Farah Chamseddine

A recent audit by the NSW Auditor General has highlighted alarming cybersecurity vulnerabilities within local councils, underscoring the urgent need for improved defences to protect our essential services and community data.   Key Findings from the Audit:   🚨 Significant gaps in cyber risk management are prevalent across the councils. 🛡️ Only two of three audited councils have initiated plans to bolster cybersecurity. 🤝 There are notable weaknesses in how councils manage cyber risks associated with third parties.   Immediate Actions Required:   📋 Strategic Planning: Councils must develop, adopt, and periodically update comprehensive cybersecurity plans. 🔄 Guideline Reviews: There should be regular assessments of cybersecurity guidelines to ensure their effectiveness. 🤲 State Support: Enhanced support and oversight from state agencies like Cyber Security NSW are crucial to guide local governments in strengthening their cybersecurity frameworks.   Full report: https://lnkd.in/g3Muq6xs   #NEXTGENGroup #CyberSecurity #LocalGovernment #PublicSector #NSW #RiskManagement #DataProtection

3

I just completed Datacom's Cybersecurity on @[Forage](urn:li:organization:68514998). In the simulation I: * Completed a simulation focussed on how Datacom's cybersecurity team helps protect it's clients * Investigated a cyberattack and produced a comprehensive report documenting findings and outlining key recommendations to improve a client's cybersecurity posture * Conducted a comprehensive risk assessment Check out the simulation here: https://lnkd.in/eWhFJKgH

4

📢 Exciting Announcement! 🔒 Seminar on Information Security Standards and Operations 🏫 Venue: Whitecliffe Wellington Campus - (Level-3 Ranchhode Tower, Lambton Quay Wellington, New Zealand) 📅 Date: 11-05-2024 (Saturday) 🕥 Time: 10:30 AM Join me for a comprehensive seminar delving into the realms of Information Security Standards and Operations. We'll explore the various phases of planning, designing, and implementing cyber defense policies tailored specifically for financial organizations. In this era of #AI & #cyberSecurity understanding both internal and external threats is paramount. Let's navigate through strategies to safeguard our organizations effectively. Looking forward to engaging discussions and valuable insights! #Standards #Policies #Assurance #Compliance #Governance #RiskAssessment #RiskManagement #Defense #CyberFrameWork #Ransom

40

8 Comments

There is some very good information provided for small business in this document. I recomended a read if you are a sole trader or other small business owner. if you know anyone that fits that description please encourage them to seek this document out.

11

🌐 Google Cloud Accidentally Deletes UniSuper’s $125 Billion Pension Account – An Urgent Lesson in Cybersecurity & Cloud Backup 🛡️ In a startling incident, Google Cloud accidentally deleted the account of UniSuper – a major Australian pension fund valued at $125 billion. This misstep left around 600,000 users without access to their accounts for nearly two weeks. UniSuper's choice of cloud service aimed at streamlining processes ended up becoming a nightmare due to unforeseen data deletions caused by a misconfiguration issue. 1. Importance of Redundant Backups: Even as a reputable organization, Google Cloud's incident underscores the necessity of maintaining backups across multiple platforms. 2. Risk Mitigation Strategies: Companies should adopt a multi-cloud strategy to prevent reliance on a single provider and ensure swift recovery in the event of data loss. 3. Consistent Vigilance: Regular audits and compliance verifications could help identify and rectify all potential risks before causing significant disruptions. 4. Recovery Preparedness: Having diverse and readily accessible backup solutions determines the efficiency of recovery processes amid unexpected data loss. This incident epitomizes why merely using cloud services like Microsoft, Google, or Dropbox isn't ample protection. You must have a robust cybersecurity strategy, including third-party cloud backup to secure your private practice, hospital, specialty pharmacy, or any other healthcare enterprise's email and cloud storage systems. 🥅 Read the full article initially posted in SPICEWORKS to gain deeper insights into the UniSuper debacle and enhance your organization’s cybersecurity stance - https://bit.ly/454QAJU 🔒Act Now! Secure your data with ICU Computer Solutions – your go-to experts for cloud backup and network security assistance. Visit our website https://bit.ly/3dG5ZK2 or request your FREE Cybersecurity Scan Report via this link > >> https://bit.ly/49hvaJP #CloudBackup #Cybersecurity #DataProtection #CloudComputing #Misconfiguration #DisasterRecovery #DataRecovery #ITSecurity #UniSuper #GoogleCloud #RiskMitigation #ITConsulting #CloudServices #CyberThreats #DataLossPrevention #TechNews #BusinessContinuity #CloudMigration #TechIndustry #InformationSecurity #DataManagement #BackupSolutions #NetworkSecurity #SecurityBreach #ITSupport #CloudInfrastructure #DigitalTransformation #BusinessSecurity #TechSupport #CyberAwareness

