Yolanda Hamblen

Interesting to see this peddled again “a lack of basic cyber hygiene”. Reviewing the latest #CyberBreach survey from HMG is sobering reading. 75% of UK business report #Cyber as being a key area for the board, yet this (again) results in total lack of #Governance: - 33% of businesses have a formal security policy - 31% have conducted a risk assessment - 30% have a board member with cyber responsibility (this has returned to the levels of 2016-18) - 27% have asset management activities - 13% are aware of the NCSC 10 Steps Guidance, but only 3% have actioned all 10 steps - 11% have conducted a pen test - 11% have reviewed their supply chains - 12% are aware of CyberEssentials (up from 8% in 2016) - 3% review NCSC/ICO guidance on Cyber (up from 2% since 2016) This is damning, we have excellent guidance on the NCSC website for Cyber and on the ICO website for Data Protection. 41% of the business are consulting externally, so why are those consultants not advising their clients correctly? I have a real issue when we fete the current #CyberSecurity strategy yet in every demonstrable metric it’s failing to engage and inform. I hope that the new government looks to reset the foundations before pushing on with anything else. Within our clients, we place baseline guidance for Cyber and Data Protection at the centre of the engagement. This ensures that governance is reset and a solid foundation can be provided for improvement.

2

2 Comments

👾 LockBit leader Identify Reveal. A leader of what was once the world’s most harmful cyber crime group has been unmasked and sanctioned by the UK, US and Australia, following a National Crime Agency-led international disruption campaign. - Dmitry Yuryevich Khoroshev, also known as Dmitrii Yuryevich Khoroshev or Dmitriy Yurevich Khoroshev, has been added to OFAC's SDN List. He is from Russia, born on April 17, 1993, with a Russian nationality. His email addresses include khoroshev1@icloud.com and sitedev5@yandex.ru. He is male, and his digital currency address is XBT bc1qvhnfknw852ephxyc5hm4q520zmvf9maphetc9z. Khoroshev poses a secondary sanctions risk under the Ukraine-/Russia-Related Sanctions Regulations. He holds two Russian passports with numbers 2018278055 and 2006801524, along with a Russian Tax ID No. 366110340670. “Khoroshev, as the developer of LockBit, typically received 20 percent of each ransom received from LockBit victims. The partner responsible for the attack received the remaining 80 percent. Thus, Khoroshev received at least $100 million in payments in digital currency,” the Ministry of Justice said in a statement. 🔐 Lesson - everything is on the internet, no one is secure. So, don't engage in any illegal activities. 💀 🌚 A hacker leaked the company data, and within that data, the hacker's information was also present. + But anyway, we, the hacker community, respect his skill, but he chose the wrong path to raise awareness in the cybersecurity community. Because in the market lots of companies don't prioritize security; they only focus on making dollars. Read More - https://lnkd.in/ew5D84ZT  #Lockbit #ransomware  #cybercrime #cybersecurity

91

1 Comment

Despite this PCI DSS v4.0 Template having being hurtling towards the QSA Companies since it was first published at the end of March 2022 (and updated in December 2022), understandably, many QSA Companies (QSACs) may have had limited time and opportunities to prepare for its arrival. Why? Well, they've already been extremely busy delivering on their v3.2.1 Report On Compliance (ROC) assessment commitments. It is only now that the PCI DSS v4.0 ROC template asteroid has collided into the QSAC world, is the impact starting to be felt. Just after the publication of the new PCI DSS ROC template, I had been commissioned to assist a level 1 Service Provider to mature their PCI DSS compliance program. Fortunately, as part of this engagement, I had the foresight to look at how this latest evolution would impact my client and their future assessments. To say that "My Gabber Was Flastered!" (I was flabbergasted) would be an understatement. 6 months working with the new 486 page ROC template as my reference blew my mind. I'd gone through some of the previous evolutionary journeys but this was (coining a phrase from Little Britain): "SOMETHING ELSE!" I was trying to imagine how QSAs were going to continue to manage this manually, using the traditional multiple screens, spreadsheets, etc. and still adhere to the stringent ROC instructions, whilst mitigating the impact on the clients. A timely intervention was to consume my life for the next 18 months. Just at the time that I was trying to get my head around the 166% longer and far more complex ROC template, Jeremy Martin, called me up out of the blue to introduce me to 27k1 Ltd's Information Security Management System (ISMS). Of course, at the time I politely informed him that I wasn't interested but could see the potential that their application could do in helping to automate and much of the time-consuming part 1, part 2 flip-flapping admin tasks, which come with completing the new ROC template. I'm hearing tales of the new level 1 assessments taking twice as long to complete and resulting in ROC write-ups that are approaching 1000 pages long. I take my hat off to all those QSACs and their QSAs who are needing to effectively manage these changes and minimise the potential impact. Hopefully, they might consider looking at 27k1's ROC Management System (RMS) to see how they might be able to assist in mitigating some of this burden. #pcidssv4 #changemanagement #evolution #pcidss

