Sunaina Aytan

So today I am posting the 6th in the NCSC CAF series. The document isn’t technical - it’s not meant to be, it's written to explain a concept that forms part of a holistic cyber posture, chunked into the CAF principles - this one is about Identity & Access Control. 5 minute read - two pages of text - come on you can do it!! Key takeaways: What is it - in simple terms How does it work - as a physical scenario What should you consider - at really high level I am interested in constructive feedback - so if you have any whack them in the comments or DM me. If you want me to expand my view, just reach out. Happy Cyber Awareness Month!!!

10

1 Comment

Cyber Incident Response Scheme (CIR) NCSC are about to announce a change in the names of the CIR Scheme. CIR (Level 1) will now be known as CIR – Enhanced level; CIR (Level 2) will now be known as CIR – Standard level. Cyber Incident Response – Enhanced level: The companies assured to respond to the full gamut of incidents, up to and including the most complex, high-risk incidents affecting nationally critical systems, including in multiple legal jurisdictions. Cyber Incident Response – Standard level: The companies assured to respond to largely untargeted, commodity-level attacks, usually in UK-only organisations and against nationally non-critical systems. Who is your Cyber Incident Response provider? When you come to review be aware of the imminent change, so that you can update your documentation. The NCSC recommends that all UK organisations should use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents. This includes, but is not limited to, businesses from small, local companies to large, multi-national organisations, central and local government, and charities. https://lnkd.in/eju_MVez

15

4 Comments

Thanks for commenting in Chasing Cyber on the QRNG Framework we published last week (https://lnkd.in/etETiMGZ), Duncan Jones. As my colleague, Itan Barmes, Quside's Carlos Abellan, and I worked through the drafts we did indeed strive to make the point that you highlight: that such frameworks can help provide a degree of assurance and market differentiation. I look forward to seeing how this type of activity evolves as industry requirements for quantum cyber readiness continue to crystallize. As Itan Barmes consistently points out, topics like this are, of course, more broadly applicable than the quantum threat. Adnan Amjad, Mark Nace, Emily Mossburg, Scott Buchholz, Deborah Golden, Clare Harding, Duleesha Kulasooriya, Robert Hillard, Dana Spataru, Marc Verdonk, Niels van de Vorle, Itan Barmes, Casper Stap, Ben Shapiro, Vikram M., Rita Gatt, Julie Gleeson #Deloitte #CyberRiskManagement #QuantumCyberReadiness https://lnkd.in/eNiQaMxN

28

3 Comments

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments

Compliance doesn't have to be a painpoint! We've recently closed out and delivered a handful of ISO 27001 internal audits and vCISO support for ISO 27001 and the feedback is in! Below is an example of some awesome Trustpilot feedback from an awesome customer we helped get ready for their ISO 27001 audit. 👇🏼 Each business is a unique rubiks cube of challenges and opportunities. Getting to understand them in a finite amount of time to advise on the effectiveness and efficiency of security controls is an art as much as a science. At Steel FYI we pride ourselves in giving practical, friendly, and commercially-minded advice on how to achieve compliance and prevent material breach, without tying the business up in red-tape. If you want some support in making ISO 27001 work for your business, not the other way around, drop me a message 📨

21

Are you looking to improve your leadership skills? I had the pleasure of meeting Andy Ellis at RSA last week and have been digging into his book ever since. Being one of the most well-known and experienced cybersecurity leaders, he shares dozens of lessons and observations that anyone, at any stage of their career, can use to create a work culture of continuous improvement and strong leadership Andy Ellis is a graduate of MIT and former US Air Force officer. In his 20-year tenure, he designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1,000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business.  Andy is now the founder of leadership development firm Duha, where he teaches his leadership philosophy not only to other executives, but strives to make leadership training more accessible to people at all career levels. My takeaways so far: ✅Focus on the present, worrying about failure can make it happen! ✅Consistency matters ✅Performance development is for EVERYONE in your team. Grab a copy if you’re looking to improve your leadership skills, I’m glad I did. #leadership #cybersecurity

