David Boda

The third guide in OSINT Combine’s Best Practice in OSINT: Building Enduring OSINT Capability series, is out, and this one is all about security and resilience. Our latest guide tackles one of the biggest challenges for #OSINT teams today: how to stay safe, secure and sustainable while working in exposed, high-pressure environments. Inside Guide 3: 🔑 How to calibrate operational security (#OPSEC) so it protects without slowing you down 🔑 Practical ways to reduce digital footprint and manage attribution risks 🔑 Strategies for building team resilience to avoid burnout and sustain performance 🔑 A bonus OSINT Team Culture Canvas – perfect for onboarding, retrospectives or offsites Building enduring OSINT capability is as much about protecting the people doing the work, as it is about responsible tradecraft, tools and leadership. 📥 Download the full guide here: https://lnkd.in/ebFKTpnc 📅 And don’t forget: this series is dropping in the lead-up to Australian OSINT Symposium 2025, 18-19 September, where we’ll go even deeper on the theme of Building Enduring OSINT Capability: Virtual tickets still available! osintsymposium.com. #OpenSourceIntelligence #OSINTtips #BuildingEnduringOSINTCapability #OSINTBestPractice #AOS2025 #AustralianOSINTSymposium2025 #IntelLeadership

31

🚨 SOC Analyst: Step beyond Triage Endless alerts. Surface triage. No time for real investigations. But you're ready for more. The Advanced Endpoint Investigations Path helps you: 🔍 Investigate, not just respond 🧠 Analyse real attacker behaviour 🧰 Master Windows, Linux, macOS, memory, disk image, mobile and file system Most analysts stop at triage. You won’t. It’s time to shift from responder -> investigator! 👉 Swipe to change the way you work. For good. 🔗 Start Advanced Endpoint Investigations today! https://lnkd.in/df_TKxKW

283

5 Comments

The UK Government has released guidance for a voluntary Software Security Code of Practice, with plans for offering a certification based on compliance. There are four themes: Secure design and development, Build environment security, Secure deployment and maintenance, and Communication with customers. The guidance consists of fourteen principles which are reasonable for vendors of all shapes and sizes to satisfy (at least to some degree). I typically dislike these generic guidance documents stating things like "Distribute software securely to customers," but not everyone is fortunate enough to have a team of internal security professionals. If it's any signal for software supply chain security, to see even the most fundamental guidance include software composition analysis and maintenance of third-party components is a huge win!

24

We’ve been unpacking through sequel posts, the integration of ISO 31050 managing emerging risks guide within existing security risk management frameworks. This post proceeds to explore the continuous monitoring and review phase which is about moving from awareness to action through a living risk-intelligence cycle. Emerging risks don’t fail because they’re invisible, they fail because signals aren’t acted on. It’s through effective continuous monitoring and review that risk management acts as an operational muscle memory. Key action plans under this phase include: 1. Ensure the risk-intelligence cycle is effectively designed – This entails documenting the cycle in plain language. Assigning owners to each stage and defining them so signals don’t stall. 2. Translate emerging risks into early warning indicators (EWIs) - This entails defining priority emerging risks through leading indicators. Use both quantitative and qualitative EWIs. And stress-test EWIs. 3. Automate where possible and humanizing where necessary – This entails leveraging faster detection without blind reliance on tools. This is because while speed matters, context matters more. Automate data feeds where feasible, visualize EWIs in a single dashboard aligned to decision maker’s needs. Also pair automation with expert interpretation to avoid false confidence. 4. Define escalation rules – When the signal hits, there should be no debate about who should act. Clarity beats urgency in a crisis. Pre-define escalation path to include who gets notified, at what threshold and within what time-frame. Align escalation levels to decision authority. Also test escalation rules using scenario exercises. 5. Build a cadence for emerging risk review – This ensures risks stay current and are reviewed as they evolve. Hold monthly operational reviews to monitor changes in EWIs, detect new signals and defer triggered actions. Hold quarterly strategic review to re-characterize priority emerging risk. Assess systemic patterns and challenge assumptions and blind spots. 6. Close the loop through learning - The cycle only matures if learning feeds back in. Each cycle strengthens the next. After each escalation or near-miss, ask what signal did we miss or misread? were thresholds right? did escalation lead to timely action? Update EWIs, thresholds and assumptions based on lessons learned. Share insights across functions to prevent siloed learning. Emerging risks monitoring is not passive observation, its active preparedness. This turns emerging risk management from a periodic exercise into a continuous capability. Credits : ISO 31050 #securityriskmanagement #managingemergingrisks #continuoslearning #securityprofessionals

22

1 Comment

Do your Incident Response team a favour: If you are using the Defender Portal and sending screenshots, please set your timezone within your account to UTC. The following (redacted) image was sent to me yesterday by a client. I had access to the client's DFE portal; however, we were in different time zones. I had to search for the Event text, comparing the seconds of the alerts in my view with the screenshot, because I was not sure in which time zone the screenshot was taken. The whole process was slowed down. Especially for international organisations, please use UTC.

