Malcolm Kelly

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

https://lnkd.in/eEZXMTH4 !!Analysts claim cyber attacks contribute to business failure!! I was going to do a post on BGP hijacking as I have seen some "imaginative" comments about recent events but this is more relevant. A small bonus that comes with being "on the bench" is that I get a chance to listen to the business news in the morning, where I heard that this longstanding retailer is going under administration. My heart goes out to those that may lose their jobs -- but I want to highlight the economic analysts comments: "that a recent cyber attack had damaged trade and cash-flow", this was echoed by the article attached. These days even traditional businesses are digital businesses - yet I find even "Digital", "no-brick only clicks" firms often treat the digital platforms & infrastructure plus the regulations+laws that govern them that "are the means of profit generation" as something other than important. Other things always hold their focus. Here is another example of something as fundamental as malware precipitating a business black-swan event - something a jobbing CISO or HofS is reminded of everyday. An example I will use Perhaps NIS2 and DORA will cause a shift in mindset

8

4 Comments

https://lnkd.in/eCAau6qp An interesting read and it goes to show you can take on huge corporations and win. Also how long it took is just insane.

4

🔐 🤖 🧠 Weekly InfoSec Knowledge Nugget 🧠 🤖 🔐 ℹ 30 million people in the UK have had data lost or stolen, whereby 55% of UK adults reported having had their data lost or stolen, and 30% of them experiencing emotional distress as a result. 🔗 Source: UK Information Commissioner's Office: https://lnkd.in/df-NS6rK ⚡Data is gold these days and it is important to safeguard it using robust security practices. Individuals and organisations alike need to do more to improve their security and data protection measures to protect this precious data. As individuals we need to ensure that we only share data with reputable organisations who have the safeguarding of such data as a core interest. Organisations collecting data need to implement all the necessary security protocols and controls to protect the data they are collecting and processing. #security #infosec #data #dataprotection #gdpr #databreach #uk #ico

2

Question for my network, what / if any training courses are there for getting someone up to speed on carrying out due diligence / risk assessments on financial organisations? Things like understanding sanctions, UBO risks, suscept business locations / registrations etc etc I have a list of things i look for but I want to get a colleague trained up, any suggestions?

28

6 Comments

Session 05 of the CISO Sessions - Useful CISO Metrics is now live. Each week I will be providing bite size snippets demonstrating how to create actionable business focussed security metrics. https://lnkd.in/eu_zFvQG

12

2 Comments

I will be speaking about Business Driven Cloud Architecture exploring why the vendor reference frameworks aren't enough. This will focus on the top down approach and identifying what capabilities you need. A follow up session at our next SABSA world event will look at development of the capabilities themselves.

19

So all this talk about DORA.. Boring EU speak, i know. "We're in Brexit land" they say. "We're not EU regulated", they say. "We only care about the SEC or MAS or FIMA or others". So full disclosure, i used ChatGPT to break the writer's block and accelerate the production of the following post/article. If you see anything materially incorrect, let me know and we can use it for a case study about the dangers of relying or utilising AI. So, without further ado about nothing: The FCA (Financial Conduct Authority) and the PRA (Prudential Regulation Authority) in the UK have introduced important frameworks around operational resilience in the financial services sector, focusing on ensuring firms can handle disruptions to key services, including cyber attacks or supplier failures, just like DORA. Here's what the FCA and PRA emphasize, as well as the timeline for compliance, including the upcoming 2025 milestone: Definition of Operational Resilience: Operational resilience refers to a firm’s ability to prevent, adapt, respond to, recover, and learn from operational disruptions. This includes ensuring that critical business services remain available during times of stress, disruptions, or crises. Legislation and Deadlines March 2022 Deadline: Firms were required to have identified their important business services, set impact tolerances, and conducted initial testing by March 2022. They were also expected to have operational resilience plans in place and started to address any gaps. **** March 2025 Deadline: **** Firms must demonstrate full compliance with the operational resilience rules by March 2025. This means they should be able to remain within their impact tolerances under a wide range of severe but plausible disruption scenarios. Remind you of any previous LOB regulations? Stress testing perhaps? By this date, firms are expected to have completed all necessary improvements to their resilience capabilities, ensuring that they can meet their impact tolerances for critical services. Focus of FCA and PRA are the usual historic areas but with OR/cyber focus: Consumer Protection: Protecting consumers from significant harm due to operational failures is a core focus. Market Integrity: Ensuring that the financial system remains stable and trust is maintained even during disruptions. Systemic Risk: Preventing major operational incidents from creating systemic risks for the wider financial system. Conclusion: The FCA and PRA are requiring firms to take proactive steps to build and strengthen their operational resilience. The March 2025 deadline is significant, as it marks when firms must be fully prepared to manage disruptions effectively, staying within their stated impact tolerances. This regulatory push is part of a broader effort across global financial systems to mitigate operational risks, especially in the face of increased cyber threats and technological dependencies.

