Coffee Musings of a Cyber Security Expert

Everyone loves a good story. And every time a cyber security breach occurs, the pros spring into action, attempt to recover what was stolen, and deal with the aftermath. Perhaps one day I'll blog about a few of those incidents, because there's some fascinating stories to be told! For now over this cup of coffee, a thought occurred to me: Troy Hunt's blog on info stealer malware logs is readable on multiple levels. I hadn't considered this earlier, but the information he often writes about can be used by individuals who are tech-curious, right through to professionals in cyber, IDAM, etc. For example, how many times have you explained the perils of malware on the interwebs to non-tech friends and family and wished for written resources and advice to point them at? Amanda-Jane Turner also has a fantastic set of resources for that . Troy's opening paragraph in that blog is ideal for this purpose. He states quite clearly a few simple actions which could lead to passwor...

Small business cyber security risks, part 4: In the last few blogs we focused on advice for small businesses, although really this has been relevant for all of us whether we’re talking about personal, small or large business information security. Reaching for the ideal situation is certainly important and, in many cases, particularly for larger businesses, it’s the law . However last week in my imagination I heard the quiet voice of a small business owner saying, “but what if I’m struggling just to stay financially afloat and keep customers happy, I know cyber security is important, but I just don’t have time unless someone tells me exactly what to do!”  Perhaps that thought came to me because I was looking on with admiration at our local cafe, amazed at the hard-working team, always with smiles on their faces and a kind word for everyone. Whilst they're not struggling financially, I know how busy they always are, and I wondered how they manage information security risk. In a rare ...

Small business cyber security risks, part 3: In my last blog we discussed passwords, including their major shortcomings . In this next blog we'll dive a little further into passwords, particularly in a work environment, but firstly we'll discuss one of the most common mitigating controls for many of the shortcomings of passwords: multi factor authentication (MFA) . You'll almost certainly have used a form of multi factor authentication before, most likely your financial institution will send you a prompt on your phone or perhaps an SMS when transferring funds. The usual form of MFA is the concept that you’re using something you know (your password) and something you have (which is the SMS, or the mobile phone prompt), although there’s a little more to it which we’ll discuss later in this blog. It’s far more difficult for the attacker to get hold of both of those things at once to impersonate you and carry out financial transactions on your behalf. Not impossible, but very u...

Small business cyber security risks, part 2: In my last blog in this small business cyber security risk series, we looked into third-party risk and how small to medium sized businesses can manage their exposure. We covered quite a range of concepts quickly, and as I wrote that blog I’d hoped to revisit each one in a little more depth, one at a time. That’s exactly what we’re going to start doing with this blog, and the first concept I’m going to cover is passwords. Yes, I know, it’s not a fun topic, and I just heard a collective groan from all of you as you read that last sentence! Bear with me, please. In my opinion, the problem with passwords is the IT industry didn’t get it right from the start. Technology evolved relatively quickly compared to say, the automotive or building industries. As consumers, we’ve only had technology that needed passwords since the mid to late nineties. In the business world, some of us encountered mainframes and their “ dumb terminals ” du...

Small business cyber security risks, part 1:  Many of the cyber security professionals around the globe are concerned about third-party risk . What exactly is that, and why should you care? Personally, I like to apply what I consider to be a layer of common sense across these sorts of things, but I feel that I’m very privileged to constantly learn from some of the very best cyber security professionals in Australia and nearby, so perhaps what I assume is common sense is actually their knowledge “bleeding through” me! So let me impart some of that knowledge I’ve accumulated, and hopefully you can benefit from it as I have done. Let’s consider a small business, a hairdressing salon. Typically the team interacts directly with clients of course, although in order to service those clients, there’s very likely a CRM (customer relationship management system) to handle appointments, hold client information, and possibly even manage a pipeline of new clients. Additionally, there’l...