249

21 Comments

New UK Government Cyber Security Policy Alert The Government Security Group has released updated guidance: Government Cyber Security Policy: Cyber Incident Exercising This policy offers clearer direction on cyber incident exercising for: ✅ Lead Government Departments (LGDs) ✅ Arm’s Length Bodies (ALBs) ✅ Other public sector organisations within their remit If your organisation falls under this guidance, now’s the time to strengthen your readiness. The UK's National Cyber Security Centre Cyber Incident Exercise (CIE) Assured Service Providers are considered capable of providing high quality cyber incident exercising services to a defined standard. These Assured Services Providers deliver controlled, scenario-based exercises for organisations to practise, evaluate and improve their cyber incident response plans in a safe environment. 🔍 Find a CIE Assured Provider here: https://lnkd.in/dpeThdbQ) 📄 Read the full policy: https://lnkd.in/dNi5W8ff #CyberSecurity #IncidentResponse #NCSC #PublicSector #GovernmentSecurity #CIE #Resilience #CyberResilience #UKGov

10

Progress isn't always linear, but your offensive security strategy should be. Our 7th annual State of Pentesting Report uncovers why critical vulnerabilities are slipping through the cracks—especially with new #genAI risks emerging. Build your action plan. Learn why knowledge from expert-led pentesting is power. Download the report and transform assumptions into actionable clarity. 🔗: https://hubs.la/Q03vrqqM0

18

The Cyber Security and Resilience Bill was introduced on 12 November 2025, with the aim of improving the UK's defences against cyber attacks.   With the ICO functioning as the central regulator, their points of contact at organisations, typically Data Protection Officers, will need to prepare to adapt their role around the new Bill. Read our full analysis here > https://bit.ly/4qGxhzX #DataPrivacy #CyberSecurity #PositiveInnovation #Resilience #Government Camilla Winlo | Mandeep | Llinos | Aneesa Wollet-LLB | Ian | Ian | Ian

19

📧 A threat campaign is abusing Microsoft 365’s Direct Send relay feature to deliver phishing emails that bypass SPF/DKIM/DMARC checks and appear as trusted internal messages. 🔍 Varonis identified instances where attackers used external IPs routed through smart hosts to spoof internal email addresses to evade detection. ➡️ https://lnkd.in/e_cCfhc2 #cybersecurity #phishing #Microsoft365 #directsend

221

2 Comments

Cyber criminals exploit vulnerabilities that should have been fixed a few weeks ago. Sensitive information is a target for organised crime groups as this data can be accessed and used to facilitate more crime. Major vulnerabilities are: -organisations that hold a lot of identity data -decision making processes, especially the tendering and regulation of specific industries -property and goods with a high resale value, or that can facilitate crime. See how you can reduce the risk of being a target for organised crime: https://ow.ly/AJ8P50Wnn23 #DataProtection #CyberCrime #CyberSecurity #Privacy

18

1 Comment

Good morning! Here is this week's ICS Advisory, Other CERT, & Vendor Vulnerability Advisories Weekly Summary for 10 – 14 November 2025. Attached are the slides for this week's ICS Advisories summary. Link to Weekly Summary Slides: https://lnkd.in/eJnSKMF2 This past week, CISA released 17 new CISA ICS Advisories for the following vendors: Mitsubishi Electric, AVEVA, Brightpick AI, Rockwell Automation, General Industrial Controls, and Siemens. One updated CISA ICS Advisory was released for Festo. Based on the new CISA advisories, Critical Manufacturing, Commercial Facilities, Energy, Transportation Systems, Chemical, and Healthcare and Public Health are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 9 new and 4 updates ICS Advisories for Eaton [Power management software], Philips [Patient monitoring Software, Cardiology Information System (CVIS)], Sony Network Communications Inc. [Cellular and WLAN Model for AI home gateway routers or IoT gateway devices], Rockwell Automation [Simulation Software for Modeling & Analyzing], Crestron [Audio, Video, Environmental Controls], Jumo [Programmable Logic Controller (PLC) / Process Controller], Schneider Electric [HMI and SCADA] and Schneider Electric [HMI, PLC, and Multiple Other Products]. For a more comprehensive understanding, you can view the summary details of other CERT & Vendor product advisories identified last week (10 – 14 November 2025) and read the vendor advisory using the links provided at: https://lnkd.in/eMQ86J4F This past week, CISA added Five new Known Exploited Vulnerability (KEV) Catalog. None correlated to CISA ICS Advisories or other CERT and Vendor ICS Advisories this past week. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw This past week, Siemens released 24 Security advisories (8 new and 17 updated), each with a corresponding CISA ICS Advisory. View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com. Sign up to receive ICS[AP] Weekly Summary Slides and Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4           I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otsecurity #icssecurity  #cybersecurity #cybersecuritythreats #industrialautomation #IoT #buildingautomation #healthcare #publichealth #manufacturing #chemical #energy #food #agriculture #oilandgas #renewables #transportationsystems #waterandwastewater Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

32

What the DFIR analyst does during an IR engagement (not only equal to a firefighter or detective) is not the same as what the management should do in handling an incident or what the GRC should do in managing an incident. Why do some experts write a playbook to combine every aspect of DFIR for the technical team to follow? Why does the procurement write a tender to ask a service provider certified with CISM/CISSP or equipped with digital forensic tools to do the IR tasks like this?

69

CMORG have now published the highlights from their 2025 Threat Monitoring report, which looks at the top threats to the operational resilience of the UK's financial sector. I'm very proud to have co-lead the development of this report over two years, with Ragna S as my co-lead in 2024, and Vikram Sethi of the Bank of England in 2025. In both years we were ably supported by a group of volunteers from firms across the sector. The process that Ragna, Vikram and I developed and operated asked CMORG firms to evaluate a set of 35 potential sectoral threats, to help us understand which were the most likely and most serious threats to the sector. The full report, which was shared with participants only, gives some great insight into these threats and how we see them developing. The highlights from the survey are available here - https://lnkd.in/eydhB-eV Thanks to the CMORG team for the opportunity to co-lead this important initiative!

67