as he shares his thoughts based on his own first-hand experiences. Key topics include identifying potential red flags during the interview process, securing executive support, developing a security roadmap, and hiring the right talent. The feature also covers strategies for aligning security priorities with business goals, measuring ROI, and overcoming the unique challenges of building a security function from the ground up. #cybersecurity #cyberjobs #hiring #opentowork #cyber

12

Will You be Applying for Jobs Being Advertised Online in 2025 🤔 As a candidate, with the amount of people applying per role at the moment, do you feel despondent when you see a role which you think you would be ideal for, but which already has a vast number of "people clicked apply", leading to you not applying❓ For employers who are relying purely on their online job adverts, they are missing out on quality suitable candidates, candidates who feel like it is a 'bun fight' to get their details in front of the hiring person. As an example, in the graphic below is an abstract taken from an online job advert where within 20 minutes of 'reposting' the role, they have over 100 people who have clicked 'apply'. We all know that the percentage of 'quality' applicants applying is so low, meaning that the firm is missing out on ideal & suitable candidates. TechCyber Solutions provides a 'human-centric' led Tech, Cyber Security and IT Security recruitment service, where when you receive a CV, you know that the candidate is: Relevant, ideal & suitable for the role. We save you money 💷 , save you time ⏲️ and we protect 👮‍♂️ your employer brand 👍 #ciso #cisos #cisolife #cisoalliance #cyber #cybersecurity #cyberjobs #recruitment #itsecurity #infosec.

5

2 Comments

Are roles being open for 6 months+ putting candidates off applying to your company? 🤔 I spoke to candidate I am working with last week who was approached by a company for a Cyber Security Manager role - one he would be a really good fit for. He was put off the role as he was told it had been open for almost 8 months and in his own words - "I know I'm good at what I do, but there are definitely other people out there with similar skills and experience for this role". He decided to pass on the role as it had been open so long and wasn't sure they were serious about hiring or knew exactly what they wanted from a candidate. He is at late stages for a couple of roles we are working on so it may have been a different case if he had just started looking at new roles - but this is a common occurance in the market. Companies with job postings open for 6 months+ who aren't willing to change strategy or work with specialist agencies like Cyber Spring will miss out on the best candidates. Over the last 5 years, I have helped companies reduce their average time to hire great security talent to 27 days. If you want to make sure your brand is viewed positively in the industry and don't want to miss out on the best candidates - it may be time to rethink your hiring strategy. #cybersecurity #securityhiring #recruitmentprocess

45

26 Comments

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments