Duncan Hart

I saw messages circulating on the internal company chat last night —not about which organisation had been compromised, but about the sheer volume of data types exposed per individual in one breach. The number caused the discussion: 40 distinct #data types, the highest we’ve reported or we can recall. It wasn’t a health company but that would be a good contender, education, government, finance, or retail; none of those typically accumulate that breadth of data. Only one sector regularly holds everything of that scope, the legal sector. Legal firms often underestimate how attractive they are to attackers, yet they are prime targets. An interesting fact: multiple cybersecurity studies over the past few years have shown that law firms are among the top targets for coordinated attacks, not because of their technology, but because they act as concentrated data hubs—holding information on individuals, businesses, mergers, court cases, and financial transactions that hackers cannot easily obtain elsewhere. If you work in risk or HR and don’t recognise the strategic value this information holds for threat actors—whether for extortion, profiling, or long-term exploitation—you are in the wrong role. Effective risk mitigation requires acknowledging exactly how valuable this data is, and why breachaware operations continue to focus on organisations that handle it. The old saying “what the eye can’t see can’t harm you” doesn’t apply here—because while you may choose not to look, others already are perusing. Threat actors actively monitor newly exposed datasets, correlating and enriching them with information from previous breaches. Once this level of detail is in the open, the risk becomes long-term, persistent, and difficult to fully remediate, particularly if they are using AI tools to aggregate data. If BreachAware® improves your risk mitigation posture by even 1%, it is worth adopting—especially when measured against its return on investment and accessible price point. Check us out. (https://lnkd.in/eH-iMQjs) Scan your Law Firm, click here (https://lnkd.in/emzqwHQ) #protectyourprivacy

35

17 Comments

I’ve been thinking a lot about ALPR lately, and I’m genuinely conflicted. On paper, it’s hard to argue with the “no expectation of privacy in public” point. Plates are visible. Public roads are public. Police observation in public is not new. What bothers me isn’t the camera. It’s what happens after the scan. ALPR turns a moment-in-time sighting into a database. Searchable. Shareable. Often retained longer than most people assume. Over time, that becomes pattern-of-life data, routines, associations, and movement history. And here’s the part that really keeps me up at night: oversight is all over the place. One department might have strict written policy, tight access controls, regular audits, and a culture of “justify your searches.” The next agency over might have none of that, but still plugs into the same networks. So the governance is decentralized, but the data flow isn’t. That gap creates predictable problems: insider misuse (including stalking and personal searches) retention creep (data kept longer “just in case”) sharing without real agreements or auditing misreads treated like certainty instead of a lead security risk when credentials or systems get compromised I’m not arguing for a ban. I’m arguing for rules that match the power of the tool. If we’re going to use ALPR, it should come with guardrails: clear purpose limits, least-privilege access, mandatory logging and audits, defined retention, strict sharing rules, transparency reporting, and real consequences for misuse. Full article here: https://lnkd.in/g8aFbbyK

5

16 Comments

Recently we've been working closely with a UK defence organisation facing a common challenge: shadow IT in the cloud. Research teams had spun up their own services outside of central IT. On the surface, it gave them agility. In practice, it created compliance risks, duplicated costs, and weakened governance. Instead of shutting it all down, we worked with users and senior stakeholders to design a service-first strategy. The first step was delivering a Cloud Centre of Excellence MVP, a controlled way to bring one platform under governance, test compliance, and build confidence in the wider programme. It’s a good reminder that “shadow IT” is often a signal, not a failure. It shows where your governance isn’t meeting demand, and can be used as the starting point to a stronger strategy.

19

One part of the Moltbook story that’s easy to miss is who identified the security gaps. They weren’t found by AI. They were found by security researchers doing basic checks on configuration and access. In a world where we lean on AI for summaries, spelling and optimisation, it’s a reminder that risk is still spotted through experience and judgement. That’s essentially what frameworks like the NIST AI Risk Management Framework (AI RMF 1.0) are getting at when they talk about boundaries around AI systems. Not documentation for its own sake, but people, oversight, and checks that sit alongside fast-moving technology so issues can be noticed and corrected early. https://lnkd.in/gNDTgxAf #cybersecurity #AI #riskmanagement

4

Interestingly, most security folks I talk to don’t complain that their SIEM is too expensive. This is mildly surprising because no matter how much they’re paying, it’s typically a big line item for their organizations. But in general the feeling is “it’s critical infrastructure,” “it is what it is,” and even for the ones planning a SIEM migration, price isn’t typically the main driver. So what drives security folks’ SIEM frustration? In part I think it’s because the pricing *model*, not necessarily the price tag itself, is misaligned. I wrote earlier about how I’d love to see security value/ROI driving more conversations about onboarding new data sources. The main issue with the pricing models of SIEMs is that cost isn’t aligned to security value. If you want to onboard a new data source, you pay for processing and storage on the whole data source, not just the 15% that actually delivers security value. This changes every conversation about new data sources from “how do we use this to enhance our program?” to “how do we justify the expense?” which is inherently frustrating and adversarial.  So yes, SIEMs are critical infrastructure and no, they’re not going anywhere. And I think anything that helps align the pricing model with actual security value is a good thing for making sure the right conversations take place.

28

3 Comments

Not much time to get on this one - yet another super important area of security! Invest in your future with this Physical Pen Testing course.

1

The March update to the Australian Signals Directorate 's Information Security Manual is here. A new cyber security principle on ‘executive artificial intelligence accountability’ was added recommending that the board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner. [GOV-08] Download from here: https://lnkd.in/g5Ye4tJz

22

2 Comments