GovTech Cybersecurity Reform Strategies

Every vulnerability follows the same timeline. → Discovery → Assessment → Remediation The slowest stage usually determines the outcome. The latest guidance from GDS and DSIT reflects that reality. AI is making vulnerability discovery faster. Code that once took days or weeks to review can now be analysed in minutes. Weaknesses are becoming easier to find. That creates a natural temptation to focus on visibility. → Who can access the code → Which repositories are public → How much information should be exposed The guidance takes a different view. The focus is on ownership, maintenance and response capability. I have seen systems carrying known vulnerabilities long after they were discovered. Not because nobody found them but because nobody owned the fix. A vulnerability sitting in a private repository is still a vulnerability. An unmaintained dependency does not become safer because fewer people can see it. The organisations handling this shift best are treating security as an operational discipline. → They know who owns each service → They know how updates are deployed → They know how quickly issues move from discovery to remediation AI is changing the speed of the first stage. The organisations that adapt fastest will be the ones that improve the last two. #GovTech #CyberSecurity #OpenSource

The recent news about DBKL systems allegedly being hacked with a ransom demand of RM236 million is deeply alarming. As someone who’s been in the IT and business development space, this incident is a wake-up call for all government agencies, GLCs, and even private corporations in Malaysia. Cybersecurity is no longer just an IT department's responsibility. It is an organisation-wide priority. This kind of attack doesn’t just risk sensitive data. It shakes public trust, disrupts services, and drains financial resources that could have been used for development. So how do we prevent this? ❗️1. Basic Cyber Hygiene Must Be Enforced Strong passwords, multi-factor authentication (MFA), timely system updates, and regular patching are not optional anymore. Many breaches happen simply due to outdated software or poor access control. ❗️2. Educate Everyone From top management to front liners, everyone needs cybersecurity awareness training. Social engineering, phishing, and impersonation attacks are getting smarter. A single unaware staff can become the weakest link. ❗️3. Conduct Regular Penetration Tests and Audits We need to stop treating cybersecurity audits as a compliance checklist. Continuous monitoring, external penetration tests, and simulated phishing campaigns must be conducted regularly. ❗️4. Invest in Threat Detection and Response By the time hackers ask for ransom, it is already too late. Organisations need to implement real-time threat detection, SIEM systems, and endpoint detection and response (EDR) tools to spot and neutralise threats early. ❗️5. Backup. Backup. Backup. Critical systems and data must be backed up securely and regularly, both online and offline. In the event of an attack, recovery should be possible without paying a ransom. ❗️6. Appoint a CISO and Form an Incident Response Team (Male for corporate smartness, Female for detailed work) Leadership matters. Cyber resilience must be driven from the top. An empowered Chief Information Security Officer (CISO) and a dedicated Cybersecurity Incident Response Team (CSIRT) should be standard in every major organisation. This DBKL case is not just about one agency. It is a national issue. We must stop being reactive and start building cybersecurity into the DNA of how we operate. #CyberSecurity #Malaysia #DBKL #DigitalResilience #ITGovernance #CyberAwareness #PublicSector #Infosec #Ransomware #CISO #PenTest #IncidentResponse #MFA #MalaysianGovTech #BusinessContinuity #CyberSecurityMalaysia

🔒 Cyber GRC: Essential Steps in Light of SEC Cyber Rule, NIST CSF 2.0, and CISA CIRCA 🔒 In today's dynamic digital landscape, managing cybersecurity goes beyond merely protecting systems. It's about Cyber GRC (Governance, Risk, and Compliance)—a comprehensive approach to aligning cybersecurity measures with business strategy, mitigating risks, and ensuring compliance with regulations. With the recent SEC Cyber Rule, NIST CSF 2.0, and CISA CIRCA, Cyber GRC's importance has reached new heights. Here's how you can leverage Cyber GRC to stay ahead: Governance: Establish a robust cybersecurity governance structure that sets clear policies and responsibilities. Define how your organization's cyber strategy aligns with business goals and industry standards like the NIST Cybersecurity Framework (CSF) 2.0. Risk Assessment: Regularly evaluate cyber risks to identify vulnerabilities and potential threats. Incorporate CISA CIRCA guidelines to manage cyber incidents effectively, minimizing business impact. Compliance: Ensure adherence to the new SEC Cyber Rule, which mandates disclosure of cyber incidents and proactive measures to safeguard data. Keep up-to-date with evolving regulations to maintain compliance and avoid penalties. Incident Response: Develop a comprehensive incident response plan, integrating guidance from CISA CIRCA and NIST CSF 2.0. Test and refine it regularly to ensure swift action when needed. Continuous Improvement: Cyber GRC is an ongoing process. Monitor performance, conduct audits, and adapt strategies to address emerging threats and regulatory changes. By integrating Cyber GRC into your organization's DNA, you can navigate the evolving cyber landscape confidently. This holistic approach safeguards against risks, maintains compliance, and ensures your cyber strategy supports business growth. How is your organization adapting to the new regulatory landscape?

