Raja Ali

ICO UK Guidance on Encryption This document outlines best practices for implementing encryption to safeguard personal data, ensuring adherence to UK data protection regulations.

13

NHS DSPT Mandatory Audit Assertion 7.3 — Incident Response Capability Assertion 7.3 of the NHS DSPT is all about incident response. Discover how to detect, contain, and recover from cyber incidents quickly and effectively.

1

This is exactly what Leet Security's Cyber Rating Services were developed to help all organisations address the challenges of Third Party Risk Management as well as providing a unique consolidated and streamlined approach across multiple certifications and audits that deliver a reductions in complexity, delivery timelines, required man-hours, and overall cost https://lnkd.in/eDf659QB

5

After years of work, we have decent security standards, but we'll continue to struggle until we adopt security by default. Take the relationship between TLS 1.2 and 1.3, for example. Both protocols can provide reasonable security, but TLS 1.2 supports a kitchen sink of options, and you need to know what you're doing to configure it correctly. TLS 1.3, on the other hand, just works, no further work needed. This is just one example; there are dozens of standards and situations for everyone to consider when it comes to their network infrastructure. Until we get security by default, the only way to stay ahead is to have comprehensive configuration monitoring to catch problems and drift. I created Hardenize to solve exactly this problem. Our free test is still available at hardenize.com, and the commercial product has been rolled into Red Sift's. Now that Mail Check and Web Check are being retired, I am very happy that there is still a way for Hardenize to continue to serve.

13

1 Comment

The UK’s National Cyber Security Centre (NCSC) has published pragmatic guidance to help organisations, especially those responsible for Critical National Infrastructure (CNI), plan, prepare and respond effectively to severe cyber threats. It’s a timely reminder that cyber resilience goes beyond technology. It requires strategic planning, operational readiness and organisational alignment. Key takeaways include: - Plan early and proactively: Embed severe threat response into enterprise risk planning and leadership decision-making. - Enhance situational awareness: Build threat intelligence and monitoring capabilities to detect and understand emerging risks quickly. - Harden and rehearse defences: Identify tactical measures to reduce exposure, document response actions, and regularly test them through exercises. - Integrate recovery planning: Connect response plans with wider business continuity and organisational objectives to ensure swift restoration. - Build long-term resilience: Plan not just for immediate threats but for adaptability and recovery across the threat lifecycle. In an increasingly hostile cyber landscape, this guidance reinforces the importance of preparedness, coordination and resilience at every level of the organisation. https://lnkd.in/gNYRiSJj #CyberSecurity #CyberResilience #CriticalNationalInfrastructure #CNI #IncidentResponse #BusinessContinuity #RiskManagement #OperationalResilience #NCSC #Leadership #SecurityStrategy

5

Progress with staff training programmes, third-party risk reviews and incident response seems to have stalled in medium and large-sized UK firms (among other things). Could standards like ISO 27001 help? Yes, if the will is there to adopt them. My latest for ISMS.online feat. comment from Etay Maor, Edward Russell and Tom K. https://lnkd.in/es6BQhD4

5

ICO wins appeal. "The CoA… confirms that DSG was required to take appropriate security measures to protect #PersonalData from unauthorised access, regardless of whether people could be identified from the data exfiltrated by the hackers." #CyberSecurity

4

MDR sharpens visibility. Because resilient businesses need a clearer lens. In today’s cyber landscape, what you don’t see often matters more than what you do. Modern security teams face an overload of alerts. MDR steps in to give clarity where it matters most: - Filters noise so only real threats demand attention - Adds context to alerts for faster understanding - Guides action with expert-driven recommendations - Accelerates decisions when time is critical - Strengthens resilience by spotting what tools alone may miss MDR makes your defenses sharper, faster and more reliable. Graftronics is a Sophos MDR partner, transforming IT teams across organizations in multiple industries. Reach out to us for assessing MDR for your setup. - Vimesh Avlani Managed Detection & Response | Cyber Resilience | Trusted by Mid-Market CXOs

