Dinesh Kumar Aggarwal

𝐈𝐒𝐎 27001 𝐜𝐞𝐫𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐢𝐬 𝐧𝐨𝐭 𝐚 𝐦𝐞𝐚𝐬𝐮𝐫𝐞 𝐨𝐟 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲. 🔹 ISO certification indicates an established information security management system, but does not confirm the effectiveness of controls. 🔹 Many organisations mistakenly view certification as a measure of cyber resilience. 🔹 Passing audits can mask significant gaps in security coverage and execution. 🔹 Having controls on paper doesn’t guarantee they function well in practice (e.g., obsolete privileged accounts, unreviewed logs). 🔹 Effective cyber resilience requires a mindset shift: 🔹 Move from proving the existence of controls to validating their effectiveness. 🔹 Transition from compliance-driven to risk-informed decision-making. 🔹 Shift from static documentation to dynamic situational awareness. 🔹 Certification is a step toward resilience, which involves continually assessing how controls perform under pressure Disclaimer: The provided article is intended for educational and knowledge-sharing purposes related to cybersecurity. #ciso #ISO27001 #cybersecurity

278

4 Comments

“Risk appetite isn’t a document. It’s your next breach waiting to happen.” → If you’re not defining risk, trust me, the attackers already are. Let me be direct. I’ve sat in too many boardrooms where the term “risk appetite” gets tossed around like a buzzword. “We’re a low-risk organization.” “We have zero tolerance for cyber incidents.” And then you look at the operations: - No clear decision authority during incidents - Critical systems with no real-time monitoring - MFA bypassed for ‘convenience’ on executive accounts - Third-party vendors onboarded without any security review That’s not zero risk. That’s wishful thinking disguised as strategy. Here’s the harsh reality: Risk appetite isn’t what you write in policy docs. It’s what you tolerate in silence. It’s the decision not to patch legacy systems because downtime is inconvenient. It’s the 15-minute delay to escalate because no one wants to be “the alarmist.” It’s letting finance push back on a budget increase while your detection controls are two years outdated. And when the breach happens? It’s no longer a theoretical discussion. The attacker defines your risk tolerance for you. They tell you exactly what you were willing to lose. 🧠 If you haven’t asked these questions, you’re already exposed: What are we willing to shut down to contain a breach? At what financial loss do we escalate to the board? Who owns the final call when time runs out and data is on the move? Have we ever practiced making that decision under pressure? If your team hesitates to answer, that’s the real risk. ✅ What real leadership looks like: Put a number on it. If you can’t quantify acceptable loss, you’re gambling. Give authority, not just accountability. Your CISO can’t protect the business if they can’t make hard calls when it matters. Simulate the hard conversations now. If you wait until a breach to figure out your tolerance, you’re already behind. 🎯 Final thought: In this industry, hesitation has a cost. And if leadership won’t define risk appetite, Attackers are more than happy to define it for you. At Microminder Cyber Security, we help leadership teams confront these tough conversations before chaos does. Because clarity under pressure isn’t optional. It’s survival. 📩 DM me if your “risk tolerance” only exists on PowerPoint slides. Let’s turn it into something actionable. 👇 What’s the hardest business decision your team has ever rehearsed under real pressure? #Day18 #CyberSecurity #RiskLeadership #CISO #CyberResilience #Microminder #BoardAlignment #OperationalRisk #SecurityLeadership #RiskAppetite

