Eric Byres

ISO 27001 Tip #7 emphasizes the importance of a structured incident management process. Ensure your team is ready to respond to security incidents effectively. #InfoSec #ISO27001 #CyberSecurityCanada

4

"Securing Critical Infrastructure with SCADA/ICS Penetration Testing" Canadian resources, from mining to agriculture, are the backbone of our economy. But with great power comes great responsibility—and risk. Why is SCADA or ICS Penetration Testing Essential? Cyber threats increasingly target SCADA systems due to their vital role in controlling and monitoring industrial processes. A successful breach can lead to catastrophic consequences, including operational disruption, financial loss, and public safety risks. Here's how SCADA & ICS penetration testing can help: 1️-Identify Vulnerabilities: Identify weaknesses in your SCADA/ICS system before malicious actors do. 2️-Enhance Security Posture: Strengthen your defenses by addressing identified risks. 3️-Compliance Assurance: Ensure your infrastructure meets regulatory requirements for cybersecurity. 4️-Minimize Downtime: Proactively prevent incidents that could disrupt operations. 5️-Protect Public Safety: Safeguard critical infrastructure to avoid potential hazards to the public. In an age of rapidly evolving cyber threats, ensuring the security of SCADA/ICS systems is not just a necessity—it's a priority. Has your organization implemented SCADA/ICS penetration testing? Share your experience or thoughts! Click the link below to learn more about our SCADA/ICS Pentesting service. https://lnkd.in/gwB5P6iA #rbtsec #SCADA #Cybersecurity #PenetrationTesting #CriticalInfrastructure #IndustrialSecurity

5

Program agenda now available for the ICPM-Rotman Cybersecurity Risk Oversight Program (Oct 9-11, 2024)! More details here: https://lnkd.in/gNJdbxkm ICPM and the University of Toronto - Rotman School of Management , along with Dr. Michael Parent, a recognized expert on Corporate Governance, focusing on cybersecurity and IT governance, have created the program to equip pension fund leaders -- including boards, CEOs, Chief Risk Officers, Chief Information Officers, Chief Information Security Officers, and those overseeing enterprise risk management -- with the latest best practices in governance for the proper oversight of cyber risks. Participants will learn about: · The current and evolving environment of cyber threats, including the changing regulatory landscape. · How to respond to cyber incidents in a way that will mitigate their impact, including war room preparations. · The role of pension fund boards and enterprise risk leaders in overseeing cyber risk, including the questions to ask and the answers to expect. · Optimal organizational structures, governance and processes that pension funds should have in place. · Best practices in monitoring cyber risk as well as the protection of digital assets and information in the organization. #education #execed #cybersecurity #risk #oversight #pensions #boards #trustees #IT #data #international #bestpractice #cyber

13

Reminder! Secure your spot at the ICPM-Rotman Cybersecurity Risk Oversight Program (Oct 9-11, 2024). More details here: https://lnkd.in/gNJdbxkm ICPM and the University of Toronto - Rotman School of Management, along with Dr. Michael Parent, a recognized expert on Corporate Governance, focusing on cybersecurity and IT governance, have created the program to equip pension fund leaders -- including boards, CEOs, Chief Risk Officers, Chief Information Officers, Chief Information Security Officers, and those overseeing enterprise risk management -- with the latest best practices in governance for the proper oversight of cyber risks. Participants will learn about: · The current and evolving environment of cyber threats, including the changing regulatory landscape. · How to respond to cyber incidents in a way that will mitigate their impact, including war room preparations. · The role of pension fund boards and enterprise risk leaders in overseeing cyber risk, including the questions to ask and the answers to expect. · Optimal organizational structures, governance and processes that pension funds should have in place. · Best practices in monitoring cyber risk as well as the protection of digital assets and information in the organization. Lindsey Matthews, CFA CIPM Sami Khoury #education #execed #cybersecurity #risk #oversight #pensions #boards #trustees #IT #data #international #bestpractice #cyber #governance

7

Phosphorus Cybersecurity Inc.: Unwrap a BOGO of xIoT Best Practices! Out-of-date firmware and default or weak credentials are massive entry points for malicious actors. Don't let the snow in. Let's close that door. #HappyHolidays #IoTSecurity #OTSecurity #BestPractices