20

4 Comments

This is now more practical than ever and "𝐫𝐞𝐚𝐜𝐡𝐞𝐬 𝐭𝐡𝐞 𝐩𝐚𝐫𝐭𝐬 𝐨𝐟 𝐍𝐂𝐒𝐂 𝐂𝐲𝐛𝐞𝐫 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 𝐅𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 𝟒.𝟎 (𝐢𝐧𝐭𝐞𝐠𝐫𝐚𝐥 𝐭𝐨 𝐓𝐡𝐞 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐁𝐢𝐥𝐥); 𝐭𝐡𝐚𝐭 𝐨𝐭𝐡𝐞𝐫 𝐩𝐫𝐨𝐝𝐮𝐜𝐭𝐬 𝐜𝐚𝐧𝐧𝐨𝐭 𝐫𝐞𝐚𝐜𝐡". Pentest Cyber provide you with this, Cyber Essentials Plus and various pentests further to assist you - but don't book too late - slots fill fast.

1

The BPS Cyberpsychology Conference for 2025 has officially come to a close! It was wonderful meeting new friends and immersing myself in cutting-edge cyberpsychology research in Birmingham, UK. The few days were packed with an incredible array of topics, far more than I could absorb in the two days. There are many I am inspired and intrigued by, so here is only a small list of highlights that come to mind presently: - I was fascinated by Glyn Matthew Pickering’s work on the ‘AI Mind Palace,’ a virtual environment he designed to reduce test anxiety and bolster assessment readiness. The integration of VR, AI, and mnemonic strategies like the Method of Loci seems promising in boosting student confidence and performance. Makes me wonder if cybersecurity education should benefit from something similar. - Leonardo Rabelo’s exploration of technobiological bodies in clinical practice offered a provocative lens into how cybernetic integration is reshaping psychological frameworks. His psychoanalytic take on hybrid identities suggested new clinical paradigms for engaging with technologically-augmented selves. This is one of the more innovative concepts presented. - Charlotte C.'s study on Gen Z’s attitudes about AI touched on an optimistic stance, where AI is largely embraced as a tool for self-expression. The next generation who will be largely more responsible for handling AI in the future. It was a reminder of the need for ethical frameworks alongside technological development. - Dr Chris Fullwood and Dr Vasilena Stefanova examined an anti-AI forum populated by creative professionals. Their content analysis revealed anxieties over authenticity, artistic integrity, and the threat of creative erosion. Insights that feel urgent in today’s rapidly evolving AI landscape and related perceptions. - Lynne Beveridge presented work on Messenger Pigeon, an AI study assistant supporting disabled and neurodivergent students. This shows not only technical promise but a thoughtful support to equitable learning experiences. As I look to how AI can be used in education and work productivity, it is interesting to see research on how this can be a benefit. The conference offered valuable insights that closely aligned with my Q-methodology study on cybersecurity practitioners, particularly regarding psychological traits, user acceptance of AI, and the subjective dimensions of hacking, ethics, and identity. Also, being able to discuss some of the struggles of those like me in industry entering the academic world, (Ai S. Dr George Raywood-Burke) helps with understanding some shared challenges. I’m leaving with new connections, new questions, and a reaffirmed excitement about contributing to this evolving field, even in my own small way. Looking forward to continuing these conversations as the work progresses! And thanks to Steven M. M. for the picture and interesting chats over the conference.

