Hasan Jahangir

📋 Cyber Security Priorities for Boards 2025–26 The Australian Signals Directorate (ASD) and the Australian Institute of Company Directors (AICD) have collaborated on cyber security governance guidance tailored to the current cyber threat environment. This publication assists a board to ask informed questions of management about how the organisation is addressing key cyber controls, given current and emerging threats. The four priority areas, informed by ASD intelligence, are: 👉 event logging and threat detection 👉 management of legacy IT assets 👉 cyber supply chain controls 👉 preparation for a post quantum cryptography environment Read on below. #CISO #cyber #AICD

273

10 Comments

🔐 Strengthen your cyber defences – Upskill your ICT team in the Essential Eight! Developed by the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) and delivered by TasTAFE, the Essential Eight Assessment Course is tailored for experienced ICT and cyber security professionals. Investing in this training will equip your organisation to: ✔ proactively manage cyber risk ✔ meet compliance requirements ✔ reduce reliance on external consultants This course helps ICT professionals: • understand the intent and application of ACSC’s Essential Eight mitigation strategies • learn to use ACSC designed assessment tools • accurately test the implementation of security controls • develop clear, actionable reports with improvement plans 🗓️ Upcoming course: 8 August 2025 - TasTAFE Campbell Street Campus. 👉 Find out more and apply: https://bit.ly/NONC0276A #cybersecurity #essential8 #tasmania

36

1 Comment

There is a shift in SIEM preference happening in Australia. When I’ve spoken with those in the SOC which SIEM has the best functionality and platform, I get told they’re all pretty similar. Once you know one, you can pick up another vendor’s model fairly quickly, though Splunk’s SPL and Sentinel’s KQL take some getting used to. In 2024, Cisco bought Splunk. Since then, a number of Aussie organisations have been switching to Sentinel. I get it, it’s a part of a broader global move toward cloud native solutions like Microsoft Sentinel. Why? If you’ve got a Microsoft 365 E5 license, you can access Sentinel as part of the Microsoft security stack. Makes sense, a cheaper and streamlined approach keeping it all with one vendor. I wonder though… Is there a hidden risk on being fully reliant on one vendor, are organisations missing out on any benefits of Splunk for SIEM once they swap, or are they making the right call?

139

70 Comments

Yesterday on WIN News I spoke about the ASD ACSC's Annual Cyber Threat Report 2024-2025, which highlights the growing cost and complexity of cybercrime in Australia — and why education, training, and collaboration are key to building national resilience. 💡 Key insights: • Average self-reported cost of cybercrime per report for businesses, up 50% overall ($80,850) • Average self-reported cost of cybercrime per report for individuals, up 8% ($33,000) • Cyber threats are more frequent, sophisticated, and AI-driven The message is clear — cyber security is everyone’s responsibility. 👉 Read the full report: Annual Cyber Threat Report 2024-2025 https://lnkd.in/gnW3a9qD University of Canberra|UC Faculty of Science and Technology #CyberSecurity #ASD #CyberThreatReport #DigitalResilience #WINNews #CyberAwareness

154

17 Comments

Quick Summary of the Cyber Market in Australia (data from Dec 2025) Total job volume fell –15.6% YoY. GRC was the only major domain with YoY growth but still didn't take the #1 spot. It feels that Companies are hiring just enough GRC to stay out of trouble, not to mature risk practices Graduate roles (This is probably the most uncomfortable insight) Graduate roles: <1% of the market December grad roles: 0.3% Down 40% YoY The industry talks about talent shortages, but behaves like it has zero tolerance for training cost? Security Engineering is still the clear priority (now ~30% of the market once normalised). SecOps and GRC follow closely behind. Together, these three make up nearly three quarters of all cyber hiring. That tells me budgets didn’t disappear they were protected for people who build, defend, and keep organisations compliant. Strategy heavy and “nice to have” roles? Much harder to justify. By Region: YoY Market Share Movement New South Wales (NSW) Market share: 34.2% Previous: 38.0% YoY change: –3.8 percentage points Victoria Market share: 28.1% Previous: 22.5% YoY change: +5.6 percentage points Australian Capital Territory (ACT) Market share: 14.5% Previous: 14.5% YoY change: 0.0 percentage points Queensland Market share: 12.2% Previous: 14.4% YoY change: –2.2 percentage points Western Australia (WA) Market share: 6.1% Previous: 3.9% YoY change: +2.2 percentage points

56

7 Comments

🔐 Ransomware Threatens Australian SMEs and Critical Infrastructure Ransomware attacks are increasingly targeting Australian small and medium-sized enterprises (SMEs) and critical infrastructure sectors. Recent data indicates that 69% of Australian businesses have experienced a ransomware attack in the past five years, with 84% opting to pay the ransom. The average ransom paid by SMEs is estimated at AUD 54,000, though payments may void some cyber-insurance clauses. Critical infrastructure sectors are also under heightened threat, prompting the Australian government to introduce mandatory ransomware payment reporting. Entities with an annual turnover exceeding AUD 3 million or those responsible for critical infrastructure assets must report any ransomware payments within 72 hours. The evolving nature of ransomware attacks underscores the need for continuous vigilance and adaptation to emerging threats. #CyberSecurity #Ransomware #SMEs #CriticalInfrastructure #Australia

