Strengthening Cybersecurity Using Current Resources

The recent news about DBKL systems allegedly being hacked with a ransom demand of RM236 million is deeply alarming. As someone who’s been in the IT and business development space, this incident is a wake-up call for all government agencies, GLCs, and even private corporations in Malaysia. Cybersecurity is no longer just an IT department's responsibility. It is an organisation-wide priority. This kind of attack doesn’t just risk sensitive data. It shakes public trust, disrupts services, and drains financial resources that could have been used for development. So how do we prevent this? ❗️1. Basic Cyber Hygiene Must Be Enforced Strong passwords, multi-factor authentication (MFA), timely system updates, and regular patching are not optional anymore. Many breaches happen simply due to outdated software or poor access control. ❗️2. Educate Everyone From top management to front liners, everyone needs cybersecurity awareness training. Social engineering, phishing, and impersonation attacks are getting smarter. A single unaware staff can become the weakest link. ❗️3. Conduct Regular Penetration Tests and Audits We need to stop treating cybersecurity audits as a compliance checklist. Continuous monitoring, external penetration tests, and simulated phishing campaigns must be conducted regularly. ❗️4. Invest in Threat Detection and Response By the time hackers ask for ransom, it is already too late. Organisations need to implement real-time threat detection, SIEM systems, and endpoint detection and response (EDR) tools to spot and neutralise threats early. ❗️5. Backup. Backup. Backup. Critical systems and data must be backed up securely and regularly, both online and offline. In the event of an attack, recovery should be possible without paying a ransom. ❗️6. Appoint a CISO and Form an Incident Response Team (Male for corporate smartness, Female for detailed work) Leadership matters. Cyber resilience must be driven from the top. An empowered Chief Information Security Officer (CISO) and a dedicated Cybersecurity Incident Response Team (CSIRT) should be standard in every major organisation. This DBKL case is not just about one agency. It is a national issue. We must stop being reactive and start building cybersecurity into the DNA of how we operate. #CyberSecurity #Malaysia #DBKL #DigitalResilience #ITGovernance #CyberAwareness #PublicSector #Infosec #Ransomware #CISO #PenTest #IncidentResponse #MFA #MalaysianGovTech #BusinessContinuity #CyberSecurityMalaysia

Enhancing Cybersecurity: A Comprehensive Security Matrix A layered approach to security is essential. The following framework breaks down cybersecurity into six interconnected domains, each with practical components to strengthen defenses and response capabilities: Information Security: Access Rights & Permissions Matrix Data Breach Notification Log Data Classification Register Data Loss Prevention (DLP) Incident Log Document Retention & Disposal Tracker Encryption Key Management Sheet Network Security: DDoS Attack Mitigation Plan Tracker IP Whitelist-Blacklist Tracker Network Access Control Log Network Device Inventory Network Security Risk Mitigation Report Security Event Correlation Tracker Cloud Security: Cloud Access Control Matrix Cloud Asset Inventory Tracker Cloud Backup & Recovery Testing Tracker Cloud Incident Response Log Cloud Security Configuration Baseline Application Security: Application Data Encryption Checklist Application Risk Assessment Matrix Application Threat Modeling Authentication & Authorization Control Sheet Modeling Patch & Update Tracker Security Management: Acceptable Use of Assets Password Policy Backup and Recovery Compliance Management Disposal and Destruction Policy Information Classification Policy Incident Management: Incident Management Guide Incident Management Policy Incident Management Process Internal Incident Report Major Incident Report Template Structure Damage Incident Report Problem Management: KE Record Template Major Problem Report Template Problem Management Process Problem Record Template This structured approach creates clear accountability, improves visibility, and accelerates incident response across technology ecosystems. It’s about turning security into an organized, repeatable, and measurable practice that protects assets while enabling innovation.

