Luiz Eduardo Poggi Silva

Newly emerged ransomware gang Qiulong has made waves in the past week, targeting a number of Brazilian organizations. The group's leak site contains information about each attack, naming the victim, the volume of data exfiltrated and a description of the data. A statement taunting the victim is also seen alongside this information. Although we do not know much about this new gang, its technical abilities are evident from its ability to target multiple victims and potentially compromise sensitive data. Could this be a ransomware gang to watch? Read more from Cyber Security News: https://lnkd.in/gjTjh-AE Want to keep an eye on newly emerged ransomware gangs in 2024? Check out our blog: https://lnkd.in/eUWCyNwk #ransomware #cybercrime #cybernews #cyberthreat #threatactors #cyberattack #cybercrime #Qiulong #dataexfiltration #datatheft #cybercriminals

8

⚠️ KRIs (BFFs to KPIs) are those early warning signs that can be SUPER effective for proactively managing emerging risks⚠️ easy enough in theory, but what are some actionable KRIs & how can you develop them in your #TPRM program? ⤵️

11

2 comentários

NIST CSF 2.0 Govern Audit Checklist Part 1

16

Nestle (Brazil) Hit by Data Breach, Employee Information Exposed: https://lnkd.in/dz8iH6dJ #databreach, #informationsecurity, #cybersecurity, #Nestle, #Brazil, #employee #privacy, #hacktivism, #informationleak, #securityawareness #ethicalempire

4

The Digital Trust Ecosystem Framework (#DTEF) features a series of elements to ensure digital trust principles are being integrated in all of your enterprise's work. Learn more: https://bit.ly/3VCLEaT

3

Implementing management and governance practices in the public sector is very difficult. This is my reality and opinion. For years, I have been leading various projects to implement these practices, including PMOs, methodologies and frameworks, programs to implement COBIT, and others. Unfortunately, some of these efforts were discontinued, and this story has repeated itself multiple times. Not only in my projects but in many others as well. I know many cases where the same services were hired more than once for the same deliverables, which means a waste of public money. I attribute this to three main reasons and suggest a solution in the post below. In your experience, what strategies have been effective in overcoming these obstacles? #projectmanagemet #governance #publicsector

22

2 comentários

Third-Party Management Policy Template Effective Third-Party Risk Management: A Critical Component of Enterprise Security As organizations increasingly rely on third-party vendors and suppliers to support critical business functions, the need for robust third-party risk management has become paramount. The "Third-Party Management Policy Template" provides a comprehensive framework to help enterprises effectively govern these important relationships and mitigate associated risks. The template outlines several key requirements that should be central to any third-party management program: Due Diligence & Risk Assessment: Thorough vetting of potential third parties is essential, including evaluating their security controls, data protection measures, and subcontracting practices. Ongoing risk assessments are crucial to identify and address evolving threats. Contractual Obligations: Well-defined service level agreements and contractual terms are critical to set clear expectations, establish accountability, and provide the organization with appropriate oversight and audit rights. Data Security & Privacy: Third parties must comply with all relevant data protection regulations and the organization's own information security policies when handling sensitive data. Incident response plans should be in place to ensure timely notification and resolution of any incidents. Performance Monitoring: Establishing key performance indicators (KPIs) and conducting periodic reviews allow organizations to continuously assess third-party performance and identify areas for improvement. Business Continuity: Third-party responsibilities for disaster recovery, service disruption mitigation, and data recoverability must be clearly defined and tested regularly. Roles & Responsibilities: Defining the accountability of the board, C-suite, and other key stakeholders is essential to ensure effective third-party risk management across the enterprise. By implementing a comprehensive third-party management policy based on this template, organizations can strengthen their overall security posture, improve vendor relationships, and protect against the growing threat of third-party cyber risks. Proactive third-party risk management is no longer a nice-to-have, but a business imperative.

19

May 7 2024 Do all key stakeholders in your organization have a basic understanding of cyber risk management? This article by IBM should be useful. It also includes several links to sites that provide additional detail on certain relevant cyber topics. https://lnkd.in/d6MHsjh3

4

Keynote Presentation: Pensar Como um Hacker: Lições de Cibersegurança por Greg van der Gaast, Named one of the '5 World's Most Infamous Hackers', World Leading Security, Cyber & Information Expert who formerly worked for the U.S. Government, no IDC Security 2024! #IDCPortugal #IDCSecurityPortugal2024 #IDC #IDCPredictions #ITSecurity

4