7

Broken API authorization is still exposing sensitive data - so Intruder built a FREE tool to find it.⚡ Three years after the Optus breach - where millions of customer records were stolen via an unauthenticated API - Intruder’s security team is still finding the same flaws, even in S&P 500 companies. These vulnerabilities are so easy to exploit you could teach someone with no technical background to do it in a day. 🤯 That’s why Intruder built Autoswagger - a FREE, open‑source tool that finds unauthenticated API endpoints leaking sensitive data like credentials or PII. Get Autoswagger FREE on GitHub and see the real vulnerabilities Intruder’s security team uncovered when they put it to the test. Get Autoswagger: https://lnkd.in/e8cA3Ktr 🔥 Read the research ->> https://lnkd.in/eKZz_ybJ

150

6 Comments

𝗔𝘂𝘀𝘁𝗿𝗮𝗹𝗶𝗮’𝘀 𝗰𝘆𝗯𝗲𝗿 𝘄𝗼𝗿𝗸𝗳𝗼𝗿𝗰𝗲 𝗶𝗺𝗯𝗮𝗹𝗮𝗻𝗰𝗲 𝗶𝘀 𝗴𝗲𝘁𝘁𝗶𝗻𝗴 𝘁𝗼𝘂𝗴𝗵 𝘁𝗼 𝗶𝗴𝗻𝗼𝗿𝗲. I’m finalising a report on Australia’s SOC workforce (releasing soon), and one thing stood out: as an industry, we’re 𝘷𝘦𝘳𝘺 top-heavy... 📊 4.4% of the SOC workforce have 1–2 years’ career experience 📊 0.6% have less than 1 year 📊 54% have 10+ years That’s not a shortage, that’s an imbalance. Junior intake is low. Knowledge is concentrated. When people leave, capability leaves too. And SOC is just one snapshot. Similar patterns exist in other cyber job families. I get it. Budgets are tight. Most cyber leaders I speak with are being asked to do more with less. Hiring one proven senior analyst at $150k can feel more bang for your buck than bringing on two juniors at $80k a pop, each of whom will need time, training, and mentoring. 𝗕𝘂𝘁 𝘁𝗼𝗱𝗮𝘆’𝘀 𝗲𝗻𝘁𝗿𝘆-𝗹𝗲𝘃𝗲𝗹 𝗮𝗻𝗮𝗹𝘆𝘀𝘁𝘀, 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝘀, 𝗮𝗻𝗱 𝗰𝗼𝗻𝘀𝘂𝗹𝘁𝗮𝗻𝘁𝘀 𝗮𝗿𝗲 𝘁𝗼𝗺𝗼𝗿𝗿𝗼𝘄’𝘀 𝗵𝗲𝗮𝗱𝘀 𝗼𝗳, 𝗹𝗲𝗮𝗱𝘀, 𝗮𝗻𝗱 𝗖𝗜𝗦𝗢𝘀. 𝗪𝗲 𝗷𝘂𝘀𝘁 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗴𝗶𝘃𝗲 𝘁𝗵𝗲𝗺 𝗮 𝘀𝘁𝗮𝗿𝘁. Credit where it’s due, there 𝘢𝘳𝘦 companies out there actively keeping the talent pipeline moving. I hate the term, but you know what I mean. Hats off to them. Sure, AI 𝘸𝘪𝘭𝘭 help with some of the workload, but it’s not a cure-all. It can’t replace lived experience, in the trenches, with a mentor who cares. If we want a resilient industry tomorrow, we need to start building it today. 💡 𝗛𝗼𝘄 𝗱𝗼 𝘄𝗲 𝗳𝗶𝘅 𝘁𝗵𝗶𝘀? 𝗖𝗮𝗻 𝘄𝗲? 𝗪𝗶𝗹𝗹 𝘄𝗲? 𝗗𝗼𝗲𝘀 𝗶𝘁 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗯𝗲 𝗳𝗶𝘅𝗲𝗱? #cybersecurity #hiring #infosec #cyberrecruitment

