Leon Fouche

The 2023 – 2024 Australian financial year has ended, which means responsible entities must submit their Critical Infrastructure Risk Management Program (CIRMP) Annual Report no later than 28 September 2024. 📅 Additionally, responsible entities will need to establish and maintain a Cyber Security Framework by 17 August 2024, as per section 8 of the SOCI Act CIRMP Rules. We’ve published a news article with information to support you in meeting your obligations - CIRMP Annual Report and Cyber Security Frameworks – providing advice on how to be compliant and what to do if you won’t be. Read the news article here 👉 https://lnkd.in/gpcgDJtC Section 8 of the SOCI CIRMP Rules 👉 https://lnkd.in/gRqP52uc

29

In a rare move 8 countries issue a joint advisory about The PRC’s Ministey of State APT40 attacking various agencies and allies. The reporting agencies are Australian Signals Directorate, (ASD’s ACSC), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), UK’s National Cyber Security Centre (NCSC-UK), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NCSC-NZ), the German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV), the Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center, and Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Police Agency (NPA). See the Cybersecurity Advisory: https://lnkd.in/gPBHaaNS

21

In need of an LGA Cyber 360 Implementation Partner? Look no further. Unsure what the LGA Cyber 360 Framework is? You probably don't work in Local Government. That said, many of the recommendations in the LGA Cyber 360 Framework are NOT Local Government specific. Recognising the changing digital threats to your council is the first step in protecting your residents. Implementing solutions to remediate gaps in your armoury is the next logical step and there are quick wins to be had. #identitymanagement #mfa #pam #lgacyber360

12

Australia's Prudential Regulatory Authority has written to regulated entities to remind them of the important of cyber resilience. Requiring covered firms to ensure they are meeting the requirements in CPS 234, self assessing themselves against sounds information security practices. Specifically ensuring entities have backup practices in place and are functioning. Highlighting APRA considers the failure of backups a material control weakness under CPS 234. Thaddeus Dziekanowski Brian D. McCarthy Veritas GRC Australian Prudential Regulation Authority #cybersecurity #cyberriskmanagement #cyberresilience

2

1 Comment

Goodness. See the report within the article. "However, it used the report to urge Victorian departments to adopt data and analytics to detect “fraud and corruption risks”." "Two departments that were audited, the Department of Jobs, Skills, Industry and Regions (DJSIR) and the Department of Transport and Planning (DTP) currently use data analytics to “proactively identify fraud and corruption risks” prior to awarding supplier contracts." "This approach should be adopted more widely, the report said, recommending that departments “set up regular data analytics reviews to assess their procurement activities for fraud and corruption risks”." “At a minimum, this involves collating and centralising data so they can export and review it,” VAGO added. https://lnkd.in/gpM2giFC

11

1 Comment

New performance audit report: Management of Cyber Security Incidents Why did we do this audit? * Australian Government entities are expected to be ‘cyber exemplars’ as they process and store some of Australia’s most sensitive data to support the delivery of essential public services. * Previous audits identified low levels of cyber resilience in non-corporate Commonwealth entities (NCEs). * Low levels of cyber resilience make entities more susceptible to cyberattack and reduce business continuity and recovery prospects following a cyber security incident. Preparedness to respond to and recover from a cyberattack is a key part of cyber resilience.

29

Don't miss your chance! We're thrilled to present the Cyber Maturity 2024 – Maintaining and Improving Cyber Maturity Report. Cybersecurity is a crucial business strategy, extending beyond IT. Enhance your organisation's resilience and risk mitigation by understanding and improving your cyber maturity. Download the full report now for valuable insights and actionable recommendations to boost your organisation's cyber maturity. https://lnkd.in/ey7gWMat #cybersecurity #scc #cybermaturity

24

The importance of a data governance strategy cannot be overstated - and the necessity for this to align with the cyber strategy is fundamental to ensure a solid cyber foundation is in place. If a cyber crisis hits, the need to understand what data is at risk must be addressed. #informationassets #datagovernance #cyber

4

Cyber resilience is not just a technology discussion. We have some thoughts. Please get in touch and let’s share notes. #cyber #cybersecurity #cyberresilience

5

If you're thinking of using AI in your business, you might find this post helpful. In addition, Microsoft has some useful tools, particularly the Responsible AI Impact Assessment Template https://lnkd.in/gZtgNDpS. It asks questions such as "Who will use or be exposed to the system?" and "Who will make decisions about whether to employ the system for particular tasks?". #iso9001 #iso14001 #iso22301 #iso27001 #iso45001 #iso42001 #businessplanning #businesscontinuity #defenceindustry #sovereigncapability #cybersecurity #networking #artificialintelligence

3

2 Comments

Such a pleasure to have spoken today at the VIC Governance and Risk Management Forum 2024 alongside the extremely knowledgeable Tony Vizza and Akash Mittal. Plenty of questions and discussions on the risks posed by cyber and AI. Please feel free to reach out if you didn't get a chance to catch up after the session today. #GRMF24 #kordamentha #cybersecurity #incidentresponse