14

Apply now for the ICPM-Rotman Cybersecurity Risk Oversight Program (Oct 9-11, 2024). More details here: https://lnkd.in/gNJdbxkm ICPM and the University of Toronto - Rotman School of Management, along with Dr. Michael Parent, a recognized expert on Corporate Governance, focusing on cybersecurity and IT governance, have created the program to equip pension fund leaders -- including boards, CEOs, Chief Risk Officers, Chief Information Officers, Chief Information Security Officers, and those overseeing enterprise risk management -- with the latest best practices in governance for the proper oversight of cyber risks. Participants will learn about: · The current and evolving environment of cyber threats, including the changing regulatory landscape. · How to respond to cyber incidents in a way that will mitigate their impact, including war room preparations. · The role of pension fund boards and enterprise risk leaders in overseeing cyber risk, including the questions to ask and the answers to expect. · Optimal organizational structures, governance and processes that pension funds should have in place. · Best practices in monitoring cyber risk as well as the protection of digital assets and information in the organization. Lindsey Matthews, CFA CIPM Sami Khoury #education #execed #cybersecurity #risk #oversight #pensions #boards #trustees #IT #data #international #bestpractice #cyber #governance

9

An incident response plan is crucial for any organization. It outlines the steps to take in case of a cyberattack, minimizing damage and downtime. ️At Cyber Security Canada, we audit IRPs as part of the CAN/CIOSC 104 cybersecurity standard! #cybersecurity #incidentresponse #CANCIOSC104 #preparedness #cybersecuritycanada #IRP

10

Last month, Public Services and Procurement Canada | Services publics et Approvisionnement Canada released its Summary Report on its RFI on the Canadian Program for Cyber Security Certification (CPCSC), the Canadian CMMC equivalency certification program. The summary report contains some important information about the position of industry in preparation for the CPCSC, but I noticed quickly that 22% of responses are not included in the overall data analysis. PSPC claims this is because the data is not statistically significant or important to show, but I argue this is a failure of their methodology and approach to understanding information from the RFI instead of the data being unimportant. With a program as important for the security and business of the defence industry as the CPCSC, the PSPC cannot afford to take shortcuts and dismiss what industry experts tell them about the program they are trying to implement. https://lnkd.in/gG_WQQYW #CPCSC #canada #defenceindustry #cmmc #RFI

10

Exciting news! 🚀 This week, we're kicking off a project with the Alberta Machine Intelligence Institute (Amii) to accelerate our novel applications of AI and machine learning within our Compliance Copilot platform. 😤 Are you tired of legacy firms using fear, uncertainty, and doubt to drive up costs while leaving you vulnerable and still wondering if you're compliant? 📊 Imagine having real-time visibility, actionable insights, and expert guidance right at your fingertips — instead of endless excuses and broken promises that literally "keep you up at night." We're on a mission to make understanding digital risk effortless and precise, so you can focus on growth and innovation without fear. We still have spaces for a few organizations with high assurance or complex regulatory requirements to join this first phase of co-innovation. If that sounds like you, you already know how to reach me. 😉 On a related note the Transportation Security Administration (TSA) released "SD Pipeline-2021-02E: Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing" in July with an interesting clarification for Pipeline Owner/Operators. The regulators clearly found it important to reinforce that a "If an Owner/Operator has delegated to... a #ManagedSecurityServiceProvider... specific security measures in the... Cybersecurity Implementation Plan, the Owner/Operator retains sole responsibility..." Personally, I believe that this is an important message for all leaders with risk and compliance accountabilities. Outsourcing DOES NOT transfer the risk, liability, or responsibility to your MSSP. Big thanks to National Research Council Canada / Conseil national de recherches Canada for their support on this project and helping us with our Intellectual Property Strategy to ensure that the fruits from our innovations stay in Canada. Looking forward to shoring up this part of our strategy with John Sanche and the Burnet, Duckworth & Palmer LLP team.

25

1 Comment

The Communications Security Establishment reported last year that it blocks billions of cyber attempts against Government of Canada networks each day. #CyberMonth2024 #GC institutions must notify the OPC and TBS of all material #privacy breaches, which are breaches that could reasonably be expected to create a real risk of significant harm to an individual. In 2023-2024, the OPC received 321 reports of cyber incidents from the private sector, and only 37 from federal institutions. If your institution experiences a material #breach, don’t forget to report it. Our new secure online breach reporting form is making it easier to report: https://lnkd.in/dG5TS7cT

