Demith Samaraweera CISSP, CISM

The Australian Signals Directorate 's 𝐀𝐮𝐬𝐭𝐫𝐚𝐥𝐢𝐚𝐧 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐞𝐧𝐭𝐫𝐞 (𝐀𝐒𝐃’𝐬 𝐀𝐂𝐒𝐂) has released it's 6th 𝐀𝐧𝐧𝐮𝐚𝐥 𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐑𝐞𝐩𝐨𝐫𝐭 (𝐀𝐂𝐓𝐑). ASD’s ACSC urges businesses, organisations and network owners to take action by focusing on 4 key areas to bolster their cyber defences and prepare for future challenges: ❇️ 𝑰𝒎𝒑𝒍𝒆𝒎𝒆𝒏𝒕 𝒃𝒆𝒔𝒕-𝒑𝒓𝒂𝒄𝒕𝒊𝒄𝒆 𝒍𝒐𝒈𝒈𝒊𝒏𝒈. ❇️ 𝑹𝒆𝒑𝒍𝒂𝒄𝒆 𝒍𝒆𝒈𝒂𝒄𝒚 𝒕𝒆𝒄𝒉𝒏𝒐𝒍𝒐𝒈𝒚. ❇️ 𝑴𝒂𝒏𝒂𝒈𝒆 𝒕𝒉𝒊𝒓𝒅-𝒑𝒂𝒓𝒕𝒚 𝒓𝒊𝒔𝒌. ❇️ 𝑷𝒓𝒆𝒑𝒂𝒓𝒆 𝒇𝒐𝒓 𝒑𝒐𝒔𝒕-𝒒𝒖𝒂𝒏𝒕𝒖𝒎 𝒄𝒓𝒚𝒑𝒕𝒐𝒈𝒓𝒂𝒑𝒉𝒚. An insightful read, link in comments for additional factsheets.

45

2 Comments

Cyber resilience is an essential requirement for the Operational Technology that underpins Australia’s critical infrastructure. Fortunately, identifying KPIs for OT is simpler than you might think, thanks to the Australian Government’s Security of Critical Infrastructure (SOCI) Act. Looking forward to presenting 'Securing Success: Prioritising OT Security in the Boardroom and Identifying KPIs' | on the 11th of February from 09:40 am - 10:20 am. CS4CA: Cyber Security for Critical Assets #CriticalInfrastructure #OperationalTechnology #IndustrialControlSystems

82

Jay Chaudhry is the definition of a self-starter. Born in the Himalayas with no running water or electricity until high school, Jay has now scaled Zscaler to a $30B public company. He and his wife went all in many times over—betting their life savings and quitting their jobs to launch their first venture, Secure IT, which became a huge success. Jay then parlayed that into building three more self-funded, successful cybersecurity companies before founding Zscaler. In this episode, we dive into his playbook for building disruptive companies, how he picks a market, and insights on using AI to combat modern breaches—plus his perspectives on life, family, and money. Going all in on disruptive technology Truly disruptive companies can’t rely on customer validation because customers are often anchored to existing solutions. Instead, success comes from identifying a niche where the big players aren’t yet focused, going all in, and creating something fundamentally different. Disruptive technology gives you a far better shot at long-term success than incremental improvements—if your tech is only 10-30% better, competitors will catch up. For Zscaler, Jay’s early conviction in cloud-native cybersecurity fueled their 1st-mover advantage. The Power of Focus Though Jay built and sold four cybersecurity companies—three at the same time—he realized the power of focus when starting Zscaler. He initially believed he could stagger multiple ventures, giving more attention to the newer ones while the others operated independently. However, he learned thatevery company requires huge commitment—there’s no such thing as hiring a CEO and setting it on autopilot. For Zscaler, he put all his chips into one basket, took no initial outside funding, hired a strong team of engineers, and gave it 200% focus. Give decisions, not options Forcing a decision, not a choice, can work wonders. Instead of letting customers compare multiple options, position yourself as the best choice with a single, superior offering. For example. while competitors offered multiple firewalls to purchase, Jay Chaudhry’s first company chose just one, branding themselves as the best in deploying it—earning exclusive referrals from Check Point. When Home Depot questioned his $2,000/day rate, citing IBM’s $1000 lower price, Jay reframed the decision: “If you want a heart specialist, you come to us. If you want a generalist, go to IBM.” Full episode: https://lnkd.in/d6f2GyA9

