Nathan Oliver

If you have five minutes to spare could you please complete this short survey to provide NexGen Cyber Limited with feedback on your businesses outlook towards #CyberSecurity https://tally.so/r/mOz2eA

1

The Nikki-Universal ransomware attack shows how quickly things can spiral when cybercriminals strike—and why the stakes are higher than ever for businesses worldwide. Attacks like these aren’t just about encrypted files; they’re about leaked secrets, operational chaos, and reputation damage. With hackers using tactics like double and triple extortion, it’s clear: defense strategies must evolve. For more insights and analysis, check out the detailed post on Matisoft’s LinkedIn page. Follow Matisoft Cyber Security Labs for more insights and updates on this and related topics. #MatisoftLabs #Cybersecurity #RansomwareAttack #DataSecurity #RiskManagement #IncidentResponse #CyberResilience

1

New Release: December 2024 Information Security Manual (ISM) The December 2024 update to the Information Security Manual (ISM) has been released, with several key changes aimed at strengthening security across both government and industry sectors. Key Updates: - Enhanced support for protecting non-classified systems (OFFICIAL systems) across government and industry. - New recommendations for handling malicious code in cyber security incident response and research. - EMSEC threat assessment activities now focused on SECRET and TOP SECRET systems. - Expanded event logging guidance for Apple MacOS, Linux platforms, and server applications, while removing previous recommendations for Microsoft Office macro execution logging. - Alignment with the internationally co-sealed Best Practices for Event Logging and Threat Detection. - Introduction of ASD-Approved Cryptographic Algorithms (AACAs) for post-quantum cryptography. - Recommendations supporting the transition to post-quantum cryptography by 2030. These updates reflect ongoing efforts to improve our resilience in the face of emerging threats, ensuring a robust, forward-looking security posture. Stay informed and prepared! #cybersecurity #infosec #ISM #postquantum #cyberthreats #securityupdates #Australia

26

1 Comment

Top 10 Cybersecurity Predictions for 2025 In summary, 2025 is poised to be a pivotal year for cybersecurity in Europe, characterized by the integration of advanced technologies, stringent regulatory measures, and a heightened focus on education and supply chain resilience. Organizations and individuals will need to remain vigilant and proactive to navigate the evolving cyber threat landscape effectively.

1

Need help with #NIST, or #ISO27001 compliance? I've seen a rapid rise in businesses demanding these accreditations from their suppliers and Punk Security Limited has a lot of experience in performing Gap analysis and implementation for both.

8

New regulations that came into effect on April 29, 2024 (#1007) aim to improve consumer protection by requiring stricter security measures for internet-connected products like smart TVs, speakers, air-friers, coffee machines and wearables. ❓What you need to know: - Applies to any business producing, selling, or distributing these products in the UK. - Requires risk assessments, security measures, and clear communication of those measures. - Regular security updates and a point of contact for reporting vulnerabilities are mandatory. 💸Non-compliance can be costly: Fines up to £10 million or 4% of global turnover. Product removals and potential liability for damages.

8

The PCI DSS v4.0.1 update provides much-needed clarifications that can help us all strengthen our cybersecurity measures. With clearer guidelines on MFA and payment scripts, we can better protect sensitive data. How is your organization adapting to these changes? Reach out to Arbure for a deep dive into these updates. #PCIDSS #Cybersecurity #Compliance #PCIUpdate

4

Guidelines for Evidence Collection and Archiving! RFC 3227 provides recommendations for handling evidence in the event of an incident involving systems and networks. It’s a valuable reference for threat hunters by outlining best practices for evidence collection and preservation, ensuring that any data gathered during threat-hunting activities can be used effectively for analysis and incident response. • Order of Volatility • Things to avoid • Privacy Considerations • Legal Considerations • The Collection Procedure • Transparency • Collection Steps • The Archiving Procedure • Chain of Custody • And many more Source: https://lnkd.in/g2_bMbAT Threat hunters use various analysis techniques on data collected from hosts, networks, user activities, and security solution logs to detect threats by identifying unusual patterns, behaviors, or actions. Explore the top 10+ data analysis techniques and prerequisites for effective hunting and detection explained in my Cyber Threat Hunt 101 Series on YouTube in a simple and easy-to-follow way: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth

116

2 Comments

Data Protection Legislation: Is your organisation compliant? Join our data privacy experts on this webinar on the 22nd of May where we will consider a range of fundamental concerns and issues that may cause you to question your organisation’s compliance and commitment to data privacy, and whether a review of your practices might be long overdue. https://lnkd.in/eNjxbeuE #dataprivacy