14

🔐 #CyberSecurity Alert: Critical ICS Security Advisory Attention industrial control systems operators and security professionals! The Canadian Centre for Cyber Security has issued an important security advisory regarding multiple vulnerabilities. ⚠️ Critical Updates Required: • Delta Electronics InfraSuite Device Master (v1.0.12 and earlier) • Siemens InterMesh 7177 Hybrid 2.0 Subscriber (pre-V8.2.12) • Siemens InterMesh 7707 Fire Subscriber (pre-V7.2.12) • Solar-Log Base 15 (firmware v6.0.1 Build 161) • Rockwell Automation FactoryTalk ThinManager (multiple versions) 🛡️ Action Required: System administrators should immediately review, implement recommended security measures, and apply all available updates. #ICS #IndustrialControl #CriticalInfrastructure #CISA #CyberSecurity #IndustrialAutomation #Siemens #RockwellAutomation #DeltaElectronics #SecurityAlert #TechnologyNews #CyberSecurityAwareness #IndustrialSecurity #OTSecurity

2

2 Comments

New Cyber Attribution Data Centre at UNB receives federal support. The centre is expected to play a role in strengthening Canada's online security resilience. https://hubs.la/Q0302Sw00

1

The authors shown below put out a well-read academic paper on Canadian corruption issues just a few months back. That this issue continues to be highlighted by CSIS, CISC, RCMP, foreign intelligence services, and now clearly stated in academic papers... and yet is completely ignored by government... is disastrous for our nation. The well-documented complaints of thousands of citizens is denied, delayed & ignored in practiced patterns to frustrate fairness & just responses, leading to ever increasing corruption & infiltration by organized crime. Even the firing of our Attorney General, Jody Wilson-Raybould, was a cover-up of massive corruption issues in Canada... and was accomplished without any repercussions for the perpetrators. My own experience of having millions of dollars of R&D crushed by career bureaucrats has been refused any fair review even though 4 Federal Ministers had requested the tech, US Homeland had vetted the tech and approved it for BC/Alaska border testing, and CBSA & CRA documentation clearly states that there was no rationale to attack this company that was providing leading-edge border security enhancement... unless it was to defend illicit trade & money laundering. Below are excerpts from the academic paper. The conclusions they make are ignored at our own peril: The impact of neoliberal policies has been profound. The destruction of regulation, regulatory agencies and regulatory agents through downsizing, defunding and deregulation removed many of those responsible for passing and enforcing laws punishing corporate wrongdoing. While deregulation in the United States started with the election of Ronald Reagan in 1980, Donald Trump carried it to an extreme. While successive Canadian governments have never directly copied their U.S. counterparts, we, too, have witnessed the negative outcomes associated with globalization. Given all this, serious action against corruption, in Canada and abroad, must include moving beyond the narrow and reactive confines of bribery law and policy, as espoused by the OECD and woefully mishandled by the Canadian government, to confront the harms associated with globalization and bring multinational corporations under democratic control.

4

5 Comments

Phosphorus Cybersecurity Inc.: “Pushing OT operators to upgrade to PQC algorithms assumes the devices are using cryptography in the first place – which is a giant assumption!” John Terrill reminds us. In OT environments, where attackers exploit basic vulnerabilities, establishing quantum-specific resilience may feel like a shiny distraction if cybersecurity fundamentals aren’t in place. Let’s not jump ahead of ourselves; the foundation matters most for critical infrastructure resilience. Read more on Industrial Cyber where Anna Ribeiro reports on the joint DHS and CISA guidance for steps to facilitate the transition to post-quantum cryptography across Operational Technology environments. https://okt.to/ClP1WI #OTSecurity #CyberHygiene #QuantumThreats #CyberResilience

11

Reboot Communications Ltd. Excellent article Renata N. Hale #Municipal decision-makers – whether elected officials or those in senior administrative or management roles – should understand three key aspects of #cybersecurity and #risk so they can effectively manage such risks and guide cybersecurity investments where they will have the greatest impact: -treating cyber risk as business risk appreciating that cyber #threats involve more than deliberate cyberattacks knowing that #privacy #compliance does not equate to #cybersecurity Payal Sondhi Harsh Modi Tim McCreight

6

💡 #CyberDefence Update: Dave M. at Sapper Labs Group provides an overview of foreign interference threats in Canada. Learn how cyber-attacks and disinformation affect our democratic processes: https://loom.ly/HY3Hn1Q #CanadianDefenceReview #CDRmagazine #CanadianDefence #Defence

30

📅 Block your calendars! On November 14 at 1:00 pm ET, join VulnCheck and Cyware for our joint webinar, "Mining the Gaps for Emerging Threats." Register now to learn how security teams can achieve a new level of intelligence to identify and prioritize threats at scale. Click the link below for more: https://hubs.ly/Q02VbRlq0 #ExploitIntelligence #VulnerabilityManagement #ThreatIntelligence

3