1

⚠️Only 21% of small organisations have a formal #CyberIncident response plan. ✅A cyber incident response pack is a vital tool to help prepare your organisation in the event of a cyber attack. 👉 https://lnkd.in/esNx2TMd #CyberScotland #Cyber

1

Another supply chain cyber attack. This time on the NHS potentially with live threatening consequences and blood transfusions and tests are impacted. It is yet another reminder that due diligence on suppliers must include their cyber security and data protection. Many companies are either open to audit or will provide their accreditations or auditor supplied reports, such as: - Cyber Essentials - ISO 27001/2 - NIST (US National Institute of Standards and Technology) cyber security framework - ISAE3402 SOC I or II reports I may do a later post into the nuances of these various reports and accreditations. What is interesting in the NHS case is that Synnovis are a joint venture between Synlab UK & Ireland and Guys, St Thomas’s and Kings NHS trusts. I ask the question were they subject to third party risk management as a supplier not connected to the NHS would be? If this has given you a cause for concern about your supply chain contact us. #cyberattack #dataprotection #infosec

13

1 Comment

For greater reach, sharing is highly appreciated. Every month, like this month, we can read in the news that an organisation has been hit by fire, had to be evacuated, was ambushed by a cyber-attack, had a business accident, had to recall products, power outages, staff shortages, authorities having to intervene in operations, fraud, iT failures. This overwiew is only a small part of incidents that was in the news here in June 2024 See here the importance of Business Continuity Management and having a tested and practised Business Continuity Plan. Without these two, it is often difficult for an organisation to survive. Be prepared for unwanted situations, it can prevent a lot of misery. Is BCM something nice to have? No it’s a must have to protect for and survive if your organization becomes in unwanted and risk fully situations. Visit the website here: https://lnkd.in/eFZMuiDr Total this month: Incidents: 33 Recalls/Safety Warnings: 9 Total this year:  Incidents: 243  Recalls/Safety Warnings: 78 #bcm #bcmp #bcp #resilience #safetyhealth @TheBCEye

4

Looking to progress your #cyber career and looking to gain a Professional Title? Then you can now go through the application process with CREST. You can learn more from the link in the post below. #cybersecurity #professionaldevelopment #careers #professionaltitles #security #testing

2

A very topical discussion!

5

The U.K. NHS released an update regarding the ransomware cyber attack on June 3rd against Synnovis, a pathology laboratory that processes blood tests for several NHS entities, primarily in southeast London. The attack has significantly reduced the laboratory’s capacity to process and report test results to clinical teams. Consequently, over 800 planned operations and 700 outpatient appointments have been rescheduled across the two most affected Trusts – King's College Hospital NHS Foundation Trust and Guy's and St Thomas'​ NHS Foundation Trust. The agency acknowledged in its recent update “Where there is a ransomware attack, there is always a risk that #cybercriminals also access data. Alongside work on restoring services, investigations are continuing to establish any possible impact to data.” Hackers also targeted Change Healthcare’s parent company in the U.S. on Feb. 21. The #healthcare organization paid US$22 million to ALPHV to unlock its systems; there are concerns that this may encourage further cyber attacks on the vulnerable healthcare industry. The cybersecurity incident underscores the sector’s fragility and has sparked calls for regulatory measures. “The Change Healthcare cyberattack is a sobering example of the U.S. healthcare system’s vulnerability to cybercrime,” Hannah Neprash wrote in a March Lawfare blog post. “I sincerely hope that this episode represents a significant outlier—rather than the new normal for cyberattacks in health care—but that may depend on swift policy action in the near future. The necessary policy changes may not be universally popular and will certainly be expensive. But failing to enact a meaningful response all but guarantees future disruptive #cyberattacks like the one Change Healthcare currently faces.” https://lnkd.in/eExaFQQD