The Government of New South Wales (NSW Government) has released the 2026–2028 Cyber Security Strategy, which contains the #cybersecurity blueprint for the NSW Government for the next 3 years. The NSW Government is working towards 5 main #cyber objectives, including: ➣ Strengthen #riskmanagement, #governance and #compliance. ➣ Improve incident response and cyber intelligence capability. ➣ Uplift cyber resilience ➣ Drive continuous development of cybersecurity tools, processes and methodology. ➣ Support NSW communities to be #cybersafe. What I like about this strategy is that it is people-centric and avoids the fluff. It explicitly frames cyber as foundational to service continuity and public confidence, while calling out the modern accelerants we’re all seeing: commoditised #cybercrime and generative #AI supercharging #phishing, #socialengineering, and #malware creation. What I also like about the 2026-28 NSW Government Strategy is that it aligns with both the NSW Digital Strategy and the 2023-2030 Australian Cyber Security Strategy (page 7). The full strategy can be downloaded below or directly at https://lnkd.in/gCW9j55W. Novera is very proud to be a prequalified and approved supplier to the NSW Government under the SCM0020 ICT Services scheme and welcomes the NSW State Government's focus on uplifting cyber resilience across Australia's largest state, which makes up over one-third of the national economy.

Morocco published his National Cybersecurity Strategy 2030, based on four key pillars: 1. National Cybersecurity Governance - Strengthen the legal and institutional framework to address evolving cyber threats. - Improve coordination and collaboration between public and private sectors, as well as regulatory authorities. - Establish effective mechanisms for information sharing and cooperation. 2. Security and Resilience of the National Cyberspace - Enhance capabilities for threat detection and proactive response. - Promote standards and certifications for cybersecurity, particularly for critical infrastructure. - Map vital infrastructures and conduct regular audits to ensure compliance with security standards. 3. Capacity Building and Awareness - Foster a cybersecurity culture through awareness campaigns targeting citizens, businesses, and public administrations. - Strengthen training and certification programs in universities and professional training centers. - Support research and innovation to build a dynamic national cybersecurity ecosystem. 4. Regional and International Cooperation - Actively participate in international forums to enhance Morocco’s position in cybersecurity. - Develop bilateral and multilateral partnerships to share expertise and strengthen capacities. Monitoring and Evaluation - The DGSSI oversees the implementation of the strategy. - Periodic evaluations will adapt the strategy to evolving risks and challenges..

During my talk at the "Telecom Cyber Security Awards 2024," addressing an audience that included the Minister of IT and Telecom, the Chairman of PTA, and representatives from the telecom industry, I proposed the following strategic recommendations to the government: 1. Implement Targeted Tax Breaks for Cybersecurity Professionals working Locally: There is a need for targeted subsidies and tax breaks specifically for cybersecurity professionals in the local industry, as well as for individuals working in other areas of emerging technology. This objective can be achieved by establishing a dedicated body comprising representatives from various industries to develop clear and fair criteria for assessing individuals eligible for these tax breaks. 2. Revamp Education to Focus on Practical Cybersecurity Skills: Introduce industry-aligned bootcamps, coding classes, and specialized programs starting in high school. Consider agile two-year degrees and diplomas to quickly prepare a skilled workforce. 3. Appoint High-Level Cybersecurity Representation: Create a dedicated Member for Cybersecurity within the Ministry of IT and PTA to ensure focused attention and strategic prioritization of cybersecurity issues at the highest levels. 4. Support Startups in Emerging Technologies: Develop specialized VC funds for cybersecurity, AI, blockchain, and other emerging tech startups. Provide support for established companies to expand globally. 5. Establish Balanced AI and Internet Media Regulations: Enforce policies that promote transparency and accountability in AI usage, such as requiring companies to responsibly open-source their training data, while ensuring innovation does not suffer in the process. #cybersecurity #nationaltelecomawards