272

5 Comments

🚨 CyberStash Receives Singapore Government Licence to Deliver Managed SOC Monitoring Services Now Actively Recruiting Strategic Partners Across the Region! Sydney, Australia – 26 June 2025 – CyberStash Pty Ltd, a next-generation cyber defence company known for its precision threat detection and 24/7 Managed Detection and Response (MDR) services, is proud to announce that it has been officially granted a Managed Security Operations Centre (SOC) Monitoring Service Licence under the Cybersecurity Act 2018 by the Cybersecurity Authority of Singapore. - Licence No: CS/SOC/C-202506-006 - Authorised Period: 24 June 2025 to 23 June 2027 This regulatory milestone underscores CyberStash’s operational maturity, trustworthiness, and alignment with Singapore’s rigorous cybersecurity standards. It also cements the company’s commitment to expanding its global presence while delivering world-class cyber threat visibility, response, and intelligence to the APAC region. “This licence is a major milestone for CyberStash and a key step in our strategy to expand our global footprint,” said Loris Minassian, Founder & CEO of CyberStash. “Singapore’s commitment to cybersecurity excellence aligns perfectly with our mission, and we’re excited to now serve customers in the region with our Eclipse.XDR™ platform and 24/7 Managed Detection and Response services.” As part of its entry into the Singapore market, CyberStash is prioritising growth through strategic partnerships with MSPs, Telcos, and Systems Integrators. 🌏 Strategic Market Entry: Partner-First Expansion into Singapore CyberStash is actively prioritising its market entrance into Singapore via a partner-first strategy, engaging Managed Service Providers (MSPs), Telcos, Cloud Providers, and Cybersecurity Integrators. With the SOC licence now secured, CyberStash is opening up new revenue and service opportunities for trusted partners who want to offer their clients: 🌐 Eclipse.XDR™ – a multi-tenant, AI-assisted detection and response platform 🕵️ 24/7 Managed SOC-as-a-Service, powered by Australian-based experts 🚀 Fast deployment & turnkey onboarding – typically live in under 24 hours! Whether you're delivering security services today or looking to expand your portfolio, CyberStash provides a ready-to-go platform with deep visibility, active response, and expert support that helps partners win, retain, and scale. 📣 Call to Action: Join the CyberStash Partner Network in Singapore CyberStash is now accepting expressions of interest from qualified partners who want to lead the charge in Singapore’s cyber defence transformation. 🛡️ Become a Certified CyberStash Partner 💼 Offer Next-Gen XDR, MDR & SOC-as-a-Service 📈 Unlock Recurring Revenue & Enterprise Retention 👉 Visit https://lnkd.in/gxhzKT36 to register your interest or book a partner briefing. 🌐 Visit www.cyberstash.com to learn more. #cybersecurity #singapore #technology

159

46 Comments

Your company has 5,000 customers. 5 are mining companies. The intel team says “mining company compromises remain rare.” Intel teams should understand and acknowledge their collection biases and gaps. I see way too many companies who do not have telemetry or incident response cases from OT claim how rare OT incidents are when they should note - it’s rare - in their datasets - which don’t include much OT.

320

35 Comments

This week in Cyber: 26th July -> 1st August Happy August All! 1. CyberArk + Palo Alto Networks = New Microsoft Competitor? PAN is acquiring CyberArk for $25B USD (a 26% premium to its closing price on the 26th July) taking the market and cybersecurity enthusiasts by surprise after earlier week news had been around a SentinelOne acquisition (fake drama to obscure the true intention perhaps?) The CyberArk acquisition will not only be PAN's largest acquisition by more than 20x but also a true reflection of the cybersecurity industry's trend towards an identity-centric security model. PAN's stock has dropped 15% with the recent news representing investors concerns around the acquisition. The question on everyone's lips: Will CyberArk remain a standalone product (4th Pillar for PAN) or will it be integrated into existing capabilities across the Palo Alto offerings. 2. The Vibe-coded "Tea" app which was a woman-only app which allowed women to share reviews and background checks on men has had two subsequent data breaches which have adversely affected the safety of its users. The data breach was first publicised on 4Chan when over 72,000 images and verification photos of users were leaked exposing not just the woman but their government ID's as well. A subsequent second database leak has also exposed over 1M private chats between users about cheating partners, abortions and other personal details which also contain PII. The private messaging function in Tea has been disabled as cybersecurity experts have gotten involved in identifying where and how the unwanted access was created. 3. ShinyHunters extortion group (tracked as UNC6040) have been involved in a wave of high-profile data breaches at Qantas, Allianz Life, LVMH, and Adidas in recent months. All attacks have followed similar playbooks, 1. They will impersonate IT staff in phone calls and trick employees into entering a 'connection code' which will link a malicious version of the Salesforce Data Loader OAuth to the targets Salesforce environment. 2. This access + stolen credentials from phishing websites that impersonate Okta logins would allow the threat actors unfettered access in the Salesforce environment. 3. The data is then stolen and taken out of the environment. Salesforce recommendations to mitigate this risk: Enable MFA, enforcement of least privilege and careful management of connected apps. 4. Just weeks after a sensational headline purchase of Base44 (vibe-coding platform) by Wix, Wiz has found a vulnerability that allows full access without signing up or or a password. Wiz took advantage of a broken authorisation check that allowed anyone access to private apps if they could correctly guess the URL, the URL's were typically quite predictable following a "https://{workspace}.base44.app/{appId}" pattern. Once in, the attackers were able to request information from endpoints which would return sensitive data without authenticating the user asking for the information.