256

17 Comments

The Australian Cyber Security Centre (ACSC), via the Australian Signals Directorate (ASD), has published updated guidance titled “Planning for Post-Quantum Cryptography.” It’s encouraging to see more national security agencies raising awareness and urging organizations to start preparing now. They correctly note that deploying protections against a CRQC may take longer than expected and highlight the risk of "harvest now, decrypt later" - which are all the right reasons to start now, but without panicking. While the ACSC’s push to "start planning for PQC right away" is wise, their recommended timeline (seen in the diagram below) raises some concerns. The guidance mentions, for example, that enterprises should have begun implementing PQC by the end of 2028 and should have completed the transition across the organization by the end of 2030. In other words, the ASD envisions that once an enterprise kicks off its migration (by 2028), it can fully replace or upgrade its cryptography within about two years. For most large enterprises, however, a two-year window to entirely swap out entrenched cryptographic systems is overly optimistic. Migrating to PQC is a massive, multi-year undertaking for a typical large organization. Roadmaps and guidelines from other bodies - such as the Post-Quantum Cryptography Coalition (which includes MITRE, Microsoft, and IBM), Moody’s, U.S. officials, and other security agencies - have estimated much longer timelines that dwarf the ACSC’s suggestion. I just posted on my blog a detailed quantum readiness program plan showing in detail why it’s a 10-year effort (if not more): https://lnkd.in/gds9FTFD. To be fair, the ACSC guidance’s intent is likely to set a bold but clear goal to galvanize action, rather than a hard-and-fast rule. However, when a super-busy CISO sees the diagram below, the risk is that they will only read that they have until 2028 to start and that it can be done in two years, and then put it in the back of their minds. In summary, Australia’s ACSC deserves credit for elevating post-quantum cryptography on the national agenda and providing practical guidance to get started. Their message aligns with global expert opinion: don’t wait for the quantum threat to become imminent; begin your preparations now. At the same time, it’s important to approach the timeline with realism. (Also, why is the risk exposure for "harvest now, decrypt later" data starting only mid 2027 in the diagram?!?) The gudiance: https://lnkd.in/gWCpZasV #PQC #QuantumReadiness #QuantumSecurity #QuantumResilience #QuantumResistance

194

10 Comments

CyberArk just crushed their Q1'25 report on every metric and amped up the message on their identity platform story. This call had a different tone. It was confident and assertive in a way we haven't seen from this new management team yet. Good for them — the results they've been putting up and the strategic moves they've been making have put them in a position where they have every reason to feel confident. Lots to talk about here: → The cross-selling machine with access management, machine identity, IGA, and more is working. Nine of the top 10 deals from the quarter were multi-solution. About half of all new customers (~200) in the quarter purchased two or more solutions. In other words, CyberArk is not just selling PAM — it's PAM plus something (or many things). They even managed to sell a six-figure Zilla deal (IGA product acquired last quarter) to a financial services company already. The CyberArk brand de-risked the purchase. This is exactly what CyberArk has done successfully multiple times: build or buy a solid but reasonably priced asset, then leverage the brand/trust/credibility of CyberArk to grow it. On the M&A side, it worked with both Conjur (secrets) and Idaptive (access mgm't). Zilla is the next attempt. (Note: Venafi was a pretty big business with its own brand/reputation already, so I wouldn't count it in this example. They will probably still see some uplift, though.) → A relatively obscure certificate lifecycle change might end up being a huge tailwind for machine identity (Venafi). The CA/B forum just voted to shorten cert expiration to 47 days (vs. the 398 it is today). Probably doesn't sound like a big deal unless you understand how gnarly (and operationally risky) it is to manage certs in an enterprise. CA/B's current plan is to tighten the screws in phases, so the 47 day thing won't hit until 2029. Even the first phase (200 days) in 2026 basically makes manual renewals unmanageable, though. TL;DR - huge boost for Venafi. → It's really difficult to compete in enterprise without a broad workforce identity platform. CyberArk's message to earlier stage identity competitors was loud and clear: large customers want broad identity platforms, not scattered tools that solve narrow use cases. It's harder than ever to compete in the workforce identity market — mostly because larger scale identity companies are doing a good job with building platforms (or at least coherent product suites). --- It sure seems like the days of CyberArk being a relatively quiet, understated, meat-and-potatoes type of company are over. They are turning the page and evolving into a cybersecurity industry leader who consistently puts up growth at scale and pushes the limits of the identity market. Lots of work to do still on bringing the new pieces of their stack together, but you can't argue with the results here.

256

9 Comments

💭 SOC platforms are evolving. 💡 What if triaging didn’t just follow rules — what if it became a cognitive process? 💡 What if alerts could explain themselves, and the system could recommend what the risk looks like? Having an L3 analyst on standby 24/7 may not be as expensive as we once thought. 💡 What if repetitive graph-based investigations were handled by specialized agents, while humans stay in the loop for critical decisions? 💡 What if platforms priced based on outcomes, not data volume? The #AutonomousSOC wave is here — and it’s coming faster than we think. Exciting times ahead! 🚀 #platformization #CyberSecurity #SOC #AI #Innovation #AgenticAI #SIEM #XDR Disclaimer: This post reflects general industry trends and ideas, and is not related to any future roadmap or capabilities of my current employer.