51

The Information Security Registered Assessors Program (IRAP), which authorizes organizations to provide security assessment services to the Australian Government, requires rigorous training in the Information Security Manual (ISM). Compliance with the ISM necessitates meeting the new control requirements outlined in the June 2024 version of the framework. Aside from keeping our Content Library updated with the latest framework versions, the 6clicks platform can help you conduct assessments and prepare a statement of applicability or System Security Plan Annex (SSP-A) to verify your compliance with the ISM. Learn more about the new changes to the ISM and how you can align your compliance program with the new requirements: https://bit.ly/3REZDM7 #IRAP #ISM #compliancemanagement Andrew Robinson

12

The 2024 ISACA Canberra Conference has THREE sub-themes! Learn more about theme 3 below 👇 Governance, risk and assurance ensure technology use remain compliant, minimising negative impacts. Join us as we explore: 📃Governance: Upholding ISO and COBIT standards to establish frameworks for managing information security risks, ensuring best practices in securing digital assets. 🤕 Risk: NIST frameworks, assessing and mitigating cyber threats, and adopting a risk-based approach to prioritise efforts and maintain digital trust. 🤝Assurance: Continuous monitoring and a culture of compliance, to provide assurance on data protection and privacy, aligning with regulations like GDPR and HIPAA. Together, we can create a trustworthy digital future! 🚀🔒 REGISTER: https://lnkd.in/gfmfC5tJ CALL FOR SPEAKERS: https://lnkd.in/gvKdxwZa #ISACACanberra #ISACACanbCon24 #DigitalTrust

6

Seeing Weird Warnings in Your Online Services? Major Misstep: Outcry Over Expired Security Certificates Recently, a significant issue has emerged with expired Transport Layer Security (TLS) certificates, causing unwanted security warnings. This problem, highlighted by a user from Australia, reveals lapses in the digital infrastructure management of a major player in the industry. The expired certificate for a crucial endpoint of a leading online service has caused global inconvenience. - Customer Journey and Brand Image The reputation of this industry leader for innovation and reliability has been severely disrupted by these expirations. Users facing security warnings due to expired TLS certificates experience unnecessary stress and frustration, reflecting poorly on the company’s attention to essential details for a seamless and secure user experience. For businesses, the implications are even more severe. Companies relying on these online services face security errors and potential downtime, leading to significant productivity losses, impacting overall business efficiency, and eroding trust in the company's reliability. - The Imperative for Strict Processes These lapses highlight the need for stricter processes within the organisation. For a company of this size and reputation, the oversight in renewing crucial security certificates is inexcusable. Both large and small organisations must implement strict protocols for managing digital certificates. - Maintaining Vigilance in Digital Management TLS certificates are essential for securing internet connections and ensuring data privacy. According to DigiCert, these certificates ensure data is transmitted securely. Expired certificates can lead to unencrypted connections, service outages, and damage to an organisation's reputation. The failure to renew the certificate, valid from August 2023 to June 2024, has led to global administrative headaches. The repeated nature of these lapses, such as the 2022 incident with a subdomain, emphasises the need for improved oversight. The repeated missteps in managing TLS certificate expirations highlight the importance of maintaining rigorous digital infrastructure protocols. These oversights disrupt the customer journey and tarnish the brand’s image. It is imperative to implement stricter processes to monitor and renew certificates promptly. This vigilance is essential to avoid service outages, ensure secure connections, and maintain customer trust. Addressing these issues transparently and effectively will be crucial in restoring the company's reputation and ensuring a seamless, secure experience for users globally. #SecurityBreach #DigitalOversight #CertificateExpiry #TechReliability #CustomerTrust #DataPrivacy #DigitalInfrastructure #BusinessContinuity #TechIndustry #UserExperience #CyberSecurity #DataProtection #ITManagement #ServiceOutage #BrandTrust

1

The AICD and the Australian Information Security Association (AISA) have collaborated to assist directors of SMEs and NFPs to build foundational cyber resilience and strengthen their cyber security capabilities. With clear and concise recommendations for easy implementation, this new guide can be downloaded here: https://bit.ly/3V055eh #CyberGovernance #CyberSecurity

77

1 Comment

The Australian Signals Directorate (ASD) Essential Eight is a framework that outlines eight strategies to mitigate cyber security risks. Maturity Level One (ML1) focuses on basic security measures, while Maturity Level Two (ML2) focuses on more advanced measures to defend against sophisticated attacks. Here's a table summarising the key differences between ML1 and ML2 for each of the Essential Eight strategies. #Essential8 #CyberSecurity #Cyberprotection

25

2 Comments

The Australian Institute of Company Directors recently published an article in their #May magazine, highlighting the stages required for #Directors to be prepared for a #CyberCrises. One contributor's statement caught my attention - "financial implications such as a declining share price, compensation costs, claims and court cases are a bigger concern than damage to a company's reputation." This raises questions about how well we understand the impact of #reputation on stakeholder trust, brand, and share price value. The recent #Optus Cyber Attack is a perfect example of how #reputational damage caused by a large crises directly impacts long-term financial implications, shareholder value, and stakeholder trust. As widely reported, the attack led to insurmountable costs to the company's market value and customer trust! It's crucial for #Directors to recognise the impact of reputation on a company's bottom line and prioritise it accordingly. #WhitlamCo.

67

13 Comments