Othman R.

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

Unreported #Ransomware payments represent a major blind spot for governments and the #security industry as a whole, limiting the availability of valuable insights into the proliferation of #malware and life cycles of #data breaches. The #UK government is looking to take a page from New York's playbook by not only requiring the prompt reporting of all #cyber extortion incidents, but also by adding friction into the process with the enforcement of a permission-based regime for all payments. I expect that such licensing requirements will create significant discussion, discord and disagreement. An analysis will be available in more detail later this week on the Bad Security Blog.

4

One thing that I am almost evangelical about is providing value to our clients which in turn helps our clients protect the value within their business. I saw one of my connections this morning post an opportunity for a GRC consultant to work with their organisation and external DPO to: 1: Understand the data assets within the organisation 2: Knowing the requirements and regulations relating to that data 3: Ensuring that data is stored, accessed and managed properly Think about this for a moment... what does the above indicate? The organisation does not know or understand the data they are processing, they likely do not have adequate Records of Processing Activity. They do not know which laws / regulations are applicable to the data that they do not know they are processing. And they have no idea how the data that they do not know they are processing is secured. Articles 30, 32 and the accountability principle completely ignored, and likely also the purpose limitation principle (if they don't know what data they have, they cannot have defined a purpose). I would also argue that they cannot have defined an adequate lawful basis for processing and therefore, are processing illegally. All the while, this organisation has been paying for an outsourced DPO service... Colour me surprised, but this is just the latest example we have seen of organisations providing outsourced DPO services that are not only smoke and mirrors, but also putting their clients at risk. If you work with XpertDPO - Data Protection Consultants, at the start of the DPO engagement, we will request a lot of information from you, including an org chart. We will require you to complete onboarding questionnaires. We will complete a full gap analysis audit. We will then set to work on remediating any gaps and on increasing the compliance levels within your organisation. What we will not do is send you an invoice every month and just react when something inevitably goes wrong. Far too many DPO service providers provide bad / wrong advice and do not provide any value. If you feel that your DPO Service isn't providing value, or you want an impartial review of your service, or you want to know what a proper DPO service looks like, you know what to do...

19

Interesting move by NHS England to move away from the Data Security and Protection Toolkit (which incorporated the Minimum Cyber Security Standard and GDPR Security Outcomes and was designed to meet the #Cyber and #InformationGovernance requirements for healthcare organisations) to the NCSC Cyber Assessment Framework (CAF) as per https://lnkd.in/ezA2j_-w I fully accept the move towards CAF for Cyber might make more sense, but CAF is not an Information Governance framework. Does anyone in the NHS IG space know how NHS England plan on maintaining the linkage with the NDG Data Security Standards which came from the Hannigan review? #BeyondCyber #SafeNotSecure #GovernanceFirst

2

Working with clients recently the big fear has been cyber any yet so many seem to focus the response exclusively around IT security and resilience. Some useful tips below.....

2

Interesting to see this peddled again “a lack of basic cyber hygiene”. Reviewing the latest #CyberBreach survey from HMG is sobering reading. 75% of UK business report #Cyber as being a key area for the board, yet this (again) results in total lack of #Governance: - 33% of businesses have a formal security policy - 31% have conducted a risk assessment - 30% have a board member with cyber responsibility (this has returned to the levels of 2016-18) - 27% have asset management activities - 13% are aware of the NCSC 10 Steps Guidance, but only 3% have actioned all 10 steps - 11% have conducted a pen test - 11% have reviewed their supply chains - 12% are aware of CyberEssentials (up from 8% in 2016) - 3% review NCSC/ICO guidance on Cyber (up from 2% since 2016) This is damning, we have excellent guidance on the NCSC website for Cyber and on the ICO website for Data Protection. 41% of the business are consulting externally, so why are those consultants not advising their clients correctly? I have a real issue when we fete the current #CyberSecurity strategy yet in every demonstrable metric it’s failing to engage and inform. I hope that the new government looks to reset the foundations before pushing on with anything else. Within our clients, we place baseline guidance for Cyber and Data Protection at the centre of the engagement. This ensures that governance is reset and a solid foundation can be provided for improvement.

2

2 Comments

Keir Starmer to prioritise new cyber security laws to protect the UK from attacks. The Chartered Institute for IT (BCS) and experts are concerned about recent Russian cyber threats and a major outage affecting multiple sectors. Key BCS recommendations include: 1. Cyber security officers on company boards. 2. Mandatory breach reporting and increased investment in cyber security. 3. Business plans to include resilience and better monitoring. 4. Support for small and medium-sized businesses. BCS CEO Rashik Parmar stressed the high costs of cyber crime and recent disruptions like the NHS cyber attack. Collaboration between the government, tech companies, and civil society is deemed essential. The Department for Science, Innovation and Technology supports the Cyber Security and Resilience Bill to strengthen public services against cyber threats. It does make you think, given the increasing sophistication of cyber threats and their potential to disrupt critical infrastructure, how should governments balance the need for enhanced cyber security measures with concerns over privacy and individual freedoms? #cybersecurity #cybersecuritynews #securitynews #computerfutures

9

1 Comment