11

Sharing some insights from the recent ANAO audit on the security authorisation of ICT systems within the Department of Defence. The findings highlight crucial areas for improvement in our approach to cyber security, which is vital for safeguarding our national interests. Key Findings: - Partly Effective Arrangements: Defence's management of ICT systems security authorisations has been inconsistent, leading to delays and compliance issues. - Policy Deficiencies: Many policies are outdated or internally inconsistent, failing to align with current security requirements. - Defence’s arrangements for system authorisation have not been regularly reviewed and do not reflect current PSPF requirements. - Defence’s reporting did not comply with DSPF requirements, omitted key system authorisation data, and indicated a more optimistic outlook than was reflected in other Defence documentation. - Defence did not comply with the PSPF and DSPF system authorisation requirements for the five case studies examined in the audit. Lessons Learnt and Way Forward applying to all industries - Personal Perspective: 1. Continuous assessment and authorisation of our systems are paramount to ensure they operate securely. It’s not enough to treat these processes as a tick-and-flick exercise; we need ongoing management and active implementation. Establishing a proactive approach to security assessments is crucial to maintaining operational integrity and timely authorisation of systems. 2. We must maintain a central record of all systems because we cannot protect what we don't know about. This visibility is essential for effective risk management and safeguarding our operations. Knowledge is power in cybersecurity. 3. Policy Alignment is Essential: Regularly updating policies to reflect current security standards is vital. Consistency across all sections of the organisation ensures everyone is on the same page and reduces confusion. This alignment should also encompass all applicable laws, regulations and industry standards. 4. Continuous education and awareness for external/internal assessors and personnel is imperative. Cultivating a culture of awareness where employees are encouraged to follow processes, report suspicious activities and understanding their roles in maintaining security. 5. Communication and Collaboration is key to a unified posture for monitoring the status of system authorisations. I hope these insights help shape your security assessment and authorisation processes within your organisations. I’m keen to hear thoughts from others on this paper or more generally about system assessment and authorisations and how we could improve the current processes in place in industry. Your perspectives could contribute to refining our approaches and fostering a stronger security culture. #LessonsLearned #CyberSecurity #Defence #ContinuousImprovement #RiskManagement #Collaboration #CyberSecurity #SecurityAuthorisation #Securityfundamentals #Accountability

33

1 Comment

Building on the below insights from my post, I want to highlight how Home Affairs has digitised its process to ensure that relevant security controls are applied and kept up to date for its numerous ICT systems. This initiative is critical in helping the department meet its Protective Security Policy Framework (PSPF) and Essential Eight obligations. This is a great example of how lessons learned can be effectively implemented for maintaining a central record of all systems and continuous assessment/authorisation of our systems For more details - https://lnkd.in/gMGTkS7W.

1

St James’s Place is a pioneer in the list of major UK organisations that are requiring their supply chain and partners to be certified to the Cyber Essentials Plus standard. Read more 👉 https://lttr.ai/AZsrb #EnsuringRegulatoryCompliance #BusinessResilience #Cybersecurity #cybersecurity

3

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments

More about the DORA Registers of Information - Check out the ICTTF DORA Blogs https://lnkd.in/eU2JbWSK ICTTF - Cyber Security Community, Academy and Events

1

UK launches 'world 1st' cyber laws to protect consumers from weak internet connected devices.. Common or easily guessable passwords like ‘admin’ or ‘12345’ will be banned to prevent vulnerabilities and hacking  Manufacturers will have to publish contact details so bugs and issues can be reported and dealt with Manufacturers and retailers will have to be open with consumers on the minimum time they can expect to receive important security updates https://lnkd.in/eSYFUkEK

12

New Blog! This time focussing on Security Monitoring, this is my background subject really, but this one doesn’t talk about the solutions you could implement for a good reason, because the most important thing is your need. A lot of businesses don’t get value because they listen to the vendor not their own business, having the need nailed down will save unnecessary cost and make your vendor relationship more sustainable. There are some tips in here that you should be aware of when approaching or re-approaching your perfect solution (if there is such a thing).

8

1 Comment

So today I am posting the 6th in the NCSC CAF series. The document isn’t technical - it’s not meant to be, it's written to explain a concept that forms part of a holistic cyber posture, chunked into the CAF principles - this one is about Identity & Access Control. 5 minute read - two pages of text - come on you can do it!! Key takeaways: What is it - in simple terms How does it work - as a physical scenario What should you consider - at really high level I am interested in constructive feedback - so if you have any whack them in the comments or DM me. If you want me to expand my view, just reach out. Happy Cyber Awareness Month!!!

10

1 Comment