Wayne Murphy MBA CISSP QSA

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments

Are you looking to improve your leadership skills? I had the pleasure of meeting Andy Ellis at RSA last week and have been digging into his book ever since. Being one of the most well-known and experienced cybersecurity leaders, he shares dozens of lessons and observations that anyone, at any stage of their career, can use to create a work culture of continuous improvement and strong leadership Andy Ellis is a graduate of MIT and former US Air Force officer. In his 20-year tenure, he designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1,000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business.  Andy is now the founder of leadership development firm Duha, where he teaches his leadership philosophy not only to other executives, but strives to make leadership training more accessible to people at all career levels. My takeaways so far: ✅Focus on the present, worrying about failure can make it happen! ✅Consistency matters ✅Performance development is for EVERYONE in your team. Grab a copy if you’re looking to improve your leadership skills, I’m glad I did. #leadership #cybersecurity

30

The ICO has posted a document discussing #CyberSecurity areas to learn from others regarding previous breaches (https://lnkd.in/esvupixY) and apparently failing to patch systems processing personal data isn't one of the biggest issues. Does anyone believe that? #BeyondCyber #GovernanceMatters #DataProtection

5

If you have five minutes to spare could you please complete this short survey to provide NexGen Cyber Limited with feedback on your businesses outlook towards #CyberSecurity https://tally.so/r/mOz2eA

1

Book a demo now, Zero Trust and Least privilege is the way to go, and you can get it from Morgan & Morgan. NG Managed Service provider of the year 2024

7

Time for a rant! Boy, haven't I read this piece of utter BS from almost any "political" body. Whether UK / US / Germany ... doesn't matter. ALWAYS the same friggin idiocy. Let's put in some sense into this blabber. About not enough candidates in universities: Well, as "cyber, cyber, cyber" is first and foremost a software, then a complexity and then a configuration problem, it would be so INCREDIBLY AWESOME if those building this dire heap of shit we nowadays call software- or tech-stack would learn "how-to-build-software-securely" IN THE FIRST PLACE! Can't be that hard, can it? There're literally hundreds of books dealing with just that. How to actually build software - AND TEST IT THEN !! - securely. Developing software is NOT an IT-Sec Pro job! Same goes for "IT-professionals": Why don't they learn how our biggest attack surface ever - aka MS - can be administered securely? (Possible, indeed duh!) Yes, it's a huge, extremely overcomplex, monstrous hydra to be tamed. So, what? That's what businesses went for. Deal with your decisions consequesces and stop whining! Administering is NOT an IT-Sec Pro job! High attrition rate: No shit sherlock! IT-Security pros these days need a complete other skill set than trained! They need the capacity to deal with the harbingers of chaos -> humans! Because "humans" are the root cause for this incredibly shitty landscape of operated "days of open doors for anyone"! No, I don't mean normal office staff. Clicking on mail will hardly do any harm nowadays ... anymore -> IF you actually run a patched up, up-to-date Microsoft stack. ... and pay the money, of course. (Welcome to the golden cage.) Those posing the biggest threat are Managers and C-Levels in NOT allowing absolute basics to be done properly and demanding "Cyber,cyber, cyber" to clean up the mess they created. The job of a cyber-sec Pro is ACTUALLY to get "people" to either do the right things OR at least not stand in the way. Therefore you need the following skills: - Communication (happy nerding as a mole is no more! Learn business lingo.) - Psychology (You're dealing with THE most diffucult NI there is!) - Leadership skills (YOU're the expert! You tell them what to do.) - Influencing (They need to do what you want them to ...) - Self-confidence (shaking in front of C-Level decinding on your budget doesn't help) That's for starters. These very simple steps would close this "gap" already considerably!

