Cybersecurity Expert

I was a panellist at the e-Crime & Cybersecurity Congress last week, the discussion was titled ' What's happening to your business? Cloud security, new business metrics and future risks and priorities for 2019 and beyond ", a recap of the points I made. Cloud is the 'Default Model' for Business Cloud is now the default model for IT services in the UK; cloud ticks all the efficiency boxes successful business continually craves. Indeed, the 'scales of economy' benefits are not just most cost-effective and more agile IT services, but also include better cybersecurity (by the major cloud service providers), even for the largest of enterprises. I t is not the CISO's role to challenge the business' cloud service mitigation, which is typically part of a wider digital transformation strategy, but to ensure cloud services are delivered and managed to legal, regulatory and client security requirements, and in satisfaction of the board's risk a...

Guest article by Cybersecurity Professionals What can we learn from the major data breaches of 2018? 2018 was a major year for cybersecurity. With the introduction of GDPR, the public’s awareness of their cyber identities has vastly increased – and the threat of vulnerability along with it. The Information Commissioner’s Office received an increased number of complaints this year and the news was filled with reports of multi-national and multi-millionaire businesses suffering dramatic breaches at the hand of cybercriminals. 2018 Data Breaches Notable breaches last year include: 5. British Airways The card details of 380,000 customers were left vulnerable after a hack affected bookings on BA’s website and app. The company insists that no customer’s card details have been used illegally but they are expected to suffer a major loss of money in revenue and fines as a result of the attack. 4. T-Mobile Almost 2 million users had their personal data, including billing information and em...

The MITRE ATT&CK knowledge base continues to gain traction as the defacto source for supporting business threat assessing, developing proactive cybersecurity and cyber resilience strategies. ATT&CK provides a defined understanding of the adversaries, their associated tactics, their techniques and procedures (TTPs). The ATT&CK comprehensive knowledge base of adversary tactics and techniques has been built up using real-world observations and is freely available to use.  There are many ways in which organisations can benefit from ATT&CK, often dependant on an organisation's security capabilities and the general security maturity. Steve Rivers, Technical Director International at ThreatQuotient has written guidance on the MITRE ATT&CK stages of maturity, so that any organisation can derive value from it. MITRE ATT&CK Framework: Keep your friends close, but your enemies even closer Steve Rivers, Technical Director International at ThreatQuo...

The perceived threat posed by Huawei to the UK national infrastructure continued to make the headlines throughout February, as politicians, UK government agencies and the Chinese telecoms giant continued to play out their rather public spat in the media. See my post Is Huawei a Threat to UK National Security? for further details. And also, why DDoS might be the greater threat to 5G than Huawei supplied network devices . February was a rather quiet month for hacks and data breaches in the UK, Mumsnet reported a minor data breach following a botched upgrade , and that was about it. The month was a busy one for security updates, with Microsoft , Adobe and Cisco all releasing high numbers of patches to fix various security vulnerabilities, including several released outside of their scheduled monthly patch release cycles. A survey by PCI Pal concluded the consequences of a data breach had a greater impact in the UK than the United States , in that UK customers were more likely to abando...