Risk Management & Reporting Archives

Scrub up – good security starts with cyber hygiene

Squeaky clean cyber hygiene has never been more important. Several Victorian hospitals in Australia were recently hit by a ransomware attack, causing many of their most important administrative systems to be shut down to prevent the malware from spreading. Included in those areas of the business affected by this attack were systems running their financial management, internet and email services, many of which have taken over a week to restore.

Audit, Compliance and Risk: The Charlie’s Angels of cyber security

Cyber security is one of the largest and most critical risks facing businesses. It has had continued and increasing attention not only from within the IT security function itself but from the wider business at board level.

The difference between PIs and KPIs in cyber security

The difference between “performance indicators” (PIs) and “key performance indicators” (KPIs) seems obvious. “Key” ones are more important, they are a subset of a larger (and longer) list.

In security, particularly in compliance-driven environments where the information security management system (ISMS) is aligned to a standard, there can be over a hundred controls that must be in place and (ideally) routinely audited, monitoring and reported on.

Getting the most from security measurement

One common challenge in security is in proving status reports or demonstrating progress against security KPIs – either ongoing operational ones or those that reflect continual improvement (for example, corresponding to a security improvement project).

Cyber security due diligence: Marriott’s GDPR breach fine

Last week was a big week for the Information Commissioner’s Office in the UK after the BA fine announcement (£183m) and a second data breach fine story around the Marriott Hotel chain.

Cyber resilience and real-time cyber security posture

The result of three recent cyber resilience audits conducted by the Australian National Audit Office (ANAO) was released on 4 July. The report showed some encouraging results, but also highlighted some concerns. The need for real-time visibility of cyber security posture is becoming increasingly evident.

Comparing Ways to Measure Security Control Effectiveness

There is a growing range of ways to provide security control metrics and assessments for businesses. The intended audience of these solutions tends to be non-security people, for example senior board members (for enterprise security and the associated risks) and procurement or risk/compliance managers (for third party security risk exposures) who need an understanding of cyber risk and security control effectiveness to monitor performance, improvements or exceptions.

Are your Cyber Security Controls effective?

Various factors are converging to influence the need for better management of cyber security risk. Whether it’s to understand the effectiveness of security controls, isolate any weaknesses or to simply acknowledge cyber security as a corporate governance issue; the requirement for greater visibility of an organisation’s cyber security posture is a given.

Cyber Risk Management: The SOC Team Perspective

Organisations are being asked by regulators, partners, and other stakeholders to improve their cyber security risk management process. As cyber risk becomes recognised as a business risk both senior executives and operations security managers are seeking greater visibility of those risks and access to tools that will help mitigate them.

Cyber security readiness: An insurance industry view

Much has been written about the growing and increasing maturity of the cyber security insurance market. There is also no shortage of (rather depressing) surveys of companies and breaches to give scale to the size of the cyber security problem. In Australia the research done on past breaches by ACSC led directly to the formulation of the Essential 8 cyber mitigation strategies.