The effective management of cyber security is an increasing priority for organisations everywhere. For those familiar with risk management principles, cyber security is more than another operational risk to be dealt with. Meanwhile, for those with less cyber security awareness, the discipline of rules-based risk management frameworks and checklists will support the management process. The […] The post In 2025 we predict: A growing adoption of threat exposure management in large and small organisations appeared first on Huntsman ..read more

Cyber security risks to businesses continue with a growing number of more skilled, well-funded, state-backed, and motivated attackers. The IMF reports that the costs of worst-case breaches have jumped four-fold to USD$2.5bn. Boards are undergoing legal and regulatory pressure to safeguard data, privacy and business resilience. This is most acute in finance, critical infrastructure and […] The post Challenges in Cyber Security Auditing appeared first on Huntsman ..read more

No doubt continuous improvement motivates your organisation, and the new perspectives on cyber and operational risk management are part of your strategic objectives – requiring an ever-evolving posture to deal with changing risks and the environment. The post CRITICAL INFRASTRUCTURE: The Changing Landscape appeared first on Huntsman ..read more

One principle that many security managers are following is called privacy-by-design, which helps  uplift the organisation’s privacy posture while getting some quick wins in place that help prevent privacy breaches. Security and risk managers are often handed the problem of ensuring their organisation’s ability to keep customer data private is adequately implemented, and while this might sound like a simple rebadging of the responsibilities security managers have always had (keep confidential information safe from compromise), there is a lot more to a privacy programme than meets the eye ..read more

Attack Surface Management (ASM) characterises a business’s security risks as the monitoring and risk mitigation of a constantly changing and vulnerable “risk-surface”. Importantly, this attack surface extends to both internal and external assets and services. Some ASM solutions deliver clear visibility across both Internet facing and internal assets. Others do not. Instead, they assess external facing services and assets only; making the mistake that internal servers and endpoints are safe from compromise and attack. Read this field guide to understand how to gain clear visibility of the secur ..read more

Attack Surface Management (ASM) characterises a business’s security risks as the monitoring and risk mitigation of a constantly changing and vulnerable “risk-surface”. Importantly, this attack surface extends to both internal and external assets and services. Some ASM solutions deliver clear visibility across both Internet facing and internal assets. Others do not. Instead, they assess external facing services and assets only; making the mistake that internal servers and endpoints are safe from compromise and attack. Read this field guide to understand how to gain clear visibility of the secur ..read more

Since its introduction in 2014, the NIST Cybersecurity Framework (CSF) has become a foundational cyber security standard. Originally devised for the critical sectors that support infrastructure and public services, its adoption as a source of reference internationally, means it now extends well beyond that. The original executive order that spawned its development might still be a major part of its rationale, but its usefulness to organisations of all sizes, in all sectors and around the world has increased and expanded with the release of this second version. Importantly, NIST has worked clos ..read more

Released on April 9th, 2024, this year’s cyber security breaches report from the UK government makes for interesting reading. Report available here. Key observations from the 2024 report One of the primary statistics is the proportion of companies that suffered a breach – a glimpse into how widespread this problem is. Changes to the 2024 report make cyber security breach and attack comparisons with 2023 impossible, but the findings show that half of businesses had some sort of cyber breach. This is a concerning number, and it gets worse for bigger businesses (70% for medium sized organisation ..read more

As predicted in early 2024 another joint advisory was recently released from the Five-eyes intelligence and cyber security community. This time the advice relates to governments and corporations moving to cloud infrastructure and the efforts of a hacking group which has adapted previously successful tactics, techniques and procedures to target cloud-based infrastructures. Unsurprisingly the market is all about supply and demand and so it would seem that as business and governments move to deliver IT services via the cloud, attackers are seeking ways to infiltrate those systems and steal data ..read more

Quick Links 1. Policy definitions 2. So much to do, so little time 3. Operational resilience stretches beyond operational risk management 4. Anticipating the unknown 5. The evolution of operational resilience processes 6. Monitoring and automation to support operational resilience 7. Other considerations in the application of the Policy Background Operational resilience requirements are being rolled out across the UK and beyond. UK finance firms are required to improve their operational resilience in accordance with Financial Conduct Authority (FCA) Policy Statement PS21/3 (the Policy). The ..read more