David M.

Do your Incident Response team a favour: If you are using the Defender Portal and sending screenshots, please set your timezone within your account to UTC. The following (redacted) image was sent to me yesterday by a client. I had access to the client's DFE portal; however, we were in different time zones. I had to search for the Event text, comparing the seconds of the alerts in my view with the screenshot, because I was not sure in which time zone the screenshot was taken. The whole process was slowed down. Especially for international organisations, please use UTC.

249

21 Comments

Musing today on the nature of risk and whether it is better dealt with using assumptions rather than forecasts as Ackoff, Addison and Bibb suggest in their book, Management f-laws, which I have rediscovered lately (although they were referencing the 'future' and not risk per se). 'Forecasts are about probabilities; assumptions are about possibilities'. We don't have a spare tyre in the back of the car because we forecast a puncture on our next journey; but we do assume that a flat tyre is possible. We therefore plan and prepare for it. Having the tyre won't prevent us having a puncture but it can reduce its negative effects such as being stranded remotely at night in the rain, hail or snow. This struck me as a great analogy for cyber resiliency. A Spare Tyre Is Your Cybersecurity Resilience Plan. Carrying a spare tyre in your car is like having resilience and recovery controls in your cybersecurity programme. 1. You don’t carry a spare tyre because you expect a flat — you carry it because you’re prepared. In cybersecurity, you don’t implement backups, incident response plans, or redundancy because you want an incident. You do it because you know incidents are inevitable, and preparation reduces impact. 2. A flat tyre doesn’t stop your journey — unless you have no spare. A cyber incident doesn’t have to stop business operations. If you have backups, failover systems, and response playbooks, you can keep moving with minimal disruption. 3. A spare tyre buys you time — it’s not the final fix. A spare tyre is temporary. It gets you safely to a repair shop. Likewise, incident response measures (e.g., isolating systems, switching to backups) buy you time to fully remediate the issue. 4. A spare tyre is useless if you don’t know how to use it. Just like a spare tyre needs: - a jack - a spanner - someone who knows how to change it Cyber resilience needs: - trained staff - rehearsed playbooks - clear roles and responsibilities Preparedness is more than having the tool — it’s knowing how to use it. 5. You check your spare tyre periodically — otherwise it fails when you need it. Cyber controls also need: - testing - validation - regular updates An untested, incomplete or out of date incident response or disaster recovery plan is probably as useless as a flat spare tyre. All of the above is predicated on not if, but when. Cyber-attacks are a certainty. The only difference between organisations is the level of impact which is reflected in their level of preparedness.

140

54 Comments

Why Cybersecurity is a critical business imperative? The recent JLR Cyber Attack is a stark example. The carmaker posted a £485m loss – before tax and exceptional items - compared with a profit of £398m for the same period a year ago due to the cyber attack.

20

1 Comment

The changes to ISO/IEC 27001 ISMS are not straightforward. Some believe that the total number of controls was reduced; however, the truth is that new controls were added while existing controls were consolidated and streamlined. The deadline for recertification is October 2025

174

11 Comments

CGI’s UK Security Operations Centre is now CREST Accredited. Our Intelligence-led Security Operations Centre has officially achieved CREST SOC Accreditation. Joining our existing CREST-certified Incident Response and Pen Testing services. Why does this matter? - Independent validation of 24/7 monitoring and response - Simplified procurement for regulated sectors - Trust, transparency, and total cyber assurance Read how this elevates resilience for our clients and what it means for the future of cyber defence https://bit.ly/448qbfj #CGIUK #WeAreCGI #CyberSecurity #SOC #CyberResilience #CRESTAccreditation

