Stephen Bonner

Join Phil Cracknell, Defence Sector CISO and former Cabinet Office Cyber Security SME, for the grand finale of ‘Season One’ in our free online series WFF Presents: The Cyber Breach Playbook. Tuesday, July 9th from 12pm - 1pm BST. #WFFPresents Rounding off what has been a fraud-busting first season, Phil will dive into his cyber breach playbook, offering invaluable insights on crafting robust disaster response plans to ensure your entire staff - from C-Suite to the frontline, are well-prepared to tackle cyber threats. #CyberSecurity Details: 📅 When: Tuesday, July 9th from 12pm - 1pm BST 📍 Where: Microsoft Teams Webinar Don’t miss your chance to get ahead of the criminal curve. Register NOW!!: https://zurl.co/be1W 👈🏼 #FraudPrevention #LossPrevention #DisasterRecovery #CyberSecurity #DataSecurity #Ransomware #StopThinkFraud #InformationSecurity

14

1 Comment

Please share this widely

1

🚨 UK CISOs Overlooking Critical NCSC Guidance, Absolute Security Survey Reveals 🚨 A new survey by Absolute Security has revealed a concerning trend: over one-third (35%) of UK CISOs admit to ignoring the National Cyber Security Centre's (NCSC) cybersecurity guidance. This is particularly alarming given that nearly half (48%) of these organisations experienced ransomware attacks in the past year. Other significant findings: - 73% of CISOs identified mobile and remote devices as their organisation’s biggest security weakness. - 64% of CISOs believe the UK lacks a strong cyber resilience framework. - 77% of CISOs feel that the UK is falling behind the US and EU in terms of national cyber policies. At Appurity, we understand the importance of following NCSC advice. Talk to us about how we can work with your business to achieve Cyber Essentials Plus certification and ensure your security infrastructure is resilient against ransomware threats. https://lnkd.in/gNk3aVmj #CyberSecurity #CISO #CyberResilience #RemoteWork #Ransomware #NCSC #UKCyberPolicy #CyberEssentialsPlus

5

Thanks, Steve T, for that video summary about such a thought-provoking and multi-faceted case. As you said, the information breached about employees would have been bad for most Organisations, but for this particular Organisation, based on its history, it was catastrophic and a high risk to the rights and freedoms of the data subjects involved.  It is a lesson for us all that governance, data protection, infosec and cyber security should have buy-in at the highest level in every Organisation. Data protection as a risk factor should be examined at the function/ departmental level. For departments that deal with a high volume of personal/ sensitive data, the level of control should be commensurate with the risk.

3

Want to advance your public sector career in Information Security? CISMP is a particularly important qualification for those working in or with public sector bodies. It's an approved part of the UK Government’s Certified Professional (CCP) Scheme, licensed by the NCSC (part of GCHQ). 📅 Next course starts 1st May 💻 Live, online ❓ Find out more on our website #CISMP #PublicSector #InformationSecurity

5

Check out this guidance for organisations who are considering payment in #Ransomware incidents? ⏰ Don't panic, review alternatives, including not paying ⏰ Involve the right people across the organisation in decisions, including technical staff ⏰Investigate the root cause of the incident to avoid a repeat attack ⏰Be aware that payment does not guarantee access to your devices or data ⏰Consider the correct legal and regulatory practice around payment ⏰Know that paying a ransom does not fulfil your regulatory obligations For more detailed information, read the #NCSC guidance webpage.

17

LIVE WEBINAR: How to Adopt AI in Compliance with the GDPR 4th June | 3pm Join our consultant Mark James for: • How existing data protection laws such as the GDPR regulate AI use; • Assessing risk and mitigation strategies through DPIAs (data protection impact assessments); • Key data protection pitfalls to look out for when assessing AI tools; • Privacy by design as a concept for organisations striving for innovation; and • Our recommendations for AI success. Sign up here: https://lnkd.in/dmn-dnTW (Even if you can't attend, you'll still receive a copy of the slides and recording) #GDPR #dataprotection #AI

12

❗IMPORTANT update for the Security Testing #CHECK community❗ By 31 March 2025, all CHECK Team Leaders must have achieved one of the UK Cyber Security Council Professional Title, ‘Principal’ or 'Chartered’. This updated requirement of the National Cyber Security Centre’s CHECK scheme emphasises the importance of both technical expertise and soft skills. Applicants can apply through one of the Council’s approved licensed bodies, CREST and The Cyber Scheme. To facilitate this transition, the Council is offering full funding for CHECK Team Leaders (registered on NCSC portal as of 31st May 2024) applying for the prestigious professional registration titles between 1 July and 30 September 2024. This funding covers the application cost (excluding exam costs), making it an excellent opportunity to advance your professional standing without bearing the full financial burden. Find out more information, including how to apply, via the link below, CREST or The Cyber Scheme websites. https://lnkd.in/ej2fvhM9