Building a Strong Foundation: How to Create an Effective Organizational Profile with NIST CSF 2.0 🔐💼 Creating a solid cybersecurity strategy starts with understanding where your organization currently stands. The NIST Cybersecurity Framework (CSF) 2.0 offers a structured way to evaluate and strengthen your security practices. One of the most important steps is developing an Organizational Profile—a tool that helps you map out your existing controls, identify gaps, and plan improvements. This guide will walk you through the process of building an Organizational Profile, so you can take meaningful steps toward enhancing your organization’s security. 1. Define the Scope: Determine the specific systems, processes, or threats the profile will address. For instance, it could encompass the entire organization, financial systems, or ransomware-specific responses. Multiple profiles can be created to target different areas or objectives. 2. Collect Relevant Data: Gather information such as organizational policies, cybersecurity standards, risk management goals, BIAs (Business Impact Analyses), enterprise risk assessments, and existing tools or practices. These details form the foundation of the profile. 3. Build the Profile: Using the collected data, document your organization’s alignment with CSF outcomes. Highlight current strengths and risks. This step establishes your Current Profile, which serves as the baseline for future improvements. Community Profiles can be a helpful reference when planning your Target Profile. 4. Conduct a Gap Analysis: Compare the Current Profile to the desired Target Profile. Identify gaps and prioritize improvements. Use tools like a risk register or POA&M (Plan of Action and Milestones) to effectively develop an actionable plan to address these gaps. 5. Execute and Update: Implement the action plan to close identified gaps and improve alignment with the Target Profile. Continuously monitor and update the profile to reflect organizational changes and evolving threats. By creating an Organizational Profile using the NIST CSF 2.0 framework, organizations can assess their current security posture and take deliberate steps to enhance their resilience. This ongoing process ensures that as threats evolve, so does your organization’s ability to address them. How is your organization aligning with the NIST CSF 2.0? #Cybersecurity #NISTCSF #RiskManagement #CyberResilience #OrganizationalProfile #NISTCSF2.0 #SecurityStrategy #CyberAwareness #InformationSecurity #RiskAssessment

Is your security team stuck in firefighting mode? Use this Cybersecurity Strategy Matrix to build a balanced security roadmap: 𝟭. 𝗘𝗺𝗯𝗲𝗱𝗱𝗲𝗱 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 (Existing Systems + Existing Controls) → Strengthen password policies and access management → Enhance patch management processes → Conduct deeper security awareness training → Low risk, focuses on security fundamentals 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Strong foundation with minimal disruption 𝟮. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗻𝗼𝘃𝗮𝘁𝗶𝗼𝗻 (Existing Systems + New Controls) → Implement EDR/XDR solutions over traditional antivirus → Deploy AI-based threat hunting capabilities → Adopt zero-trust architecture frameworks → Moderate risk, leverages advanced protections 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Significantly improved protection without system overhaul 𝟯. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝗽𝗮𝗻𝘀𝗶𝗼𝗻 (New Systems + Existing Controls) → Extend current security monitoring to cloud workloads → Apply existing controls to newly acquired systems (M&A) → Secure shadow IT with established security baselines → Moderate risk, focuses on consistent security coverage 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Unified security posture across your growing environment 𝟰. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗧𝗿𝗮𝗻𝘀𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 (New Systems + New Controls) → Build security for containerized environments → Implement quantum-resistant encryption → Develop custom security for IoT/OT environments → Highest risk, prepares for emerging threat landscapes 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Future-proofed security ready for emerging threats Effective cybersecurity requires balancing immediate needs with long-term resilience. Where is your security program investing today?