2

7 Comments

Another attack; another breach; and the same advice to those impacted - change your passwords and adopt a hygienic approach to password management. I have 452 credentials stored in my own personal password safe/vault. I don't think I'm that much of an outlier, but that is a lot of passwords and that means my "person attack surface" is already frightening. And it's not just passwords. I couldn't tell you off the top of my head what information is being held about me in a lot of those systems/platforms/apps/sites - are their credit card details on file, PII, preferences, other information they have "inferred"? As consumers, we put our trust in these suppliers of services that they will look after our information. It's not good enough that they say: "sorry, would you mind changing your passwords". They shouldn't let it happen in the first place! #breach #attacksurface #password #passwordhygiene https://lnkd.in/eHMsG5Qb

15

Need help with #NIST, or #ISO27001 compliance? I've seen a rapid rise in businesses demanding these accreditations from their suppliers and Punk Security Limited has a lot of experience in performing Gap analysis and implementation for both.

8

It is not just a fantastic update, but focusing on a point about why we use something is a significant step forward. ** Anyone trying to break into the industry, and even those looking for that next role, should take note. ** "A candidate who runs a valid tool and can explain why it was run, the risks involved and the expected outcome may be awarded more marks than a candidate who ran a tool but doesn't know why, what the risks were, what the expected outcome was, they just found it on a cheat sheet and it seemed to work."

10

If you are going to send a phishing email pretending to be from DVLA, then it is probably not a good idea to send it to the ex-DVLA Chair, include spelling and grammar mistakes, an ancient GSI email suffix and a .net email addy that has nothing whatsoever to do with DVLA! #justsaying

107

4 Comments

Using findings from a recent Dark Reading report, the discussion explores: - Why cyber hygiene should be a higher priority? - How the Bank of England gets actionable insights from security data? - How to bring the sexy back to cybersecurity fundamentals? ==

1

New Blog! This time focussing on Security Monitoring, this is my background subject really, but this one doesn’t talk about the solutions you could implement for a good reason, because the most important thing is your need. A lot of businesses don’t get value because they listen to the vendor not their own business, having the need nailed down will save unnecessary cost and make your vendor relationship more sustainable. There are some tips in here that you should be aware of when approaching or re-approaching your perfect solution (if there is such a thing).

8

1 Comment

The UK government’s Research Institute in Trustworthy Inter-Connected Cyber-Physical Systems (RITICS) (that's a mouthful!) has just released a document offering guidance in securing operational technology (OT) and industrial control system, (ICS) hardware. It's a quick 20-page guide and a good reference to prepare for ICS/OT incidents. Organisations should be treating ICS/OT separately from other IT assets, with specific incident response plans and playbook targeting these systems. You can access it here: https://lnkd.in/gkyWBhzg #ics #ot #cybersecurity #bestpractices #ritics #danweis #nexon #hackproofyourself

7

1 Comment

The UK Cyber Security council has defined 15 career paths, each with requisite competencies, attributes, and knowledge areas mapped to CyBoK. Any security standard or framework (CIS, NIST-CSF, ISO27001, PCI, etc) will have a dozen or more control domains and each requires specific knowledge and capabilities. Any effective security function requires a blend of all these professionals to fulfill each role and perform each function. Cyber security is broad and complex. It needs diversity in its people, in their competencies, ways of working, and areas of interest. Anyone that tells you that you must have one specific skill or another in order to succeed has a blinkered view of cyber security. As Maslow said "it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail."

84

1 Comment

Where is your data? Who hosts that data? What contracts are in force to protect your data being "handed over" to third parties at a whim? If Police Scotland struggle to get their head around the implications of their actions, how are SMEs supposed to cope? Do SMEs have the legal wherewithal to understand the Cloud Act? (Do SMEs even know where their data is? Much of it is likely lurking in the shadows, after all). I know I'm asking questions rather than answering them. Cloud services were meant to make our lives easier, but do they? #cloudsecurity #ico #shadowdata https://lnkd.in/eetuxeQZ

8

1 Comment

Data Protection Legislation: Is your organisation compliant? Join our data privacy experts on this webinar on the 22nd of May where we will consider a range of fundamental concerns and issues that may cause you to question your organisation’s compliance and commitment to data privacy, and whether a review of your practices might be long overdue. https://lnkd.in/eNjxbeuE #dataprivacy

11