30

PSNI fined £750,000 for data breach despite appeals to lower amount due to perilous finances... Would your organisation survive if you received a fine like the PSNI have? Are you ensuring that your staff members are acting as a human firewall to keep you and your data safe? If you are reading this and feel like you have members of the team who may be a risk to your organisation, are you testing and training them to improve education and vigilance levels? At Phishing Tackle, we understand that user education differs and that groups of users have different levels of vigilance. This is where, with the fully managed service, we break the users into groups and test and train them consistently, with up-to-date and relevant material, to ensure that education and vigilance levels increase across the board, within a matter of weeks. Are you looking for someone to take this stress away from you? Drop me a DM! #humanfirewall #phishing #security https://lnkd.in/evD7Q2Ta

7

1 Comment

the LinkedIn fairies asked me to share my thoughts... probably a mistake on their part but they asked, so here we go. The biggest inertia in an organisations cyber maturity is the board. Ok, so I just said that and here I am trying to sell my services to them! Let me add a little bit more to that statement. It’s not their fault! We expect them to know why cyber risks are business risks without detailing the organisational benefits of the investment we are asking them to make, and we don't demonstrate the impact of a cyber incident in a way that they can easily understand (most are not cyber experts and we don’t want them to be, they are business leaders). And most importantly, stop trying to scare them into action, explain the risk in a way they can relate to, they’ll get it and they will act because they get things like bottom line impact and brand trust erosion without having to tell them the sky is falling down. Food for thought...

12

1 Comment

Daily Cyber Briefing - Wednesday 11th September The latest cyber security news. #infosec #cybersecurity #cybersecuritynews

3

7 Comments

As is so often the case “simple to implement procedures could have prevented the serious breach” While the PSNI were impacted by this breach, similar breaches are happening on a daily basis, where simple procedures could prevent such breaches. Reach out to NexGen Cyber Limited to protect your business from having a serious data breach.

8

Our Threat Intelligence Team has reported a GitHub phishing campaign that targets GitHub users, tricking them into downloading infostealer malware. This week, GitHub users have been getting email notifications telling them to address a fake "security vulnerability" in a project repository to which they have contributed or subscribed. The emails advise users to visit "github-scanner[.]com" to learn more about the supposed security issue. The domain github-scanner[.]com is not affiliated with GitHub and is being used to distribute malware to visitors. BleepingComputer has confirmed that the Lumma Stealer malware is an information-stealing malware used to steal credentials, authentication cookies, and browsing history from installed web browsers. The malware can also steal cryptocurrency wallets or files containing sensitive information from the infected device. These campaigns are likely targeting developers' credentials in order to access source code or projects, which can then be modified with malicious code to conduct supply chain attacks. If you'd like to know more about this threat or want to find out how you can help better protect your clients from cyber attacks, get in touch or visit www.dynarisk.com #Phishing #Infostealers #CyberSecurity 

3

What types of vulnerabilities are targeted in penetration tests? 1/6 Access Control Management This refers to evaluating how well the system authenticates and authorises users based on their roles within the organisation. Testers create user accounts with different roles to assess whether privileges are appropriately assigned and whether there are any loopholes that could lead to unauthorised access. Keep an eye out for our upcoming posts to uncover more vulnerabilities targeted through penetration testing! #PenetrationTesting #WebSecurity #VulnerabilityAssessment #CyberSecurityTools #SecurityTesting #CyberMatters

1

🛡 Whether you're looking to build a new SOC, optimise an existing one or address specific security challenges. 🗓 Book a conversation with me for any questions or requests. #cybersecurity #SOC #securityoperationscenter #informationsecurity #riskmanagement

