Shaun Cooney

If you are working in IT, software development or anti-fraud, you absolutely need to pay attention to the #Horizon IT Inquiry. It may be the biggest carriage of misjustice in the UK in the modern times! Horizon IT is a perfect case study into the blind trust many put in the positions of authority, the magical thinking that still surrounds computer systems, and the inability of organizations to regulate themselves when they find themselves engaged with immoral practices for an extended period of times. If you are interested in similar cases, go check out the infamous #RoboDebt case from some years earlier. Equally sickening, and perfectly avoidable. Just imagine how much worse would either of these cases have been if there would have been autonomous AI with an agency at play! Scripted and predetermined programmatic execution is something we can trace, investigate and reproduce once we become to suspect errors. But how would you go about investigating if the system is incapable - or unwilling! - to explain the rationale of its actions and operates at the scale there is no way of tracing its reasoning back to where the hallusination started..

1

A great set of tools.

6

You know, I really do wonder. It seems we almost always need multiple investigations, 'expert' opinions, analysis, reports, and then even more reports.. to conclude something that is (bleeding) obvious. Ask any affected parent, SEN child, teacher or care professional, and they'll tell you the same thing they've been saying for years. Yes, the SEN system really is broken. Very broken. But what we will see, of course, isn't the practical planning and action needed to make worthwhile changes. Oh no. It'll be more time and resources frittered away on further reports and investigations, finger pointing and scapegoating, handwringing, apologies (unlikely), empty rhetoric and promises. And then.. the cycle will repeat. https://lnkd.in/dYXGjzZs

3

1 Comment

UK Businesses Expect a Cyber-attack, But Are They Prepared? “With incidents on the rise in both volume and frequency, preparation is key,” said Christian Reilly, CTO at Cloudflare Inc.  The majority (70%) of UK #business leaders expect to suffer a cybersecurity incident in the next 12 months, but only 35% of organisations feel well-prepared to deal with one. That’s according to new research from leading #connectivity #cloud company #Cloudflare, Inc. https://lnkd.in/ex5n_zue #cybernews #cybersecurity

2

It is not just a fantastic update, but focusing on a point about why we use something is a significant step forward. ** Anyone trying to break into the industry, and even those looking for that next role, should take note. ** "A candidate who runs a valid tool and can explain why it was run, the risks involved and the expected outcome may be awarded more marks than a candidate who ran a tool but doesn't know why, what the risks were, what the expected outcome was, they just found it on a cheat sheet and it seemed to work."

10

Are You Tired of worrying about Cyber Attacks ? You're not alone. But there is a solution. IASME Cyber Essentials can help protect your business and boost your reputation. Here is why it matters: Stronger Security: Cyber Essentials provides a solid foundation for protecting your business from common cyber threats. It's like having a security expert on your team. Build Trust: Customers and partners value businesses that prioritise security. Certification shows you are serious about protecting their data. Open New Doors: Work with government agencies and win new contracts. Cyber Essentials can give you a competitive edge. Peace of Mind: Knowing your business is protected against common cyber threats lets you focus on growing your business. Do not gamble with your business's security. IASME Cyber Essentials is an investment in your future success. Ready to take the next step? Let's talk about how Cyber Essentials can benefit your business. email us: [email protected] #CyberSecurity #Certification #DataProtection #Therybecgroup

6

Where is your data? Who hosts that data? What contracts are in force to protect your data being "handed over" to third parties at a whim? If Police Scotland struggle to get their head around the implications of their actions, how are SMEs supposed to cope? Do SMEs have the legal wherewithal to understand the Cloud Act? (Do SMEs even know where their data is? Much of it is likely lurking in the shadows, after all). I know I'm asking questions rather than answering them. Cloud services were meant to make our lives easier, but do they? #cloudsecurity #ico #shadowdata https://lnkd.in/eetuxeQZ

8

1 Comment

🚨Here is a big bang for buck cybersecurity project I would recommend NHS England undertake as soon as possible… If it doesn’t exist, we need a database of every single IT supplier to the NHS that has £10m+ global revenue and 50+ employees. 💡Funnily enough these are the criteria for the mandatory DSPT audits for IT suppliers and align with NIS/NIS2. The first step in enforcing mandatory standards, monitoring compliance and implementing punitive measures is knowing who the participants in your supply chain are (Same principle for OES). We must not let suppliers fly under the radar or self-select whether they meet regulatory criteria. It is the duty of government to have active, in date intelligence of its market and how its safe-guards must be applied. Then outreach and communications can start to happen effectively. This is the same principle as needing to know what assets you have before you can assess vulnerabilities and threats. Sam Shah Dr Saira G. Clive Flashman 💙 Stewart Duffy Daniel Cartter David Finn Shaun van Niekerk, CISSP Christopher McGrath Dr. Zhong Wei Khor 🇬🇧 Antoinette Smedley-Walsh Richard Staynings The AbedGraham Group #healthcare #NHS #patientsafety #publichealth #cybersecurity #cybercrime

