Charles Gillman

🧭 Identity risk grows quietly when access reviews slip. ASD guidance continues to highlight privilege creep and weak identity governance as key contributors to incidents. You don't need perfect IAM tooling to start. You need: ✔ MFA everywhere ✔ regular access reviews ✔ removal of shared accounts That's access discipline. Source: Australian Signals Directorate — Annual Cyber Threat Report 2024–25 https://lnkd.in/ggFg_BYu #IdentityGovernance #AccessManagement #IncightInsights #Hospitals #Schools #AgedCare #OperationalResilience #ASDReport

2

📣 As the recent ManageMyHealth incident and NCSC announcements show, New Zealand cannot afford to get complacent about cybersecurity...   ► The ransom hack on New Zealand's largest health portal is being billed as one of the country's biggest cybersecurity incidents - hackers threatening to release more than 400,000 documents stolen from about 126,000 Manage My Health patients if the private company fails to pay $60,000.   ► It's also been a massive period for the National Cyber Security Centre (NCSC). Recently, they took an unprecedented step - proactively reaching out to 26,000 New Zealanders to warn them their devices may be compromised by Lumma Stealer malware. This is the first time they've conducted public outreach at this scale, signalling a fundamental shift toward a more active protective stance.   ► They also released the New Zealand Cyber Threat Report for 2025, and frankly, it makes for sobering reading. A few key findings explain exactly why the NCSC is ramping up their activity: → State-sponsored actors are now actively targeting New Zealand organisations → Cybercriminals have access to increasingly sophisticated tools → Supply chains have become prime attack vectors → Unpatched vulnerabilities continue to provide easy entry points   ► And there's more - they just published new guidance on Secure Integration of #AI in #OperationalTechnology, recognising how rapidly our threat surface is expanding with emerging technologies.   For business leaders, this should be a clear signal. It reminds us that cybersecurity is a strategic business risk that demands board-level attention and investment as the threat environment has escalated to the point where government agencies are moving from reactive to proactive mode.   Examine these in detail (and more) at the National Cyber Security Summit this March 17-18 in Wellington: https://lnkd.in/gWqqzF7h #cyber #cybersecurity #cybersummit2026 #wellingtonnz Brightstar

16

2 Comments

🟣Governing Through a Cyber Crisis: In 2024, the Australian Institute of Company Directors (AICD), in partnership with the Cyber Security Cooperative Research Centre (CSCRC) and Ashurst, released “Governing Through a Cyber Crisis: Cyber Incident Response and Recovery for Australian Directors.” 18 months later, these guidelines are relevant more than ever. ☑️ Readiness: Build the Foundations Before the Breach. Boards are expected to lead from the top, not just sign off on policy. Effective readiness means: - A comprehensive, regularly tested Cyber Incident Response Plan, integrated with business continuity and communications frameworks. - Clear board-level roles and responsibilities, including when to activate sub-committees or crisis structures. - Scenario testing and simulation exercises that involve directors, not just IT teams, ensuring governance mechanisms work under pressure. - Data governance frameworks that clearly identify where sensitive information resides, who owns it, and how it’s protected. - Supply-chain due diligence: recognising that vulnerabilities often sit outside the organisation’s perimeter. ☑️ Response: Act Decisively, Communicate Transparently. - When an incident unfolds, speed and clarity are critical. Boards should expect imperfect information but must ensure that: - Management activates the crisis plan and establishes clear reporting cadence. - Stakeholder communication is transparent, coordinated, and empathetic with customers, regulators, and the market. - Legal and regulatory obligations are promptly addressed. - External experts (forensics, legal, and communications) are mobilised early. - Larger organisations are encouraged to establish a Cyber Incident Sub-Committee to enable agile oversight, freeing the full board to focus on strategic and reputational governance ☑️ Recovery and Remediation: Oversight Beyond the Crisis. - The “long tail” of cyber risk extends months or years beyond the initial event. Boards play a central role in ensuring: - Root-cause analysis is independently reviewed and acted upon. - Remediation programs are well-resourced, customer-focused, and transparent. - Employee wellbeing is prioritised, fatigue and moral strain are common post-incident. - Regulatory investigations, compensation, and class actions are managed with integrity and accountability. - Lessons learned are embedded into the organisation’s cyber governance and shared responsibly with peers to strengthen the wider ecosystem. Boards that treat cyber resilience as part of enterprise risk management, rather than an IT line item will be the ones that navigate crises with credibility and protect stakeholder trust. Read the full report here: https://lnkd.in/eRfjqsUc

11

Cyber risk is now a board issue, not an IT problem. When something goes wrong, it’s no longer the security team answering questions. It’s the board. It’s executives. It’s reputations, disclosure, and accountability on the line. Regulators now expect this. ASIC, APRA, and the OAIC have made it clear that boards are responsible for cyber oversight, not just funding tools, but actively understanding risk. Yet many boards still receive cyber updates as technical briefings, not risk briefings. Tick box exercises listing patch levels, tool deployments, and incident counts. Useful, but not strategic. What boards actually need is situational awareness. A clear view of the current risk posture of the business, what’s exposed, what’s protected, and where the real weaknesses sit today. Then comes impact. What would a breach cost? Which operations would stop? How long would recovery take? Who would be held responsible? Good governance isn’t about knowing the tools, it’s about understanding the very real consequences. That’s why cyber maturity starts when boards stop simply asking “Are we secure?” and start asking “What do we actually look like right now, and what happens if we’re not?” If you want a short insight on how boards should be framing cyber risk today, comment or DM me. No jargon. Just leadership perspective.

7

📢 New Report Released: Cyber Security Priorities for Boards (2025–26)   The Australian Cyber Security Centre has published its latest guidance for directors here https://lnkd.in/gHMPdEVX   Key themes:   ✅ Secure by Design ✅ Legacy IT Risk Management ✅ Quantum-Ready Cryptography   I've create a report on how to align these priorities using Microsoft 365 Business Premium. If you want a free copy of the report just reply here.

4

1 Comment