2

Pupils miss classes as school cyber-attacks rise! "The type of cyber-attack which increased most across all sectors between the end of 2022 and 2023, according to the ICO, was ransomware, incidents of which increased by 170%". As we know, these attacks are getting more and more regular. What is happening with your Cyber/ IT Security budget, is it stagnant or increasing? We are hearing in almost every conversation with Cyber/ Security leaders that they are under resourced, but budget restraints are holding them back from recruiting the skills they need. https://lnkd.in/e4eF_D5B. #ciso #cisos #cisolife #cyber #cuberjobs #cybersecurity #infosec #bbcnews #informationsecurity

2

1 Comment

I had the pleasure of being invited onto Robert Wall's podcast last week to talk about "The Psychology of Cyber Security". Some very interesting and, sometimes, controversial points were made. It was great to meet Paul Baird - FCIIS, Martin Simpson and Adam McCaig. Thanks for letting me take part Robert Wall. 🙏🙏🙏 #cybersecurity #psychology #podcast

12

1 Comment

𝙋𝙡𝙚𝙖𝙨𝙚, 𝘿𝙤𝙣'𝙩 𝙏𝙚𝙡𝙡 𝘼𝙣𝙮𝙤𝙣𝙚.........🤫 In conversation with a potential client looking for a senior Cyber Security/ IT Security leader yesterday, the reason they turned to us is that they do not want it known that they are looking for such a person, 𝗻𝗼𝘁 𝗯𝗲𝗰𝗮𝘂𝘀𝗲 𝗶𝘁 𝗶𝘀 𝗰𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝘁𝗶𝗮𝗹, it's because they do not want to be bombarded with 'non' relevant applicants (lots of them) applying through an online job ad and do not want to be bombarded with unsolicited CV's. The company tried the direct route for other Cyber Security/ IT Security roles and they quickly established that the hidden costs 💰 & hidden time 🕰️ it took to try and get someone onboard totally outweighed reaching out to a specialist recruiter, someone who has an engaged 🤗 community & knows what people within their network are looking for from their next role. So for your next Cyber Security or IT Security hire, remember, the direct route may seem cheaper and faster, but not always. Reach out to us and let us do the hard work for you 👍. #ciso #cisos #cisolife #cyber #cybersecurity #cyberjobs #infosec #infosecjobs #informationsecurity #jobs

10

The Nikki-Universal ransomware attack shows how quickly things can spiral when cybercriminals strike—and why the stakes are higher than ever for businesses worldwide. Attacks like these aren’t just about encrypted files; they’re about leaked secrets, operational chaos, and reputation damage. With hackers using tactics like double and triple extortion, it’s clear: defense strategies must evolve. For more insights and analysis, check out the detailed post on Matisoft’s LinkedIn page. Follow Matisoft Cyber Security Labs for more insights and updates on this and related topics. #MatisoftLabs #Cybersecurity #RansomwareAttack #DataSecurity #RiskManagement #IncidentResponse #CyberResilience

1

🚨 Attention Business Owners! 🚨 A recent cybersecurity breach has exposed the personal data of nearly 70,000 Welsh Rugby Union supporters' club members. Names, addresses, phone numbers, emails, and payment details were all leaked. 😱 This incident highlights the critical importance of robust cybersecurity measures. Here are a few takeaways: 🔒 Secure Your Data: Ensure your data protection strategies are up-to-date. Encrypt sensitive information and regularly update your security protocols. 🛡️ Employee Training: Educate your team about cyber threats and safe practices. Human error is often the weakest link in security chains. 📈 Regular Audits: Conduct frequent security audits to identify and address vulnerabilities before they can be exploited. 📞 Incident Response Plan: Have a clear action plan for potential breaches to minimise damage and restore trust swiftly. Cybersecurity isn't just an IT issue—it's a business imperative. Protect your business, your data, and your reputation. Don't wait for a breach to take action! #CyberSecurity #DataProtection #BusinessSafety #TechNews #StaySecure https://lnkd.in/egW_i32Z

3