1

🌐 Google Cloud Accidentally Deletes UniSuper’s $125 Billion Pension Account – An Urgent Lesson in Cybersecurity & Cloud Backup 🛡️ In a startling incident, Google Cloud accidentally deleted the account of UniSuper – a major Australian pension fund valued at $125 billion. This misstep left around 600,000 users without access to their accounts for nearly two weeks. UniSuper's choice of cloud service aimed at streamlining processes ended up becoming a nightmare due to unforeseen data deletions caused by a misconfiguration issue. 1. Importance of Redundant Backups: Even as a reputable organization, Google Cloud's incident underscores the necessity of maintaining backups across multiple platforms. 2. Risk Mitigation Strategies: Companies should adopt a multi-cloud strategy to prevent reliance on a single provider and ensure swift recovery in the event of data loss. 3. Consistent Vigilance: Regular audits and compliance verifications could help identify and rectify all potential risks before causing significant disruptions. 4. Recovery Preparedness: Having diverse and readily accessible backup solutions determines the efficiency of recovery processes amid unexpected data loss. This incident epitomizes why merely using cloud services like Microsoft, Google, or Dropbox isn't ample protection. You must have a robust cybersecurity strategy, including third-party cloud backup to secure your private practice, hospital, specialty pharmacy, or any other healthcare enterprise's email and cloud storage systems. 🥅 Read the full article initially posted in SPICEWORKS to gain deeper insights into the UniSuper debacle and enhance your organization’s cybersecurity stance - https://bit.ly/454QAJU 🔒Act Now! Secure your data with ICU Computer Solutions – your go-to experts for cloud backup and network security assistance. Visit our website https://bit.ly/3dG5ZK2 or request your FREE Cybersecurity Scan Report via this link > >> https://bit.ly/49hvaJP #CloudBackup #Cybersecurity #DataProtection #CloudComputing #Misconfiguration #DisasterRecovery #DataRecovery #ITSecurity #UniSuper #GoogleCloud #RiskMitigation #ITConsulting #CloudServices #CyberThreats #DataLossPrevention #TechNews #BusinessContinuity #CloudMigration #TechIndustry #InformationSecurity #DataManagement #BackupSolutions #NetworkSecurity #SecurityBreach #ITSupport #CloudInfrastructure #DigitalTransformation #BusinessSecurity #TechSupport #CyberAwareness

2

Google Cloud accidentally deleted a massive customer account, causing two weeks of downtime for UniSuper, an Australian pension fund that manages $135 billion worth of funds and has 647,000 members. The incident raised concerns about the safeguards in place to prevent account deletion and the importance of a multi-cloud solution. While UniSuper was able to recover its data using backups from a different provider, the incident highlights the need for redundancy in cloud storage. #GoogleCloud #cloudstorage #disasterrecovery

7

1 Comment

I am hearing on the vine that this campaign is having significant success in a number of sectors. Make sure your staff are aware. Update your response plans. Do you have a playbook for stolen session cookies? Update your systems with known IOCs. Comment below if you have additional suggestions or tips.