This article highlights a St. Louis federal court indicted 14 North Korean nationals for allegedly using false identities to secure remote IT jobs at U.S. companies and nonprofits. Working through DPRK-controlled firms in China and Russia, the suspects are accused of violating U.S. sanctions and committing crimes such as wire fraud, money laundering, and identity theft. Their actions involved masking their true nationalities and locations to gain unauthorized access and financial benefits. To prevent similar schemes from affecting you businesses, we recommend a multi-layered approach to security, recruitment, and compliance practices. Below are key measures: 1. Enhanced Recruitment and Background Verification - Identity Verification: Implement strict verification procedures, including checking legal identification and performing background and reference checks. Geolocation Monitoring: Use tools to verify candidates’ actual geographic locations. Require in-person interviews for critical roles. - Portfolio Validation: Request verifiable references and cross-check submitted credentials or work samples with previous employers. - Deepfake Detection Tools: Analyze video interviews for signs of deepfake manipulation, such as unnatural facial movements, mismatched audio-visual syncing, or artifacts in the video. - Vendor Assessments: Conduct due diligence on contractors, especially in IT services, to ensure they comply with sanctions and security requirements. 2. Cybersecurity and Fraud Prevention - Access Control: Limit access to sensitive data and systems based on job roles and implement zero-trust security principles. - Network Monitoring: Monitor for suspicious activity, such as access from IPs associated with VPNs or high-risk countries. - Two-Factor Authentication (2FA): Enforce 2FA for all employee accounts to secure logins and prevent unauthorized access. - Device Management: Require company-issued devices with endpoint protection for remote work to prevent external control. - AI and Behavioral Analytics: Monitor employee behavior for anomalies such as unusual working hours, repeated access to restricted data, or large data downloads. 3. Employee Training and Incident Response - Cybersecurity Awareness: Regularly train employees on recognizing phishing, social engineering, and fraud attempts, using simulations to enhance awareness of emerging threats like deepfakes. - Incident Management and Reporting: Develop a clear plan to handle cybersecurity or fraud incidents, including internal investigations and containment protocols. - Cross-Functional Drills and Communication: Conduct company-wide simulations to test response plans and promote a culture of security through leadership-driven initiatives. #Cybersecurity #HumanResources #Deepfake #Recruiting #InsiderThreats

🛡️ Strengthening Your Cybersecurity: A Practical Guide for Small Businesses 🛡️ Cybersecurity might seem daunting, but safeguarding your business doesn't require breaking the bank. Here are five robust yet budget-friendly strategies to enhance your protection: 1. Invest in Employee Education: It's crucial to cultivate cyber awareness within your team. Free online resources can empower your staff to recognize threats and safeguard your operations. This proactive approach is your first line of defense. 2. Conduct Regular Risk Assessments: Utilize third-party services to perform vulnerability checks and penetration testing. Remember, if you can't measure it, you can't manage it! 3. Minimize Entry Points: Implement Single Sign-On (SSO) combined with Multi-Factor Authentication (MFA) to tighten access controls. Fewer gateways mean fewer opportunities for breaches. 4. Embrace a Solid Backup Strategy: Remember '3-2-1' (three copies of data, two different storage types, one off-site location) to ensure you can recover quickly from data loss scenarios, including ransomware attacks. 5. Stay Prompt with Updates: When updates are available, apply them immediately. These patches are essential for closing vulnerabilities that could be exploited by cyber threats. Cybersecurity is a wise investment that supports your business’s longevity and reputation. Start enhancing your defenses today! #Cybersecurity #SmallBusiness #DataProtection #TechTips

𝐓𝐡𝐞 𝐏𝐲𝐫𝐚𝐦𝐢𝐝 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐨𝐬𝐭𝐮𝐫𝐞 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐭𝐨 𝐝𝐞𝐟𝐞𝐧𝐝 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐛𝐚𝐝 𝐭𝐡𝐫𝐞𝐚𝐭 𝐚𝐜𝐭𝐨𝐫𝐬 𝐚𝐧𝐝 𝐀𝐏𝐓𝐬. 🔹 Vulnerability Scanning: Conduct quarterly scans to identify and document security weaknesses.   🔹Patching and Updates: Implement a robust patch management strategy, addressing critical vulnerabilities within 48 hours and others within 7-30 days based on severity. 🔹Vulnerability Assessments : Generate detailed reports to analyze risks and prioritize security measures. 🔹Penetration Testing : Simulate real-world attacks to identify critical vulnerabilities, performing tests once or twice a year. 🔹Red Team Engagement : Conduct realistic assessments of security capabilities, with Purple Team collaboration for real-time defense training. 🔹Vulnerability Remediation : Systematically eliminate identified weaknesses post-assessment and testing, with ongoing monitoring. 🔹Blue Team Training / Incident Response Training : Provide continuous training on best practices and response strategies to enhance security team readiness. 🔹 Overall Strategy : Implement these activities to strengthen security posture against evolving cyber threats. Disclaimer: The provided article is intended for educational and knowledge-sharing purposes related to cybersecurity. #ciso #cybersecurity

