Kiranraj Govindaraj (KG)

My latest article outlines what makes a strong cyber response strategy. It explains why regular reviews are vital to keep it aligned with your company’s changing threat landscape and resilience goals. Find it on page 35 of today’s Australian Financial Review: https://bit.ly/4iRzXGO #Cybersecurity #CyberResilience #ExecutiveLeadership

60

How good! The Australian Signals Directorate has just released its Annual Cyber Threat Report 2024-2025. Just in time for the Australian Information Security Association (AISA) Melbourne CyberCon. Always full of stats, this report is a helpful litmus test of what's happening beneath the cyber hood across the economy: 1️⃣ 84,700 cybercrime reports made to ReportCyber, down 3%. Still, that's one report every 6 minutes, consistent with last year. 2️⃣ Average self-reported cost of cybercrime per report for individuals, up 8% ($33,000). 3️⃣ Average self-reported cost of cybercrime per report for businesses, up 50% overall ($80,850). Small business: $56,600 (up 14%), medium business: $97,200 (up 55%), and large business: $202,700 (up 219%). 4️⃣ Publicly reported common vulnerabilities and exposures increased 28%. 5️⃣ 11% of all incidents responded to included ransomware, consistent with last year. 6️⃣ The ASD responded to more than 200 incidents involving Denial of Service (DoS) or Distributed Denial of Service (DDoS), up more than 280% from last year. 7️⃣ Identity fraud remained the top reported cybercrime, up 8%. Keep an eye out for further discussions this week! https://lnkd.in/gsgVNjri

115

5 Comments

Nearly every organisation has a policy that says multi-factor authentication will be implemented on external connections, which is good practice. However the reality is that organisations are complex and often have more than 100 external connections (both human and system). In many cyber incidents I’ve reviewed for clients, the attackers have found an interface that lacks MFA or has weaknesses. This matters because cyber insurance can decline a claim where an organisation has gaps around the controls that were stated as present when the insurance was priced. It reinforces the importance of assurance measures for management to confirm that the true position matches policy. https://lnkd.in/gjuZSXWk

57

4 Comments

Australia’s updated Privacy Act has raised the bar; K–12 schools are now under more stringent obligations for data retention, breach reporting, and handling of personal information. For Principals, CIOs, CISOs, and School Boards, this is a watershed moment. The solution? A unified, education-ready approach to data protection from Fortinet FortiDLP: Prevents the loss of sensitive data across devices, users, and cloud environments, minimizing reputational and legal risk. FortiDATA: Scans and classifies data at rest, both on-prem and in cloud storage, helping schools understand where their sensitive data lives and how it’s exposed. FortiCASB: Analyses data in SaaS platforms from Microsoft 365 and Google Workspace, Zoom and Zendesk, critical as learning and collaboration increasingly move online. All three integrate with: FortiGate (NGFW), Microsoft Entra ID, and Microsoft Sensitivity Labels to ensure consistent, enforceable policies from endpoint to cloud. Key Board-Level Value Drivers: No consumption-based licensing for OCR or classification allowing predictable budgeting Fast implementation for under-resourced IT teams Supports compliance with Australian Privacy Act, eSafety guidelines, and internal risk frameworks Why Now? The legislation is live. The risk is real. Fortinet delivers operational confidence in the face of new compliance obligations and data threats, without enterprise overhead or complexity. If you sit on a school board or lead ICT strategy, it’s time to reframe cybersecurity as a governance imperative. https://lnkd.in/gX7bsyrC #K12Leadership #Fortinet #DataGovernance #PrivacyAct #CyberRisk #EducationIT #FortiDLP #FortiDATA #FortiCASB #CISO #CIO #SchoolBoard #CyberSafeSchools #IndependentEducation #InformationGovernance

51

1 Comment

🌞 AISA's Cyber Today - Edition 1, 2025 In this edition of Australian Information Security Association (AISA)'s biannual journal: - The Future of the Cyber Security Industry - Australia's Kaspersky Ban: The Unanswered Questions - How to Train Your Cyber Jedi Online version of Cyber Today: https://lnkd.in/gW5vhUET PDF version of Cyber Today (attached) and https://lnkd.in/gAeJGFFS Order hard copy: https://lnkd.in/g7CNwBtx

44

2 Comments

The Australian Signals Directorate’s Australian Cyber Security Centre (#ASD #ACSC) recommends eight essential strategies to mitigate cybersecurity incidents - commonly referred to as the ACSC Essential Eight (#ACSC #E8). ✏️ Privileged Accounts…. One of the ACSC E8 strategies is ‘#restrict #administrative #privileges’ - which organisations often assume applies only to ‘IT admin accounts’ used by people. The ACSC reinforces in the E8 FAQ that “A #privileged user #account may belong to a person or a #service.” 😫 Windows AD Service Accounts…. Those #Windows #Active #Directory Service Accounts that: ⏳over the years have proliferated in IT/OT environments; 🔭 lack visibility, are unknown and undocumented; ✍️ where granted and still have excessive privileges; ⛓️‍💥use weak and/or unknown credentials, which are sometimes also hard coded in systems; ⚠️ aren’t/can’t be changed, disabled, onboarded to a password vault, passwords rotated, etc., without breaking critical business processes are in-scope of the ACSC E8 ‘restrict administrative privileges’ - yet organisations struggle to handle them and to sufficiently reduce the risk of attackers exploiting this blind-spot, gaining unauthorised access to systems and data, and causing business disruptions. If you want to learn more about this problem and how to reduce risk exposure - have a look at this blog article published on the Microsoft site by Silverfort, a Microsoft Security #MISA member -https://lnkd.in/gVmQWmN7 #ServiceAccount #NHI #IdentitySecurityDoneRight Microsoft Alumni Network Microsoft

58

3 Comments