36

3 Comments

I just completed Datacom's Cybersecurity on @[Forage](urn:li:organization:68514998). In the simulation I: * Completed a simulation focussed on how Datacom's cybersecurity team helps protect it's clients * Investigated a cyberattack and produced a comprehensive report documenting findings and outlining key recommendations to improve a client's cybersecurity posture * Conducted a comprehensive risk assessment Check out the simulation here: https://lnkd.in/dQUxfXCj

3

Google's Cloud CEO Thomas Kurian has weighed in on the UniSuper fiasco. The multi region setup accidentally deleted... These incidents are possible, always ask the "What if question....?" "How do we recover...?" #cloud #privatecloud #dr #businessplan #gcp #google #aws #microsoft #azure https://lnkd.in/er_MNmEh

10

So, #GCP had a little mishap – accidentally deleted the main account and with it the redundancies from another geography for UniSuper resulting in a blackout for the firm's more than half a million users and $125 billion fund. A gentle reminder of the importance of staying alert in the world of auto setups and provisioning. While going multi-cloud or even multi-account setups might seem daunting, putting all your eggs in one basket? Well, that can spell disaster. Also, major props to the brains behind UniSuper's backup and disaster recovery plan! 🏅 #ops #cloud #disasterrecovery

9

It's encouraging to see more vendors taking a proactive step towards improving security with the recent pledges under the Secure by Design principles. We’ve seen Secure by Design as a focus for both CISA and also locally in Australia with ACSC. While these pledges are a positive sign, hopefully, these will translate into tangible actions to improve security and provide true ‘secure by default’ products. Close to 70 software vendors have agreed to the Secure by Design pledge, we look forward to seeing more companies join this list. #SecureByDesign

25

📢 Data Breach at Optus: A Lesson in API Security and Oversight In a recent court filing, Australia's Communications and Media Authority (ACMA) detailed the significant data breach at Optus, which exposed the personal information of over nine million customers. This breach, traced back to a coding error that broke API access controls, highlights critical gaps in security practices and oversight. 🔍 The Incident: --Cause: The API had two entry points, each secured in 2017. In 2021, a coding error broke one of the access control lists (ACLs). Unfortunately, the defect was only detected in one of the entry points, despite both being impacted by the same flaw. --Detection: Optus identified and fixed the issue on the Main domain in 2021, but the Target domain remained vulnerable. --Impact: In September 2022, an attacker exploited this vulnerability, accessing customer information via Target APIs. The attack was not sophisticated, relying on simple trial and error. 💡 Key Takeaways: --Single Entry Point Strategy: While the obvious move was to ensure that the same fixes were applied to all entry points, the better move for future security is to have only one entry point, one set of security controls, and one instance to support, secure, document, and implement. --Segregation and Security: Ensuring that API traffic is segregated and properly secured is crucial. --Regular Audits: Continuous monitoring and auditing of all domains and access points can prevent prolonged vulnerabilities. --Timely Response: Rapid identification and rectification of security issues are essential to protect customer data. 🔍 Broader Implications: --API Vulnerabilities: APIs remain a common source of security flaws, reminiscent of web hacking from the early 2000s. It's critical to delve into API security and recognize their susceptibility to traditional attacks. --Reasonable Cybersecurity: This incident is the second recent determination by an Australian authority that a commercial business failed in implementing reasonable cybersecurity measures. While guides like the CIS framework are very specific and useful, defining and achieving reasonable cybersecurity is a global imperative. This incident serves as a stark reminder of the importance of robust security protocols and vigilant oversight in safeguarding sensitive customer information. 🔗 Stay informed and vigilant! #CyberSecurity #DataBreach #API #TechNews #ACMA #InfoSec #DataProtection #ReasonableCybersecurity

10

Lookout! The NCSC has issued a warning about a multi-stage phishing campaign affecting New Zealand organizations since at least 05 June 2024. Compromised user accounts are being used to send phishing emails via Microsoft OneDrive/SharePoint sharing invitations, potentially from trusted contacts, redirecting users to malicious websites to harvest credentials. Organizations are advised to stay vigilant, monitor for suspicious activity, and educate staff on being cautious with sharing links, particularly from external domains. It's recommended to implement additional security measures to counter this threat. https://lnkd.in/g8MH_fRr #CyberSecurity #Phishing #NCSC #SecurityAwareness

21

1 Comment

#changingtheconversation This guide covers: ~ What role a director serves in an elevated cyber threat environment ~ The fundamentals of cyber security ~ How to develop key internal policies and build a culture of cyber resilience

10