Nathan Gardiner

Cyber resilience is an essential requirement for the Operational Technology that underpins Australia’s critical infrastructure. Fortunately, identifying KPIs for OT is simpler than you might think, thanks to the Australian Government’s Security of Critical Infrastructure (SOCI) Act. Looking forward to presenting 'Securing Success: Prioritising OT Security in the Boardroom and Identifying KPIs' | on the 11th of February from 09:40 am - 10:20 am. CS4CA: Cyber Security for Critical Assets #CriticalInfrastructure #OperationalTechnology #IndustrialControlSystems

82

The Australian Signals Directorate 's 𝐀𝐮𝐬𝐭𝐫𝐚𝐥𝐢𝐚𝐧 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐞𝐧𝐭𝐫𝐞 (𝐀𝐒𝐃’𝐬 𝐀𝐂𝐒𝐂) has released it's 6th 𝐀𝐧𝐧𝐮𝐚𝐥 𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐑𝐞𝐩𝐨𝐫𝐭 (𝐀𝐂𝐓𝐑). ASD’s ACSC urges businesses, organisations and network owners to take action by focusing on 4 key areas to bolster their cyber defences and prepare for future challenges: ❇️ 𝑰𝒎𝒑𝒍𝒆𝒎𝒆𝒏𝒕 𝒃𝒆𝒔𝒕-𝒑𝒓𝒂𝒄𝒕𝒊𝒄𝒆 𝒍𝒐𝒈𝒈𝒊𝒏𝒈. ❇️ 𝑹𝒆𝒑𝒍𝒂𝒄𝒆 𝒍𝒆𝒈𝒂𝒄𝒚 𝒕𝒆𝒄𝒉𝒏𝒐𝒍𝒐𝒈𝒚. ❇️ 𝑴𝒂𝒏𝒂𝒈𝒆 𝒕𝒉𝒊𝒓𝒅-𝒑𝒂𝒓𝒕𝒚 𝒓𝒊𝒔𝒌. ❇️ 𝑷𝒓𝒆𝒑𝒂𝒓𝒆 𝒇𝒐𝒓 𝒑𝒐𝒔𝒕-𝒒𝒖𝒂𝒏𝒕𝒖𝒎 𝒄𝒓𝒚𝒑𝒕𝒐𝒈𝒓𝒂𝒑𝒉𝒚. An insightful read, link in comments for additional factsheets.

45

2 Comments

Thrilled to have joined James Turner, Pieter Danhieux and Samantha M. on stage this week at the Tech Council of Australia National Tech Summit in Sydney to discuss some of the most pressing challenges and opportunities shaping our industry. Insightful conversation covering: - The evolving role of AI in business and security - Building and scaling a strong security culture within startups - The tipping point where growing companies need a CISO and dedicated security team - How to balance rapid innovation with resilience and trust The AI discussion in particular dovetailed well with Okta's view on securing agentic AI through a unified security fabric — extending protection beyond human users to include non-human identities as they evolve and scale rapidly. By adding visibility, governance and curbing over-provisioned access we're not only reducing attack surfaces and risk, we’re helping organisations innovate faster with AI tools (tune into #Oktane25 next week to hear a tonne more about this). Big thanks to the organisers and my fellow panelists for such a dynamic conversation. The future of technology depends on both innovation and trust — and it’s inspiring to see how our community is working together to achieve both. #Security #Trust #Culture #AI #Identity #Startups #SecurityCulture

125

2 Comments

Advisory alert re Oracle EBS In the last 24 hours, the Atmos team is starting to see an increase in reports from entities receiving extortion emails from a threat actor claiming to have an affiliation with the CLOP ransomware group. CLOP is notorious for widescale enterprise attacks, including previous major events such as Accellion, GoAnywhere, MOVEit, and Solarwinds. The emails have been sent from hundreds of different compromised email accounts, likely an attempt to bypass mail filters. The contents of the emails, often sent to executives within an organisation, allege that data has been stolen from the Oracle E-Business Suite. Oracle has not confirmed the threat and we understand investigations are underway. We are closely following any Oracle reporting to provide guidance. Alongside our industry partners, we have not yet been able to validate whether the claims made by the threat actor are accurate. Fraudsters have previously been observed impersonating the CLOP. There is every possibility that this is a hoax, although we are treating it as an unvalidated threat at this stage. We are not aware of any validated data exfiltration by entities involved. At this stage, until more is known, we are treating this with caution. Our Atmos Intelligence team is gathering actionable intelligence, and we thank our partners for their support (including the DFIR, intelligence community, and cyber insurers) for doing what they can to identify actionable intelligence to assist during this period of uncertainty. What to do next? For organisations that use the Oracle E-Business Suite, we recommend you immediately check your email filter for any extortion emails that may have been quarantined. While the email addresses of the threat actor vary, you can also search for “pubstorm.com/pubstorm.net” which should pick up the contents of the email from the threat actor (if you have received them). While this may be another impersonation event, we are advising organisations who have received any emails from the threat actor to prepare as if the threat actor’s claims are legitimate and mobilise their response team (including cyber insurance support if available), to be on the ready to respond as more information becomes known. We have stood up a dedicated team, including various DFIR providers, to ensure that there is immediate capacity to respond should things escalate. Richard Berkahn, Anthony Cooke, Stefanie Luhrs, John Moran, Alec Christie, Andrew Brewer, Suzannah Hills, James Blakely