Cybersecurity threats are evolving rapidly. Daily, new vulnerabilities emerge, and businesses struggle to keep up. How can we stay ahead? Here are some key cybersecurity strategies: → Educate Your Team Cybersecurity is everyone's responsibility. Conduct regular training on the latest threats and best practices. → Implement MultiFactor Authentication (MFA) Passwords alone aren't enough. MFA adds an extra layer of security. → Regularly Update and Patch Systems Software updates often include critical security fixes. Update systems promptly. → Backup Data Frequently Up-to-date backups can save you in a ransomware attack. Ensure secure and tested backups. → Conduct Regular Security Audits Identify vulnerabilities through regular audits. Engage third-party experts for an objective view. → Adopt Zero Trust Architecture Trust no one by default. Verify every access request. → Invest in Threat Intelligence Stay aware of emerging threats. Use threat intelligence tools to mitigate risks. → Develop an Incident Response Plan Prepare for the worst with a clear response plan to minimise damage and recovery time. → Leverage Cloud Security Solutions Use advanced security features offered by cloud providers to protect your data. In this fast-paced landscape, staying proactive is crucial. Implementing these strategies can significantly reduce risk. What strategies work for your organisation? Let's discuss in the comments.

The role of Chief Information Security Officers (CISOs) in maintaining a flat budget for 2025 while addressing the escalating threat of targeted cyber attacks is paramount. To enhance security and reduce risks effectively with limited resources, CISOs are focusing on several key strategies: - Improving visibility into all data-in-motion. - Maximizing current security investments. - Enhancing cloud security protocols. - Investing in robust Identity and Access Management (IAM) solutions. - Implementing Zero Trust principles and expanding their reach. - Harnessing Artificial Intelligence (AI) and Machine Learning (ML) for advanced threat detection. - Ensuring adherence to regulatory standards. - Educating staff on cybersecurity best practices. - Regularly updating incident response protocols. - Enhancing communication with the board. These strategies empower CISOs to uphold security standards while navigating the evolving landscape of cyber threats. #Cybersecurity #CISO #RiskReduction Please note that the outlined priorities represent personal opinions and do not endorse specific vendors or solutions. Stay tuned for the forthcoming post detailing the steps to achieve these top 10 objectives.

My Reflections on the New Year Rather than reiterating common narratives about “increasing threats and attacks”, I want to focus on actionable insights for the upcoming year: 1. Emphasizing Cross-Discipline Teams in Cybersecurity Shared Responsibility: Cybersecurity is a collective responsibility. Too often, I encounter scenarios where I'm only engaging with a single group, such as a security team, when I also need to involve the networking team, identity providers (IdP), endpoint team, and cloud applications team. Organizations must foster and mandate cross-functional collaboration to ensure that all relevant teams are working in unison. Effective cybersecurity requires seamless coordination and communication across all departments. 2. Advancing SASE-Based Zero Trust Beyond the Basics Maturity in Implementation: SASE-based Zero Trust should be more than a trendy phrase; it should be a matured, integral part of your cybersecurity strategy. At this stage, organizations should have moved beyond initial adoption and be actively implementing advanced practices. Key concepts include: Brokered Connections: Facilitate secure, intermediated connections. Isolation of Apps and Users from the Network: Prevent direct access to critical resources. Proximity of Security Stack to Users: Ensure that your security measures are close to where your users are, regardless of their location. TLS Inspection at Scale: Comprehensive visibility is crucial; you cannot protect what you cannot see. 3. Purple Teaming:  It is imperative that we engage in ongoing testing of our security controls through Purple Teaming exercises. This approach enables us to identify and address any vulnerabilities or gaps in our defenses, our playbooks, and our IR plans.. Regular and thorough tuning of our security measures is essential to ensure that enterprise risk is effectively managed and mitigated. By focusing on these areas, we can enhance our cybersecurity posture and better prepare for the challenges of the new year.