Robert J Toogood

ICS Advisory Project Weekly Summary [8 - 12 April 2024. Here is this week's ICS Advisory, Other CERT, & Vendor vulnerability advisories weekly summary for 22 – 26 April 2024. Attached are this week's CISA ICS Advisory summary slides. This past week, CISA released four new ICS Advisories for Siemens, Honeywell, and Hitachi Energy. Updated CISA ICS Advisories were released for the Rockwell Automation - 5015-AENFTXT [ICSA-24-102-09], Chirp Systems - Chirp Access [ICSA-24-067-01], Mitsubishi Electric - Electrical discharge machines [ICSA-24-051-03], Mitsubishi Electric - MELSEC iQ-R Series/iQ-F Series EtherNet/IP Modules and EtherNet/IP Configuration Tool [ICSA-23-157-02], and Mitsubishi Electric - MELSEC Series CPU module [ICSA-23-143-03]. Based on the new CISA advisories, Critical Manufacturing, Energy, Chemical, and Water and Wastewater Systems are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 11 new advisories from other CERTs and Vendors for the following vendors: MOXA [Industrial Switch], Delta Electronics [Industrial Gateway], Dräger [Medical Device and Software], OMRON [PLC], Meinberg [LANTIME], Secomea [Industrial Access Management Server for remote machine maintenance.], Welotec [SMART Enterprise Management System], Grassroot DICOM [DICOM medical files], and DCMTK [Medical software]. See the Weekly Summary of Other Vendor & CERT Advisories for potentially impacted CI sectors. Four new Known Exploited Vulnerability (KEV) Catalogs were added this past week. However, CISA released ICSA-24-116-03 - Siemens RUGGEDCOM APE1808 Devices Configured with Palo Alto Networks Virtual NGFW for CISA Known Exploited Vulnerability (KEV) Catalog match CVE-2024-3400 —Palo Alto Networks PAN-OS Command Injection Vulnerability.

3

Cyber Essentials is a UK government-backed scheme designed to help organisations safeguard sensitive information by implementing baseline security measures. Thrive, as a recognised certification body for Cyber Essentials (CE) and Cyber Essentials Plus (CE+) through IASME, is here to guide businesses through the journey to CE compliance and a stronger cybersecurity posture! Check out our latest blog to dive deeper ▶️ https://lnkd.in/eiypyyHP #CyberEssentials #UK #Cybersecurity #CE #Compliance

37

1 Comment

The deadline for NHS Data Security and Protection Toolkit (DSPT) submissions is officially next month. ⌛ Final DSPT submissions are expected no later than 30th June 2024. This year's toolkit is a little different to last year's, with a number of changes having been made that organisations need to be aware of. If your organisation is required to provide this, have you done so yet? Our latest blog post covers the updates you need to know about, goes over what the DSPT actually is, and delivers comprehensive advice on completing it. We also provide you with a handy downloadable resource that covers the 10 data security standards that the DSPT is built around. ✅ Read it here: https://lnkd.in/gzYbRDRy Do you need reassurance about your DSPT submission? Do you want to be certain that it covers everything it needs to, and that it effectively demonstrates your organisation's compliance? If that's the case, take a look at our DSPT review and audit service. https://lnkd.in/g-ctQEYz We'll take a thorough look at your submission and identify any gaps or oversights - this way, your organisation can rest assured that this year's submission will meet the required standards. 🔍 Nigel Gooding LLM, PGDip, PGCHE,PGCert, FBCS, FCMI Natalie Bennett Emma Martins Nicola Saunders ACIM #data #privacy #dataprivacy #dataprotection #dspt #dsptoolkit #nhs #nhsdspt

19

Download your FREE sample of our book of the month ‘IT Governance – An international guide to data security and ISO 27001/ISO 27002, Eighth edition’ by Alan Calder & Steve Watkins. 📘   The book is the recommended textbook for the Open University’s postgraduate information security course and the recommended text for all IBITGQ ISO 27001 courses.   Download your free book sample here 👇   #FreeSample #itgovernance #datasecurity #iso27001 #iso27002