🚨 Cyber Security and Resilience Policy Statement – A Game-Changer for UK Critical Infrastructure 🚨 The collective cyber and resilience industry today welcomes the Department of Science, Innovation and Technology (DSIT) Cyber Security and Resilience Policy Statement. This presents ground-breaking legislative proposals focused on addressing the increasing cyber threats to the UK’s critical services (healthcare, energy, and water). Why is this game-changing? The UK's critical infrastructure is increasingly vulnerable to cyberattacks. Hostile actors exploit our reliance on digital connectivity, i.e. the June 2024 cyber attack on Synnovis, which impacted critical health services. The proposed legislation recognises the need for a more robust and adaptable approach to cyber security. Core aspects of note: 📈 Expanding the scope of NIS Regulations: The NIS Regulations will be extended to cover a wider range of organisations including data centres, Managed Service Providers (MSPs), and critical suppliers. This will ensure a more comprehensive and effective framework for protecting critical infrastructure. ⚖️ Empowering regulators: Authorities will have access to more tools and resources to improve cyber security and resilience in the sectors they oversee. This includes the ability to require more detailed reporting of significant cyber incidents. 💪 Strengthening governmental authority: The government will have new executive powers to respond to cyber threats that pose a risk to national security. This will provide a more agile and effective response to emerging threats. ⚠️ Adapting to evolving risks: The framework will be more flexible, allowing the government to update it quickly to address new and emerging cyber threats. This will ensure that the UK's cyber defences remain effective in the face of a constantly evolving threat landscape. 🤝 Collaboration is key: As we navigate the dynamic landscape, joint efforts are required to strengthen our national resilience. I encourage all organisations to familiarise themselves with the details of the DSIT Cyber Security and Resilience Policy Statement to build a more secure and resilient future. #CyberSecurity #Resilience #CriticalInfrastructureProtection

The White House just released Cyber Strategy for America. If you work in cybersecurity, AI, infrastructure, or emerging tech… this document is worth understanding. It lays out six major policy pillars shaping how the federal government plans to approach cybersecurity going forward: ➤ Shaping adversary behavior ➤ Streamlining cybersecurity regulation ➤ Modernizing and securing federal networks ➤ Securing critical infrastructure ➤ Sustaining superiority in emerging technologies like AI and quantum ➤ Building America’s cyber workforce Whether you agree with every policy direction or not, strategies like this often translate directly into federal priorities, budgets, and contract opportunities. For government contractors, that means paying attention to signals like: 👉 Increased focus on AI-enabled cybersecurity 👉 Zero-trust and post-quantum security adoption 👉 Protecting critical infrastructure and supply chains 👉 Greater public-private collaboration in cyber defense These themes will likely influence agency priorities, funding decisions, and procurement over the next several years. Understand this strategic document, then consider sharing the key points with your customers or target customers as a way to demonstrate your SME and thought leadership value. ___________________________________ 🔥 Join 28,804 others and subscribe to our GovCon newsletter | https://lnkd.in/es6qfwgk 👀 Follow me (Neil McDonnell) on LinkedIn™ and hit the 🔔 on my profile to see more government contracting content like 44,964 other people do.

The Office of Management and Budget (OMB) and the Office of the National Cyber Director (ONCD) have just unveiled their memorandum, outlining crucial cybersecurity budget priorities for federal departments and agencies. 🔹 The memo emphasizes the need for budget submissions to be in harmony with the administration's cyber strategy and policy. OMB and ONCD will diligently review these submissions, identifying any potential gaps and proposing innovative solutions. It's a comprehensive approach to safeguarding our critical infrastructure, disrupting threat actors, shaping market forces, investing in resilience, and forging international partnerships – all key priorities outlined in the National Cybersecurity Strategy. 🔹 The memo also hints at upcoming strategies that will further strengthen our cyber defenses. Among these are the implementation plan for the National Cybersecurity Strategy and a national cyber workforce strategy. These initiatives underscore the importance of modernizing federal defenses, combating ransomware, influencing the cybersecurity market through smart procurement, fortifying the cyber workforce, preparing for a post-quantum future, and securing global supply chains for critical technologies. Keep an eye out for a separate memo that will outline cybersecurity research and development priorities, properly demonstrating the government's commitment to driving innovation and staying ahead of emerging threats through cutting-edge research. Exciting times lie ahead as we work collectively to protect our digital infrastructure and ensure a secure future for all! More from CyberScoop: https://lnkd.in/d8dyBXRq #NationalSecurity #Cybersecurity #Strategy #Development

The next phase of DoW cyber reform won’t be won in policy, it will be won in implementation, training, and operational visibility across mission-critical infrastructure.   That’s where the 2026 NDAA gets interesting.   The law includes provisions that reflect the operational reality of securing critical infrastructure across the DoW, including power, water, transportation, and base systems: 🔹 An assessment for an OT cybersecurity training center of excellence 🔹 Annual reporting on the cyber posture of OT, ICS, and base-level infrastructure 🔹 Increased scrutiny of legacy technologies and mission-readiness gaps 🔹 A broader push for harmonization that must contend with the complexity of critical systems, not just enterprise IT   It’s no longer about policy debates or frameworks. Instead, it’s just outcomes on DoW-wide mission readiness.   The job ahead: translate mandates into resilience, visibility and control into action, and training into operational advantage at scale.    If you're focused on the same, let’s talk. Here’s more on Forescout Technologies Inc.’s approach: https://lnkd.in/gqKQQdiM   #OTSecurity #MissionAssurance #ZeroTrust #NDAA2026