58

7 Comments

The Cyber Security and Resilience Bill (CSRB) will introduce some of the most significant changes to UK cyber regulation seen over the last 10 years. This strategic webinar will bring together legal and technical experts from Pinsent Masons and Bridewell to dissect the Bill and the changes it will introduce. By attending this webinar, you'll learn about: 👉Incident reporting requirements under the CSRB 👉Supply chain engagement on cyber-readiness and monitoring and enforcing supply chain compliance 👉Contracting for resilience: trends and effective contractual approaches to enable a cyber-ready supply chain 👉Interactions with global cyber regulations for multinational organisations 👉What’s likely to follow from the government once the bill becomes law Register today➡️ https://lnkd.in/eHJcGJdU

15

🔒 Penetration Testing That Delivers Assurance As cyber threats continue to evolve, penetration testing remains one of the most effective ways to identify risks and strengthen resilience. At Laneden, we deliver CREST-accredited penetration testing services that go beyond simply finding vulnerabilities. We help security teams validate controls, uncover blind spots, and give leadership the assurance that defences are truly fit for purpose. I’m confident we can help your organisation strengthen its security posture, while remaining one of the most cost-effective CREST-accredited providers in the market. Many of our clients have been impressed not only by the quality of our service, but also by the fact that we’ve delivered it at up to two-thirds less than competitor pricing. 📩 Get in touch to learn more #CyberSecurity #PenTesting #CREST #Laneden

13

Ready to take control of your cybersecurity - without the jargon or headaches? Our latest blog breaks down the Cyber Essentials checklist into practical steps you can actually use. From firewalls and patching to access control and malware defence, simply follow the path to certification and protection. Drop the stress. Grab your guide. Get Cyber Essentials done. Read more: https://lnkd.in/eGnxY6ks

1

Newly published independent research from the Department for Science, Innovation & Technology (DSIT) highlights the economic impact of cyber attacks in the UK. Key findings include: • The average cost of a “significant” cyber attack for a UK business is £195,000, with an estimated total impact on the economy of around £14.7 billion annually (approximately 0.5% of GDP). • The theft of intellectual property and knowledge assets via cyber attacks is projected to range from £1 billion to £8.5 billion in 2024. • Consumer-facing consequences are significant; for instance, a three-day outage of online banking services could result in costs between £5.5 million and £231 million. • In a worst-case scenario, a systemic cyber incident in the rail network could lead to costs of up to £1.8 billion from just one week’s disruption. Recommendations include: • Elevating cyber discussions to board level, given the clear financial stakes. • Strengthening foundational controls by implementing frameworks like Cyber Essentials and other best-practice governance. • Viewing cyber as integral to business continuity, innovation, and growth, rather than merely a cost centre. Link in comments 👇

21

6 Comments

Our Information Security Lead, Ashley Dunn (CISSP, CEH), will be taking the stage later today at an Open Web Application Security Project (OWASP® Foundation) event in Bristol. He’ll be hosting a session on Bug Bounty Programs. Ash’s Q&A session will draw on his experience in the industry and include a breakdown of why companies should consider using bug bounties to help improve their security posture, how to implement them, and the ROI and unexpected wins that can come from implementing them. 📍Dareshack, Bristol 📅 July 15th 🕟 6:40 - 7:30pm For more information on the session, head to the comments below 👇 #OWASP #InformationSecurity #SuperAwesome

14

1 Comment

Exciting news! This new standard is one you will want to become familiar with & provide feedback on given its potential impact on other standards such as PCI DSS, PCI PIN, P2PE, etc... #PCIDSS

24

Fantastic new partnership between Institute of Directors (IoD) an Cyber Innovation Hub to deliver cyber awareness and leadership training to Directors and Board members 🙌🏻

12

Chris Roberts speaking against a punitive approach via phishing tests, with Avishai Avivi on the CISOnomics podcast. Links in comments👇

Eye watering effects of a Cyber attack - British retailer Marks and Spencer saw its half-year profits more than halve as a result of a cyberattack that brought its online business to a grinding halt.  In a statement Wednesday, M&S said its underlying pretax profits tumbled 55.4% to £184.1 million pounds in the six months to Sept. 27. The company has said the attack was due to “human error.”  The hack cost it 324 million pounds in lost sales but that it was able to recover 100 million through an insurance payout.  #Incident #cyberattack #incidentresponse

68

7 Comments