8

ICS Advisory Project Weekly Summary [8 - 12 April 2024] Here is this week's ICS Advisory, Other CERT, & Vendor vulnerability advisories weekly summary for 8 – 12 April 2024. Attached are this week's CISA ICS Advisory summary slides. This past week, CISA released ten new ICS Advisories for Siemens, Rockwell Automation, and Subnet Solutions Inc. No updates were released this past week. Based on the new CISA advisories, Critical Manufacturing, Energy, Transportation Systems, and Water and Wastewater Systems are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified eight new and three updated advisories from other CERTs and Vendors for the following vendors: Rockwell Automation [PLCs], Schneider Electric [Multiple Products], B&R Industrial Automation GmbH [Multiple Products], Pepperl+Fuchs SE [Network Module], UNISOC [Chipset], Westermo [WeOS], and Welotec GmbH [Industrial Router]. See the Weekly Summary of Other Vendor & CERT Advisories for potentially impacted CI sectors. CISA added three new Known Exploited Vulnerability (KEV) Catalogs. None of these CVEs correlated to the CISA ICS Advisory. [See Attached Slides for details on CVEs added to the KEV Catalog]. ICS Advisory Project has identified a CISA ICS Advisory to CISA Known Exploited Vulnerability (KEV) Catalog match for ICSA-24-102-03: Siemens RUGGEDCOM APE1808 before V11.0.1 released this week to CVE-2022-0028—Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability.

2

This EuroMaTech Document Control Specialist training course will concentrate on the skills required to effectively deploy and maximise the benefit of document and records management as well as manage the outcomes and deliver business benefits. All participants will return to their organizations with a detailed understanding and have developed action plans to implement document and records management successfully in their organisations. Register today! https://lnkd.in/dMHYeRuM #documentcontrol #recordsmanagement #compliance #iso15489 #informationgovernance #datamanagement #businessprocesses #documentmanagement #euromatech #qualityassurance #informationsecurity #documentretention 

5

🚨 Incident Response in Healthcare: Steps to Take After a Cyber Breach Having a robust incident response plan is essential in healthcare. 🏥⚡ Only 50% of healthcare organisations have a tested incident response plan in place. 📊 A healthcare provider's response to a breach showed the importance of a well-prepared plan. 🔧💼 Quick Tip: Regularly test and update your incident response plan. 🔄📋 Contact us to find out how Periculo can help with your response plan🛡️⏱️ https://lnkd.in/enn-zFdn

1

The Critical Platform Transformation project and Enterprise Security Programme, which aim to tackle technical debt and improve cyber posture, have now formally been combined to become the Technical Health Programme... #HMRC #digitaltransformation #governmentdigital #ukgov

1

NHSE seeking provider to support cyber resilience in NHS supply chain - Digital Health Title: NHSE Seeking Provider for Cyber Resilience in NHS Supply Chain #NHSE Provider Search The NHS England (NHSE) is looking for a provider to enhance cyber resilience in the NHS supply chain. This initiative aims to strengthen security measures against cyber threats. #Key Requirements The chosen provider must meet specific criteria to ensure the security and protection of sensitive healthcare data. These requirements include expertise in cybersecurity, experience in the healthcare sector, and a proven track record in implementing robust security measures. #Benefits of Cyber Resilience Enhancing cyber resilience in the NHS supply chain can help prevent data breaches, protect patient information, and maintain the integrity of healthcare services. By implementing strong security measures, healthcare organizations can minimize the risk of cyber ai.mediformatica.com #cyber #suppliers #security #supplychain #cybersecurity #nhse #contract #management #risk #tender #digital #health #digitalhealth #healthit #healthtech #healthcaretechnology @MediFormatica (https://buff.ly/4eGfHqE)

1

📽 Watch a new webcast providing a comprehensive overview of the ESRS–ISSB Standards Interoperability Guidance published in May 2024. Join ISSB Vice-Chair Sue Lloyd and ISSB Strategy Lead Sam Prestidge as they delve into: 🔹 The background and purpose of the Interoperability Guidance; 🔹 The high alignment of climate-related disclosures between ISSB Standards and ESRS, simplifying reporting for companies; 🔹 Specific elements of the disclosures necessary for compliance with both standards; and 🔹 Incremental disclosures in ESRS. This webcast is designed to help companies understand the interoperability between ISSB Standards and ESRS, making it easier to ensure compliance with both sets of standards. 👉 Watch the webcast and access the ESRS–ISSB Standards Interoperability Guidance: https://lnkd.in/ek8nd4iQ 👉 Explore other ISSB educational material: https://lnkd.in/ddXp8F9m #Sustainability #ESRS #ISSB #IFRS