17

Thrilled to have joined James Turner, Pieter Danhieux and Samantha M. on stage this week at the Tech Council of Australia National Tech Summit in Sydney to discuss some of the most pressing challenges and opportunities shaping our industry. Insightful conversation covering: - The evolving role of AI in business and security - Building and scaling a strong security culture within startups - The tipping point where growing companies need a CISO and dedicated security team - How to balance rapid innovation with resilience and trust The AI discussion in particular dovetailed well with Okta's view on securing agentic AI through a unified security fabric — extending protection beyond human users to include non-human identities as they evolve and scale rapidly. By adding visibility, governance and curbing over-provisioned access we're not only reducing attack surfaces and risk, we’re helping organisations innovate faster with AI tools (tune into #Oktane25 next week to hear a tonne more about this). Big thanks to the organisers and my fellow panelists for such a dynamic conversation. The future of technology depends on both innovation and trust — and it’s inspiring to see how our community is working together to achieve both. #Security #Trust #Culture #AI #Identity #Startups #SecurityCulture

125

2 Comments

Active Directory & Entra: Are You Prepared for the Worst? ​A recent incident in Australia highlighted the critical importance of comprehensive data backup strategies. A major financial services provider experienced a significant outage when their cloud account was inadvertently deleted due to a misconfiguration. While the provider had data duplication across two geographies, the deletion affected both locations, underscoring that redundancy within the same cloud service may not suffice. Fortunately, they had backups with an additional service provider, which minimised data loss and facilitated recovery. Recovering an entire Active Directory (AD) forest after a catastrophic event is a complex and time-sensitive challenge. The process involves numerous steps, each prone to human error, and can be daunting for IT teams under pressure. Microsoft's Active Directory Forest Recovery Guide outlines a comprehensive approach, but the manual nature of the tasks can lead to prolonged downtime and increased risk of mistakes. To mitigate these challenges, we strongly urge organisations to consider automating their AD forest recovery processes. Automation can streamline the recovery, reduce the likelihood of errors, and significantly decrease downtime. Implementing such solutions ensures that businesses can restore their critical directory services swiftly and accurately, maintaining operational continuity even in the face of unforeseen disasters. It's essential for organisations to proactively assess their disaster recovery plans and explore available solutions that offer automated recovery capabilities. By doing so, they can enhance their resilience and readiness to handle potential AD disruptions effectively. #CanaryIT #DR #BusinessContinuance #ActiveDirectory #Entra

17

CISA Alert: SharePoint Vulnerability (CVE-2025-53770) Actively Exploited CISA has warned about active attacks targeting a critical Remote Code Execution (RCE) flaw in on-premises Microsoft SharePoint servers. Dubbed “ToolShell,” this exploit gives unauthenticated attackers full control—without needing credentials. The lesson is clear: Attackers aren’t breaking in—they’re logging in. Identity abuse and misconfigurations are the low-hanging fruit. This breach underscores the urgent need for proactive visibility and control over who has access to what, and what's changing across your critical systems. Netwrix Corporation helps you shut those doors before they’re opened, and detect threats in real-time: #IdentityManagement : Enforce least privilege, streamline access reviews, and eliminate over-permissions across your SharePoint and AD environments, denying attackers the "keys under the mat." #ConfigurationManagement: Monitor every change in real-time across SharePoint and other critical systems to detect unauthorized modifications that could be exploited. #ITDR & Behavioral Analytics: Spot identity threats and suspicious user behavior—like Bob suddenly downloading 5GB of files at 2 AM—before they escalate into a full-blown breach. Actionable #AuditTrails: Accelerate investigations with clear, centralized logs that tell you exactly who did what, where, and when. Patches are available, but proactive visibility and continuous monitoring are what truly reduce risk and help you detect threats early. Let’s not wait for the next zero-day. Learn more about strengthening your security posture: https://lnkd.in/d5WpEcPt #SharePoint #CVE202553770 #CISA #Netwrix #Cybersecurity #ZeroDay #ITDR #IAM #VisibilityMatters #IdentitySecurity #SecurityPosture

24

1 Comment

🔥 The Salesforce breach escalated fast: 😮 153GB of Qantas data leaked 😮 64GB from Vietnam Airlines exposed 😮 33 more companies allegedly compromised Threat actors followed through after ransom deadline 🎯 For GRC professionals: This is a masterclass in third-party risk gone wrong. The full ⌚ timeline and analysis breaks down exactly how social engineering bypassed technical controls. 🚨 Read the incident breakdown: https://lnkd.in/gWwZwCFZ Transparency: Simply Cyber may receive a commission if you click. Sharing because this analysis is valuable to practitioners AND supports Simply Cyber.

41

Across ANZ, major enterprises in sectors such as banking, telecommunications, retail, and public services are embracing Google Cloud to propel their digital evolution. One significant hurdle security teams encounter in incident response pertains to ephemeral workloads. Containers, serverless functions, and short-lived instances often disappear before evidence can be captured—leaving major blind spots in investigations. This comprehensive guide delves into: - Why ephemeral workloads complicate response - Key gaps in logging, forensics, and automation - Practical measures to proactively equip for unforeseen incidents With Cado Security (acquired by Darktrace), attaining forensic-level visibility within these transient environments becomes a reality. Explore the Ultimate Guide to Incident Response in Google Cloud Platform (GCP) here

15