71

20 Comments

The Australian Signals Directorate’s Australian Cyber Security Centre (#ASD #ACSC) recommends eight essential strategies to mitigate cybersecurity incidents - commonly referred to as the ACSC Essential Eight (#ACSC #E8). ✏️ Privileged Accounts…. One of the ACSC E8 strategies is ‘#restrict #administrative #privileges’ - which organisations often assume applies only to ‘IT admin accounts’ used by people. The ACSC reinforces in the E8 FAQ that “A #privileged user #account may belong to a person or a #service.” 😫 Windows AD Service Accounts…. Those #Windows #Active #Directory Service Accounts that: ⏳over the years have proliferated in IT/OT environments; 🔭 lack visibility, are unknown and undocumented; ✍️ where granted and still have excessive privileges; ⛓️‍💥use weak and/or unknown credentials, which are sometimes also hard coded in systems; ⚠️ aren’t/can’t be changed, disabled, onboarded to a password vault, passwords rotated, etc., without breaking critical business processes are in-scope of the ACSC E8 ‘restrict administrative privileges’ - yet organisations struggle to handle them and to sufficiently reduce the risk of attackers exploiting this blind-spot, gaining unauthorised access to systems and data, and causing business disruptions. If you want to learn more about this problem and how to reduce risk exposure - have a look at this blog article published on the Microsoft site by Silverfort, a Microsoft Security #MISA member -https://lnkd.in/gVmQWmN7 #ServiceAccount #NHI #IdentitySecurityDoneRight Microsoft Alumni Network Microsoft

58

3 Comments

Hi Folks, check out this excellent guide from the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate: Artificial Intelligence for Small Business - Managing Cyber Security Risks (published 14th Jan 26). It offers practical guidance for small businesses adopting AI tools like ChatGPT, Google Gemini, Claude, and Microsoft Copilot. These cloud-based solutions can boost efficiency through task automation, data insights, and better customer experiences, but they also bring specific cyber risks that need careful management. Developed in collaboration with New Zealand's National Cyber Security Centre (NCSC-NZ) and the Council of Small Business Organisations Australia (COSBOA), the guide focuses on AI-specific threats (beyond everyday issues like phishing or ransomware). Key risks covered: - Data leaks and privacy breaches (e.g., accidental uploads of sensitive customer or staff info, or data being used to train AI models) - Reliability and manipulation of AI outputs (e.g., prompt injection attacks or hallucinations leading to inaccurate results) - Supply chain vulnerabilities (e.g., weaknesses in third-party SaaS providers) It includes real-world examples, risk management tips, a secure deployment example for customer-facing AI chatbots, and a handy AI cyber security checklist for small businesses. Additional helpful resources mentioned: ACSC Small Business Hub (cyber.gov.au) COSBOA’s Cyber Wardens program (cyberwardens.com.au) NCSC-NZ’s Own Your Online (ownyouronline.govt.nz) Great advise for small businesses using AI (or thinking about it). Please re-post   #CyberSecurity #repost #AI #AIMaturity #AIGovernance #AIRisk #PCICompliance #DigitalTransformation #PCIDSS #Cybersecurity #InfoSec #Informationsecruity #NIST #SANS #ISO #ISOStandards #Cyberrisk #Cybersec #Privacy #DigitalResilience #riskintelligence #governance #crisismanagement #riskmanagement #riskassessment #enterprisesecurity #cybersecurity #informationsecurity #digitalsecurity #securityoperations #dataprotection #cybersecuritynews #infosecurity #Securityarchitecture #TechLeadership #PECB #AINZ #AIAUS #AIFourms #Frameworks #AustralianAI #OWASP #repost #NCSC

70

Australia is fortunate to have a thriving #cybersecurity community. From the Australian Information Security Association (AISA), ACS (Australian Computer Society), ISC2 Chapters, ISACA Chapters, AWSN - Australian Women in Security Network, Day Of The Month (DOTM) Club and many other passionate groups, there’s no shortage of people dedicated to making our digital world safer. But with that passion has come fragmentation. Too often, our collective efforts are siloed. Duplicate events, overlapping initiatives, and at times, competing priorities. This can create confusion for practitioners, dilute our impact, and ultimately leave gaps and differences for adversaries, both criminal as well as self-serving in the industry, to exploit. During my time as Director of Cybersecurity Advocacy at ISC2 and on the Board of Directors at Australian Information Security Association (AISA), I made it a personal mission to try to bring these groups together, encouraging collaboration and alignment. My vision was for each organisation to play to its strengths ... whether that was technical skills development, policy influence, professionalisation of the sector, or community outreach, so that, collectively, we could deliver something far greater than the sum of our parts. Cybercriminals don’t compete with one another. They collaborate. They share ideas. And they are winning. If we are to meet the scale and sophistication of the threats we face, we must do the same. Imagine what we could achieve with shared strategy, pooled resources, and a unified voice advocating for Australia’s cybersecurity future. The talent, energy, and willpower are there. It should be about bringing it all together. While working and industry cyber practitioners splinter into their own little tribes and clubs, the #technology companies have unified under lobby groups such as the Tech Council of Australia - and tech policy in this country is now poorer as a result. It is my view that it is past due to unify our ecosystem. Collaboration isn’t just nice to have. It’s absolutely essential for building a resilient, secure digital Australia. How can we unify the disparate #IT and #Cybersecurity practitioner groups together under a common mission and vision?

76

17 Comments