157

Free PDF download 📩 Cyber Security and ISO 27001 – Reducing your cyber risk With thousands of cyber attacks launched every day, putting in place appropriate cyber security measures is more vital than ever. The urgent need to protect information – and to be seen to be protecting it – is motivating more and more organisations to achieve certification to the international standard for information security management, ISO 27001. Download this paper to: ​ 🛡️Better understand the cyber threat landscape; 🛡️Learn more about ISO 27001 and its benefits; and 🛡️Discover our nine-step approach to implementing the Standard. Download now 📩 https://ow.ly/pgEu50SvUgK #CyberSecurity #ISO27001 #InformationSecurity #CyberRisk #CyberThreat

9

‘IT Governance – An international guide to data security and ISO 27001/ISO 27002, Eighth edition’ 🔒 ✅Fully updated to align with ISO 27001/27002:2022 ✅Recommended textbook for The Open University’s postgraduate information security course. Find out more and order your copy today! 👇 https://ow.ly/XJPw50SFpKi #ITGovernance #NewEdition #datasecurity

12

If you want to install the risk mindset, read these books: Links to the standards and publications can be found in my latest article. ________ Enjoy this? Join 7K+ in GRC Lab — my free newsletter to help you launch, grow and accelerate your career in GRC:

56

3 Comments

🔐 Practical Guide to Risk Management with NIST’s RMF 🔐 If your organization is focused on securing information systems, the NIST Risk Management Framework (RMF) is a must-have approach. Here’s a practical breakdown of how RMF can improve security and privacy, step by step: 1. Start with Preparation: Identify risks, assign roles, and understand system priorities before diving in. Knowing what’s critical makes the rest of the process smoother and more effective. 2. Categorize Systems by Impact: Classify systems based on the impact of a security breach. This step ensures resources are focused where the risk is highest. 3. Select Controls: Use the RMF’s guidelines to choose security and privacy controls that match your organization’s unique needs. The goal is to mitigate risk in a targeted way. 4. Implement Controls: Deploy these controls practically within your systems and document everything—clear documentation aids future reviews and audits. 5. Assess Effectiveness: Conduct thorough assessments to confirm controls work as intended. RMF’s structure makes it easier to spot gaps and make quick fixes. 6. Authorize for Operation: With the controls in place and assessed, RMF helps you determine if your systems are ready for authorization, balancing security with operational needs. 7. Continuous Monitoring: Keep systems secure with ongoing monitoring and automated checks. This way, you stay ahead of threats and keep controls effective. Why Use RMF? Scalable: Works for both federal and non-federal organizations. Integrated Security & Privacy: Aligns with lifecycle engineering and supply chain security. Automated for Speed: Real-time monitoring reduces effort and boosts security decision-making. For any organization looking to boost cybersecurity and privacy in a structured way, RMF provides both the framework and flexibility needed to succeed. #Cybersecurity #RiskManagement #NIST #Privacy #Compliance #DataProtection #Infosec #FRA

3

The deadline for the NHS Data Security Protection Toolkit (DSPT) is fast approaching! 😥 Our Information Governance team recently summarised some of the most common mistakes made during the submission process and how you can avoid them: https://lnkd.in/e66MAyic If you're lost on your journey, we can help navigate the path. We have an in-house team of experts that can help: ✅ Develop a compliant #DSPT submission ✅ Support organisations to embed Information Governance best practices 👨‍⚖️ Act as expert Data Protection Officers (DPO) for #DigitalHealth and #MedTech businesses ✅ Prepare for advanced Information Security Certifications such as #ISO 27001 Get in touch. #JoinThe8fold

7

Is your PMO at risk? 🚨 When selecting a PPM tool, security is paramount. Your 4 essential requirements should be: ✅ Cyber Essentials Plus ✅ ISO27001 ✅ Annual Penetration Testing ✅ UK Data Storage Failing to meet these standards could leave your project portfolio vulnerable to cyberattacks. 🛡️ Protect your organisation with PM3, a PPM tool built with security at its core. 🔒 Let's discuss how we can safeguard your PMO. #PPMTool #cybersecurity #PPM #PMO #datasafety #PM3

5