14

2 Comments

What's in a Name? Having led the response to major reliability and cyber incidents over the last 15 years, I am fascinated by how the names of incidents often starkly contrast with those of projects. Projects typically bear grand titles, invoking historic milestones or badges of greatness 🏆, while incidents are given more mundane, boring names. Take the recent CrowdStrike incident, for instance, named "Channel File 291." In contrast, consider project names like "Apollo" or "Titan," which evoke a sense of grandeur and ambition. Even the actual sensor in question, Falcon, symbolizes agility and precision. Unfortunately, these attributes were not evident in the incident a few weeks back. And no, "Blue Screen of Death" was not a contender ☠ . This naming convention highlights how incidents, despite their significant impact, are often treated as routine problems to be managed and resolved. In contrast, projects are celebrated endeavors aimed at achieving major milestones. #IncidentManagement #ProjectManagement #CyberSecurity #TechLeadership

2

Session 08 of the CISO Sessions - Useful CISO Metrics is now live. Each week I will be providing bite size snippets demonstrating how to create actionable business focussed security metrics. https://lnkd.in/eu_zFvQG

14

Bank of England’s Sasha Mills sets out the banks expectations around operational resilience for FMIs. Some key points hinting at regulatory focus in the run up to April 2025… 1. Growing emphasis on cyber and data corruption scenarios as some of the most demanding 2. Ensuring that extreme but plausible scenarios provide a full exploration of resilience issues 3. Adopting more comprehensive resilience testing regime over time not just tabletops 4. Considering broader market impacts and involving market participants in testing 5. Growing emphasis on third party risk and the forthcoming critical third party regime While this speech focuses mainly on payment systems - the themes will be familiar to most FIs in their recent dealings with regulators. While April 2025 focusses many people’s minds - we can all be certain that regulatory interest in resilience will not diminish after that date. We wait with interest for the next rounds of supervisory engagement as the regulators digest everyone’s latest self assessments. #operational resilience

62

1 Comment

For anyone in security, I highly recommend reading Phil Venables' latest piece—an excellent introduction to the concepts of risk appetite and risk tolerance, complete with practical insights. I often see these terms used interchangeably, even though they represent distinct aspects of risk management. Here’s a simple analogy to clarify the difference: ➡️ Risk appetite is like deciding to go to the casino—it's your willingness to take on risk in the first place. ➡️ Risk tolerance is the amount you’re comfortable losing once you’re there—it's the level of risk you’re willing to accept within that decision. #RiskManagement #CyberSecurity #Security

30

1 Comment

Session 06 of the CISO Sessions - Useful CISO Metrics is now live. Each week I will be providing bite size snippets demonstrating how to create actionable business focussed security metrics. https://lnkd.in/eu_zFvQG

12

Not to jump on the bandwagon, but this Crowdstrike incident is a perfect example of the risk of supply chain attacks. As we drive to be as close to the cutting edge as possible in regards to our controls to thwart potential malicious actors, we have introduced several instances of centralisation which can and has affected global markets. The SolarWinds attack was a pivot into various organisations, technologies such as Crowdstrike sit at the heart of a lot of services we provide our customers. Because of this requirement to deploy frequent and almost instant changes of signatures and heuristic detections across our security estate, the ability to test what has been deployed is almost impossible. I am sure that Crowdstrike did not intend to release such a potentially devastating content pack, but it does demonstrate the loss of control and the centralisation of these controls have been performed globally. I don't have an answer apart from our suppliers need to ensure the validation of their tools are correct, but it does come at the expense of speed. Correctness vs speed, not sure what side I would want to be on whilst the next sexy new 0day comes into play. It's a hard one.

107

9 Comments

We can talk about AI. We can say we are doing all cool things with AI in security, but maybe we should talk about the frankly boring stuff a bit more? Patching is a pain, we get it and we do need to revolutionise the approach. Two years ago, Mark Carney wrote a phenomenal paper (https://lnkd.in/d6ewm7ss) where, in essence, the idea was to prioritize patches by expressing the connectivity of various vulnerabilities on a network with a QUBO and then solving this with quantum annealing. I'm sorry Daniel, a wat? Well a QUBO problem involves finding values for binary variables (i.e., variables that can only be 0 or 1). You can think of this as 1 if vulnerability is to be patched in the current cycle or 0 otherwise. We cannot patch all, let's be honest with each other here, but what we can do is apply some logic to it, like: Impact of vulnerabilities: Some vulnerabilities might have a more significant impact if exploited. Take a SSL VPN here, the border gateway device. Dependency factors: Some systems or applications might depend on others, so patching one might reduce the risk or necessity of patching another immediately. Patching costs and risks: Including the cost or potential disruption caused by patching (e.g., system downtime) The paper is deep, as you'd expect from Dr Carney, but it has logic to it and the use of vulnerability graphs to help ascertain what to patch, based on the above and by employing a QUBO approach to the problem of vulnerability patching, an organization can systematically analyze and prioritize patches in a manner that accounts for the complex interdependencies between system components, leading to a more secure and efficient patch management process. I didn't say it was easy but the graph showing how badly we are doing it now, kinda tells me we need to rethink our approaches to patching.

68

10 Comments

Thanks Jian Hui Lee for reposting and sharing. Glad that my approach of narrowing down the attack techniques as part of threat-driven risk assessment seems to align with this profiling approach and in the right direction. If you want to start doing a threat-driven risk assessment, then I do think this is worth a read to help you scope threat identification into more manageable and less daunting task. Thereafter, apply contextualisation of the narrowed down threats to your tech setup. Now, you will have a list of threats that are nearer to the real-world than just theory.

11

1 Comment

UK arrests teen linked to Transport for London cyber attack U.K.'s National Crime Agency says it arrested a 17-year-old teenager who is suspected of being connected to the cyberattack on Transport for London, the city's public transportation agency. "A teenager has been arrested in Walsall by the National Crime Agency, as part of the investigation into a cyber security incident affecting Transport for London (TfL)," reads the NCA statement. "The 17-year-old male was detained on suspicion of Computer Misuse Act offences in relation to the attack, which was launched on TfL on 1 September." Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

1

Would you like to understand more about the intersection of Business Risks, Technology Driven Risks and Vulnerabilities? Are you interested in how to automate the CONVERSION of Technical Vulnerabilities INTO Technical or Cyber Security Risks, knowing that the Board of Directors views Cyber Security as a Business Risk? Join me at the UK Financial Services Information Security Network 2024 as I share insights into this topic. #The Network Group

21