201

2 Comments

What's the IAM market saying?! Of course I do not, and never will have a full view of 'the market' (and also, what 'market', IAM is everywheeeeeere, in different ways etc) But a few things others have shared with me recently... 🆔 Many companies are waiting until 2026 to lift off again - for many, it's more about survival and the MUST do's - e.g for DORA etc 🆔 Some are desperate to hire specific talent and are paying over the odds - but is this sustainable? is it right? will it 'outprice' those people later down the line etc? 🆔 Budgets have been and of course still are a challenge - want vs ability to hire, but not everywhere, some are flying, and it won't always be like that 🆔 Many people I speak to don't use their network to find opportunities and tell me there are 'less opportunities'... but not every opportunity is advertised, there's peaks and troughs always, some areas hotter than others etc. 🆔 CIAM is tough right now - budget cuts etc, IGA is where it's at 🆔 There's a place for specialists in tools - but generally you absolutely NEED to know the foundations and not just 'tools' 🆔 All hail to the great work IAM 'business' focussed people do, you are invaluable and absolutely crucial to the success of IAM programmes A super common thing from most of my chats recently is 'Liv, the market is tough, I'm struggling to secure something' etc.... Watch out for some tips on that shortly! Happy IAMing ✌🏻😎 #iam #identityandaccessmanagement #identitysecurity

84

8 Comments

#CyberUK 2025 run by National Cyber Security Centre was another great event. Quite apart from the networking and meeting vendors I enjoyed talking on two different panels, one about Cyber Essentials and getting the foundations of good cyber resilience right with Felicity Oswald OBE, and the other about Secure by Design alongside Eleanor Fairford and others. I've had some queries about my fruit and veg quote from those that weren't there - so here's an explanation! Doing Cyber Essentials (CE) is like eating your cyber "fruit and veg". We all know we need to eat our veg before we eat our pudding and eat our 5 a day as part of a varied diet. AI and other advanced digital tooling is a bit like your pudding. If you fill up on AI (your delicious pudding) without eating enough fruit and veg (doing CE) you tend to end up rather unhealthy (poor cyber resilience)! I'm also delighted that Eleanor Fairford at UK Ministry of Defence and Emma Philpott FCIIS MBE at IASME announced the creation of the Defence Cyber Certification (DCC). It will provide a scalable assurance mechanism to drive improved resilience across the whole of the defence supply chain. Achieving CE and the new DCC as part of a wider Secure by Design process to ensure organisations retain a risk focus along with compliance, will measurably increase the resilience of the UK Defence sector.

135

8 Comments

The BPS Cyberpsychology Conference for 2025 has officially come to a close! It was wonderful meeting new friends and immersing myself in cutting-edge cyberpsychology research in Birmingham, UK. The few days were packed with an incredible array of topics, far more than I could absorb in the two days. There are many I am inspired and intrigued by, so here is only a small list of highlights that come to mind presently: - I was fascinated by Glyn Matthew Pickering’s work on the ‘AI Mind Palace,’ a virtual environment he designed to reduce test anxiety and bolster assessment readiness. The integration of VR, AI, and mnemonic strategies like the Method of Loci seems promising in boosting student confidence and performance. Makes me wonder if cybersecurity education should benefit from something similar. - Leonardo Rabelo’s exploration of technobiological bodies in clinical practice offered a provocative lens into how cybernetic integration is reshaping psychological frameworks. His psychoanalytic take on hybrid identities suggested new clinical paradigms for engaging with technologically-augmented selves. This is one of the more innovative concepts presented. - Charlotte C.'s study on Gen Z’s attitudes about AI touched on an optimistic stance, where AI is largely embraced as a tool for self-expression. The next generation who will be largely more responsible for handling AI in the future. It was a reminder of the need for ethical frameworks alongside technological development. - Dr Chris Fullwood and Dr Vasilena Stefanova examined an anti-AI forum populated by creative professionals. Their content analysis revealed anxieties over authenticity, artistic integrity, and the threat of creative erosion. Insights that feel urgent in today’s rapidly evolving AI landscape and related perceptions. - Lynne Beveridge presented work on Messenger Pigeon, an AI study assistant supporting disabled and neurodivergent students. This shows not only technical promise but a thoughtful support to equitable learning experiences. As I look to how AI can be used in education and work productivity, it is interesting to see research on how this can be a benefit. The conference offered valuable insights that closely aligned with my Q-methodology study on cybersecurity practitioners, particularly regarding psychological traits, user acceptance of AI, and the subjective dimensions of hacking, ethics, and identity. Also, being able to discuss some of the struggles of those like me in industry entering the academic world, (Ai S. Dr George Raywood-Burke) helps with understanding some shared challenges. I’m leaving with new connections, new questions, and a reaffirmed excitement about contributing to this evolving field, even in my own small way. Looking forward to continuing these conversations as the work progresses! And thanks to Steven M. M. for the picture and interesting chats over the conference.

58

7 Comments