58

2 Comments

Reviewing the latest #CyberBreach survey from HMG is sobering reading. 75% of UK business report #Cyber as being a key area for the board, yet this (again) results in total lack of #Governance: - 33% of businesses have a formal security policy - 31% have conducted a risk assessment - 30% have a board member with cyber responsibility (this has returned to the levels of 2016-18) - 27% have asset management activities - 13% are aware of the NCSC 10 Steps Guidance, but only 3% have actioned all 10 steps - 11% have conducted a pen test - 11% have reviewed their supply chains - 12% are aware of CyberEssentials (up from 8% in 2016) - 3% review NCSC/ICO guidance on Cyber (up from 2% since 2016) This is damning, we have excellent guidance on the NCSC website for Cyber and on the ICO website for Data Protection. 41% of the business are consulting externally, so why are those consultants not advising their clients correctly? Within our clients, we place baseline guidance for Cyber and Data Protection at the centre of the engagement. This ensures that governance is reset and a solid foundation can be provided for improvement. If you would like a better guide on your journey, then please do reach out :) #BeyondCyber #SafeNotSecure #GovernanceMatters https://lnkd.in/exrf-FNW

8

2 Comments

It's reported that a payroll system for the MOD has been hacked (as per https://lnkd.in/eZNPtuJk), causing a #DataBreach of personal details relating to serving members of the armed forces. It will be interesting to see the cause of this, because it's often the case that perceived low risk targets get left behind in #SupplyChain assurance. It's often the case that breaches are caused by not addressing baseline security requirements such as appropriate hardening, patching and access control. The current #CyberSecurity strategy has been proven to have delivered very little awareness of the guidance of how to address the basics, of which there is a wealth of guidance on the NCSC website. I keep saying this, but #CyberEssentials isn't moving the dial on addressing the basics and certainly isn't sign-posting organisations to the NCSC guidance. Supply chain assurance portals aren't making the change either, as they are often the manifestation of a #CyberSecurity consultants spreadsheet collection of questions to ask in a portal. If you want to make real change, then you have to ensure that the outcomes you ask of your supply chain meet your needs and that they have consistent guidance to follow. We do this using our ASIRTA portal from The Common Framework which has questions linked to legal obligations and signposts the NCSC and ICO guidance. Reach out if you'd like to know more. #BeyondCyber #GovernanceMatters #SafeNotSecure

9

Good morning, all! Paul Gogarty and I are proud to be presenting a #webinar on the #CAF guidance framework next week! Are you a power generation company? Do you work in the energy industry? Perhaps you are a site manager for a critical infrastructure facility; if so, you may need to be aligned with #CAF soon! See the link below on the ABB Process Automation post to register your interest 💻🤓

12

MAST's Security Report issue 395 is available to read now. This issue reviews, analyses and assesses the security issues facing the UK, London and the wider security and risk picture. Read the full report here: https://lnkd.in/eQr2DPkw #security #mastsecurity #news #uknews #crime #report #safety #secure #fyp #explore #uk #crimenews #securityservices

4

The ICO has posted a document discussing #CyberSecurity areas to learn from others regarding previous breaches (https://lnkd.in/esvupixY) and apparently failing to patch systems processing personal data isn't one of the biggest issues. Does anyone believe that? #BeyondCyber #GovernanceMatters #DataProtection

5

An excellent resource here from the National Cyber Security Centre, designed to help board members govern their cyber risk more effectively through their board toolkit. It covers: 🔨 Their board toolkit and how it helps 💡 The benefits of using the toolkit ❓ How to use the toolkit Attached below is NSCS's executive summary document to get you started, but visit the link in the comments for the full resource⬇️ #CyberSecurity #Cyber #InfoSec #InformationSecurity #NCSC

21

3 Comments

Upcoming Training Course - 🔒 Information Security and Data Breach Management 📆 9 July 2024 We will be focusing on the technical and organisational security elements of data protection. Covering understanding the legislation (UK GDPR & Data Protection Act 2018) and how these relate to the wider discipline of information/cyber security. The course focuses on key areas of compliance, such as: 🔒 technical security controls, 🌐 response strategies to data breaches 📄 reporting to the ICO Book here: https://lnkd.in/eUipKpSS #dataprotection #nkatraining #databreach

4

Working with tech but need to upskill your understanding of privacy rules and how to embed privacy in design? This course is for you 👇

3