2

Devastated to see another cyber attack disrupting our National Healthcare Service. The NHS relies on a network of 3rd parties helping it deliver critical services and its this supply chain which is the most vulnerable to attack. In particular the impact on pathology services which sit at the heart of healthcare procedures is concerning. Although patient data should be obfuscated in test results and is hopefully not breached, the impact of delays in pathology tests will be substantial. I expect that business continuity plans will executed that involve alternative testing arrangements and start to minimise this disruption. https://lnkd.in/eb3_QdT8

71

3 Comments

What is equally important if not more important than to speak? . . . To listen, to understand and to expand our mind and perception on what is possible for a safer and secure cyber future. I love speaking, but this week I am going to listen. I am going to listen to some brilliant speakers on everything related to social engineering, security awareness and the human behaviourial aspect. ↗ I specifically look forward to hear Charles Milton talk on how to balance user experience with cloud security. ↗ To Katie Ralph on how do we prioritize building cyber resilience in a rapidly shifting cyber threat landscape. ↗ To Dave Ross, about who is behind the ransomware negotiation and learn more about how emotional intelligence is used to prepare senior leaders for these negotiations, if push comes to shove. ↗ I can't wait to meet and listen to Tim Ward on how do we actually measure behavioural change in cyber security? ↗ To how Ben Owen and Danni Brooke deal with the common belief that hackers won't bother with people or businesses like you. ↗ And finally to Neil Frost and his take on how we demonstrate the value of cyber security awareness to stakeholders. I am sure I will listen to many more talks, and if you are attending and would love to meet up, please DM me. I promise, I will keep my Dutch humour in check and be on my best #EmotionalIntelligence behaviour 😊 But first, I am looking forward to record an in studio podcast conversation about CISO's leadership and emotional intelligence with Mark Segelov in London. Looking forward to meet new people, make new connections and build bridges of emotional resilience within cyber security. #emotionalintelligence #emotionalresilience #leadership #UKCyberWeek #securityawareness #cyberresilience

7

1 Comment

MAST's Security Report issue 395 is available to read now. This issue reviews, analyses and assesses the security issues facing the UK, London and the wider security and risk picture. Read the full report here: https://lnkd.in/eQr2DPkw #security #mastsecurity #news #uknews #crime #report #safety #secure #fyp #explore #uk #crimenews #securityservices

4

Check out this guidance for organisations who are considering payment in #Ransomware incidents? ⏰ Don't panic, review alternatives, including not paying ⏰ Involve the right people across the organisation in decisions, including technical staff ⏰Investigate the root cause of the incident to avoid a repeat attack ⏰Be aware that payment does not guarantee access to your devices or data ⏰Consider the correct legal and regulatory practice around payment ⏰Know that paying a ransom does not fulfil your regulatory obligations For more detailed information, read the #NCSC guidance webpage.

17

While there is nothing in particular within this article to disagree with, it is very slightly misleading in its theme. The cyber attack in June was carried out against a third-party supplier to the NHS. Not specific against the NHS trust(s) themselves. Which makes we wonder where the NHS DTAC comes into all this? NHS DTAC was introduced with a core purpose to: “…be used by healthcare organisations to assess suppliers at the point of procurement or as part of a due diligence process, to make sure digital technologies meet our minimum baseline standards.” This includes criteria such as Data Protection and Technical Security. The DTAC should be rigorously applied to existing suppliers as well as new/as part of procurement. https://lnkd.in/eEEdws2i

1

National Counter Terrorism Security Office (NaCTSO) invites the UK security industry for a free webinar on Security-Minded Communications via Microsoft Teams on 10 July 2024. While the webinar is open to everyone in the UK security industry, it will be particularly beneficial for those responsible for communications in their company or those who can influence communications decisions. The webinar will be presented by Beth Daniel who is the national lead for Security-Minded Communications. Security-Minded Communications (SMC) guidance is designed by National Protective Security Authority (NPSA) to disrupt hostiles and to make a hostile believe that if they were to choose an organisation or event as a place to attack, they will almost certainly fail. This approach has been informed by an extensive research programme and can help to equip organisations, venues and events with the ability to use communications as part of their protective security measures. 📅 Wed, 10 Jul ⏰ 12:00 - 13:00 BST 💻 Online Register your interest: https://orlo.uk/pCuLn Counter Terrorism Policing National Protective Security Authority (NPSA) #ActionCountersTerorism

62

2 Comments