46

14 Comments

STATING THE OBVIOUS #85 I've mentioned it before, but when triaging issues, people generally look at the issue in isolation, not in context (especially not taking into account other issues elsewhere within the organisation that it can be chained with). As a good example of this, I recently popped a site primarily using the TRACE method, which barely rates as a low-impact issue (and because of this, often goes unfixed as people think it isn't worth the effort). Anyway, on its own, TRACE is indeed a bit meh. But in this case, the response had an internal header that was being added by some middleware. Which contained a base64 encoded protobuf. Which contained a string. Which ended up in a management report, without being encoded. So with three simple steps, that takes us from TRACE to a blind, stored XSS in an admin panel. Remember kids, if you're not paying attention to context, you can bet some twat like me is ;) #redteam #blueteam #bugbounty

10

I enjoyed this opportunity to take a step back and reflect - it's hard (and maybe misguided?) to try and boil down the results of many small decisions over a long period of time into a few pithy conclusions, but I had a go. The link below has some thoughts on key ideas that I believe have been helpful in navigating my career to date.

19

2 Comments

The next episode of #redteamraw is dropping this evening.. I speak with Gavan Kingdon (Director of PwC's Ethical Hacking) about his journey to becoming a Red Teamer and getting all the certs.. Here's the trailer... Be sure to follow on YTube so you know once it lands! #redteam #hacking #pentesting #cybersecurity

70

18 Comments

A powerful opening keynote from Mivy James FBCS , CTO Defence Digital, UK Ministry of Defence at today’s techUK Delivering Diversity in Defence, Security & Policing Reception 👊 Mivy called out: - The importance of male allyship - role to mentor and sponsor women, challenge the micro aggressions - Tokenism in the workplace - take a holistic approach to inclusion - Delegation of power to infinity groups - address the systemic root causes of imposter syndrome - Wanting to see the business case for not having D&I - Holding leaders accountable for their D&I initiatives by measuring impact - ‘A privilege of seniority to lead by example…if I can’t show it in the workplace, then how can I expect others to do it’ 👏🏽 It was a thought provoking panel discussion I had the privilege of being apart of to discuss these points - collaboration and taking action at the heart of D&I. Thank you Stacey Crump, Josie Welland, Nikki Butt, @Elaine Peberby & Vanisha Mistry (Bhogal) for leading by example in your sectors 💜 #NationalInclusionWeek

79

2 Comments

Are you looking to improve your leadership skills? I had the pleasure of meeting Andy Ellis at RSA last week and have been digging into his book ever since. Being one of the most well-known and experienced cybersecurity leaders, he shares dozens of lessons and observations that anyone, at any stage of their career, can use to create a work culture of continuous improvement and strong leadership Andy Ellis is a graduate of MIT and former US Air Force officer. In his 20-year tenure, he designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1,000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business.  Andy is now the founder of leadership development firm Duha, where he teaches his leadership philosophy not only to other executives, but strives to make leadership training more accessible to people at all career levels. My takeaways so far: ✅Focus on the present, worrying about failure can make it happen! ✅Consistency matters ✅Performance development is for EVERYONE in your team. Grab a copy if you’re looking to improve your leadership skills, I’m glad I did. #leadership #cybersecurity

30

Over the course of the last few weeks I've been conversing with peers in other venues, to randomly stumble into an apparently controversial opinion: Clients believe that pentests should find 'everything.' Some argue that isn't fair or realistic, with others talking about customer maturity, and some talking about scenario-based assessments. While I don't disagree, I thought it'd be fun to ask here. In the near decade plus I've delivered security assessments, I've found that nearly all customers: * brag about how your company found more than #lastvendor * fire you because #othervendor found something you didn't find * will call you to the principle's office if: a bug bounty submission comes through and you "missed it" (or even worse if there was a compromise) * run 'bake offs' to try and assert who is the best (by measuring number/highest severity) of findings * run 'test engagements' where an internal team (that's thought of as advanced) already did an assessment and you are being checked to see if you find the same things they do. * swap vendors when they don't find a lot of things after n-assessments All of which indicates that as long as there is more 'juice from the squeeze' to be found-- you've somehow missed the mark. What has your experience been?

29

7 Comments

The biggest changes to UK Healthcare Data Security and Protection Toolkit have arrived. #assurance. I looked through the NHS CAF (Cyber Assessment Framework) DSPT Portal changes earlier and it looks good in principle, however Boards are not yet equipped with the understanding of how much more difficult the assurance process is going to be. By my estimate it will take a minimum of 2 years to "learn the new dance", and to be able to meet these new assertions. As much as it is outcome heavy, it is also evidence heavy. Remember, once the auditors have processed this new information, expect some tricky conversations and an increase in blood pressure. To senior leaders, support your IT and IG Teams because they are going to need it! Congrats to NHS England for getting this over the line. It is certainly more higher grade than the previous assurance model. #defendasone #cyber #ciso #nhs #cisolife #healthcare #patientsafety #cybersecurity #gdpr #nhs #nhsengland #compliance

49

10 Comments

Well reasoned document

1