34

2 Comments

🚨 How Ready Is Your Organization for a Cyber Incident? 🚨 The Australian Cyber Security Centre (ACSC) has created a Cyber Incident Response Readiness Checklist to help organizations evaluate their preparedness for cyber incidents. This resource is a must-have for IT professionals and organizations aiming to boost their resilience in today’s evolving threat landscape. 🌐 📋 What’s Inside? Guidance on developing and testing a Cyber Incident Response Plan. Practical tips for building an effective Cyber Incident Response Team (CIRT). Recommendations for log retention and incident detection mechanisms. Essential communication strategies to engage internal and external stakeholders. Steps for post-incident reviews to continuously improve defenses. 🔒 Whether you’re a small business or part of a larger enterprise, this checklist provides actionable insights to fortify your cybersecurity posture. 💡 Why Read It? Cyber incidents aren’t a question of if but when. This guide ensures your organization has the right processes, tools, and people in place to respond effectively when threats arise. 📥 Download the document below and take your first step toward a safer digital environment! #CyberSecurity #IncidentResponse #Resilience #RiskManagement #ITLeadership #CyberAwareness

62

3 Comments

There are never enough columns and inches to describe the range of controls required to mitigate credential stuffing attacks. As I told the AFR, enrolling users in MFA is the most essential step, but it’s not the only one. https://lnkd.in/guz3De3j Super funds should also: - Enable bot detection. These machine learning algorithms present a CAPTCHA challenge when they detect a request is likely to be a bot (not a human). - Detect and block the use of known breached passwords. These features compare sign-ups or log-ins against lists of billions of known breached usernames and passwords. Organizations can create policies that prevent a user from registering an account using one of these passwords, or to require existing users to reset their password. There’s another half-dozen controls Auth0 and Okta can enable to limit the impact of attacks like these. I’ll link some additional resources in the comments below.

79

7 Comments

Effective SOC Detection Practices! A list of best practices for building and improving the detection capabilities of a Security Operations Centre (SOC) by the UK’s National Cyber Security Centre (NCSC). It focuses on helping organizations understand regular activity (baseline comparison), centralizing their log data for better visibility (single pane of glass), and designing meaningful and easy alerts for analysts to triage. It also covers reducing false positives, maintaining and reviewing detection rules over time (use-case lifecycle), and testing them using simulated attacks like red or purple team exercises. • Baseline comparison • Single pane of glass • Triage as an objective • False positives • Use-case lifecycle • Testing use-cases Source: https://lnkd.in/gQ5agZkV To stop advanced threats effectively, we must move beyond basic alerts and implement advanced data analysis techniques, including behavioral analytics, anomaly detection, and correlation across multiple data sources. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

212

9 Comments

Not all forms of MFA are equally secure. In this Root Causes Podcast episode Jason Soroko and I describe the differences between the more secure and less secure forms of MFA. Audio: https://lnkd.in/g_Ar-hyx Video: https://lnkd.in/gKJRZiQ6

27

1 Comment

Severity 8.8/10 vulnerability in Windows 11, 10 and Windows Server (all versions): A remote attacker can exploit this vulnerability by tricking a user into clicking a specially crafted WebDAV URL, potentially leading to arbitrary code execution. Patch just released yesterday. See below link for further details: https://lnkd.in/gJ38RfcF

21

**People used to ask me: “What logs should we prioritize for SIEM ingestion?”** Here’s what the experts say (via Australian Signals Directorate & global cyber agencies): 1️⃣ **EDR Logs**: Process creation, network connections, file executions, registry changes. 2️⃣ **Network Devices**: Firewall denies, NetFlow, IDPS alerts, VPN/auth events. 3️⃣ **Domain Controllers**: Kerberos (4768/69), account changes (4724), DCSync (4928/29). 4️⃣ **Cloud (AWS/Azure/GCP)**: Admin changes, breakglass access, sign-ins, API calls. 5️⃣ **Windows Endpoints**: PowerShell (4103/04), logon events (4624/25), process tracking (4688). **Key principles**: - Start small, then expand. - Match logs to YOUR risk profile—no one-size-fits-all. - Never use SIEM as a central dump—only ingest security-critical logs. #SIEM #CyberSecurity #ThreatDetection #EDR #CloudSecurity