87

4 Comments

🚨 CyberStash Receives Singapore Government Licence to Deliver Managed SOC Monitoring Services Now Actively Recruiting Strategic Partners Across the Region! Sydney, Australia – 26 June 2025 – CyberStash Pty Ltd, a next-generation cyber defence company known for its precision threat detection and 24/7 Managed Detection and Response (MDR) services, is proud to announce that it has been officially granted a Managed Security Operations Centre (SOC) Monitoring Service Licence under the Cybersecurity Act 2018 by the Cybersecurity Authority of Singapore. - Licence No: CS/SOC/C-202506-006 - Authorised Period: 24 June 2025 to 23 June 2027 This regulatory milestone underscores CyberStash’s operational maturity, trustworthiness, and alignment with Singapore’s rigorous cybersecurity standards. It also cements the company’s commitment to expanding its global presence while delivering world-class cyber threat visibility, response, and intelligence to the APAC region. “This licence is a major milestone for CyberStash and a key step in our strategy to expand our global footprint,” said Loris Minassian, Founder & CEO of CyberStash. “Singapore’s commitment to cybersecurity excellence aligns perfectly with our mission, and we’re excited to now serve customers in the region with our Eclipse.XDR™ platform and 24/7 Managed Detection and Response services.” As part of its entry into the Singapore market, CyberStash is prioritising growth through strategic partnerships with MSPs, Telcos, and Systems Integrators. 🌏 Strategic Market Entry: Partner-First Expansion into Singapore CyberStash is actively prioritising its market entrance into Singapore via a partner-first strategy, engaging Managed Service Providers (MSPs), Telcos, Cloud Providers, and Cybersecurity Integrators. With the SOC licence now secured, CyberStash is opening up new revenue and service opportunities for trusted partners who want to offer their clients: 🌐 Eclipse.XDR™ – a multi-tenant, AI-assisted detection and response platform 🕵️ 24/7 Managed SOC-as-a-Service, powered by Australian-based experts 🚀 Fast deployment & turnkey onboarding – typically live in under 24 hours! Whether you're delivering security services today or looking to expand your portfolio, CyberStash provides a ready-to-go platform with deep visibility, active response, and expert support that helps partners win, retain, and scale. 📣 Call to Action: Join the CyberStash Partner Network in Singapore CyberStash is now accepting expressions of interest from qualified partners who want to lead the charge in Singapore’s cyber defence transformation. 🛡️ Become a Certified CyberStash Partner 💼 Offer Next-Gen XDR, MDR & SOC-as-a-Service 📈 Unlock Recurring Revenue & Enterprise Retention 👉 Visit https://lnkd.in/gxhzKT36 to register your interest or book a partner briefing. 🌐 Visit www.cyberstash.com to learn more. #cybersecurity #singapore #technology

159

46 Comments

The Australian Signals Directorate’s ACSC has released guidance on fast-moving, self-propagating attacks targeting open-source and community-maintained code repositories — with “s1ngularity” and “shai-hulud” among the most high-profile. It’s a timely reminder of the growing risks in the software supply chain. Wiz threat research teams have been tracking these closely and recently shared findings on their impact so far. I’ve linked the ACSC advisory below — and if you or your team would like help working through the recommendations (or exploring the research), I’m always happy to chat. https://lnkd.in/gSZXZe-r

35

Active Directory & Entra: Are You Prepared for the Worst? ​A recent incident in Australia highlighted the critical importance of comprehensive data backup strategies. A major financial services provider experienced a significant outage when their cloud account was inadvertently deleted due to a misconfiguration. While the provider had data duplication across two geographies, the deletion affected both locations, underscoring that redundancy within the same cloud service may not suffice. Fortunately, they had backups with an additional service provider, which minimised data loss and facilitated recovery. Recovering an entire Active Directory (AD) forest after a catastrophic event is a complex and time-sensitive challenge. The process involves numerous steps, each prone to human error, and can be daunting for IT teams under pressure. Microsoft's Active Directory Forest Recovery Guide outlines a comprehensive approach, but the manual nature of the tasks can lead to prolonged downtime and increased risk of mistakes. To mitigate these challenges, we strongly urge organisations to consider automating their AD forest recovery processes. Automation can streamline the recovery, reduce the likelihood of errors, and significantly decrease downtime. Implementing such solutions ensures that businesses can restore their critical directory services swiftly and accurately, maintaining operational continuity even in the face of unforeseen disasters. It's essential for organisations to proactively assess their disaster recovery plans and explore available solutions that offer automated recovery capabilities. By doing so, they can enhance their resilience and readiness to handle potential AD disruptions effectively. #CanaryIT #DR #BusinessContinuance #ActiveDirectory #Entra

17