23

2 Comments

If you're truly committed to building a career in OT penetration testing or OT red teaming, particularly in a consulting role—understand this that exploiting PLCs or running Nmap scans is just the beginning. The real value lies in your ability to understand the sector you’re operating in, whether it’s power, transportation, rail, telecom or manufacturing. It’s not just about gaining access to systems, it’s about recognizing what those systems do, how they fit into the operational process, and the consequences of interacting with them. Once inside an OT environment, you’ll face technologies that don’t exist in traditional IT such as protection relays, interlockings, SCADA-connected IEDs, signal controllers. These aren’t just endpoints, they’re critical process enablers. If you don’t know what you’re interacting with, you’re not testing securely. Its like you’re gambling. Trust me the real thrill in OT security doesn’t come from just landing a root shell on a PLC or cracking into an embedded device. That’s fleeting. The real excitement begins when you truly understand how the process works behind it all. It’s when you realize how one telecom operator’s infrastructure in one country operates entirely differently from another. It’s when you can board a train and confidently say you understand how every onboard system functions — from signaling to safety. That’s when it clicks. That’s when the work becomes more than testing — it becomes a journey through the technology that quietly runs the world. And that’s where the fun really begins. Master the process. Understand the environment. Respect the function of every device. That’s what separates a tool runner from a trusted OT security professional. Someone who delivers not just access, but insight, accountability, and value. If your goal is to remotely move a train, it’s going to take more than just finding open ports and launching exploits, it requires deep sector knowledge. You need to understand how the entire system works, not just how to access it. #OperationalTechnology #IndustrialControlSystems #OTSecurity #PenetrationTesting

452

33 Comments

Thursday afternoon (July 3rd) around 12:30pm the June 2025 Australian Information Security Manual (ISM) finally dropped, and I can see why it took them some time. A whopping 62 new controls were added, and several oldies that had been removed were reintroduced. Others were rephrased for clarity, without changing meaning or scope. The Cybersecurity Principes were updated, which is good. Not entirely new as it's in legislation, the board of an organisation is responsible, and thus must have/get sufficient cyber security knowledge around the boardroom table to judge what's going on and to guide the direction. The board cannot complete off-load that responsibility. So boards should get technical people as well. Excellent. Most of the new controls are about development process, particularly regarding secure by design and secure by default. I've been talking about that for a while now, so it's very satisfying to see it enforced. Organisations advised by me will already have implemented the best practices required so they're already better prepared for this version of the ISM (as well as being more secure and having produced more secure output). Good development practices such as static and dynamic code analysis, and integration of these tools into their pipelines; still not used in many orgs, otherwise we wouldn't see so many vulnerabilities from their products! Developers must be trained to have that knowledge and skill as well as general cyber security, and an organisation must maintain a register of that training and the relevant competence of staff. Need to have access and principles of least access have been strengthened. Just giving someone all privileged access because they need something or they're the CEO (think Medibank) is not acceptable. Tighter control over remote access by service providers. Oh I could tell you stories... Increased and ongoing scrutiny required over supply chain (hardware, software, and services). Optus and Qantas were both breached via outsourced service providers, although various other factors were also involved. As we always explain it, organisations often "transfer risk" but it's important to understand that they can't transfer away responsibility and liability. And no, Cyber insurance won't cover these cases any more, they expect an org to have done their basic homework. Usually the questions from an insurer are based on ISO 27001, which covers this well. Default accounts and passwords, are dealt with on first install or setup. Expect an outright ban of default admin/admin type access and insecure factory configs in future (take note, makers of routers and switches, including most big brands!) And then a control that, in my opinion, is directly aimed at Microsoft: Application backwards compatibility does not compromise any security measures or features. [ISM-2045] Brilliant! Verdict: worthwhile. https://lnkd.in/g3ukkUMk

22

1 Comment