Joe Antic

Busy day at BSides Canberra today with a keynote from a prominent bug bounty hunter, followed by an intro to CTF (maybe a little too introductory) and two exploitation talks. The first exploit talk focused on buffer overflows and illustrating how exploitation has changed over the years and what AI models do well (and what they don't). The second was a joint talk balancing a breakdown of Adobe Experience Manager's (AEM) components and its associated SSRF, XXE and other vulnerabilities. After briefly catching up with former colleagues for lunch and collecting some BSides swag, there was a great talk on threat actor identification, various tools like MISP, THAICERT and Malediction, and how these dwarf the threat actor intelligence publicly available from sources such as MITRE and Microsoft Threat Intelligence Centre (MSTIC). It was also good to hear about vendors like Crowdstrike and Microsoft teaming up to unmuddy these waters, as topics like this don't always make the headline news. I formally wrapped up the day briefly attending a Red Hat focused talk on detecting and preventing exposure of secrets, followed by a talk on how to present bug bounty findings. I decided to call it there and am spending a bit of time this evening reviewing last year's CTF to prep for some of tomorrow's CTF challenges in crypto, reverse engineering, and web (pwn) among others.

4

How PSPF, ISM, Essential Eight and IRAP Shape Azure Solution Design (Australia) In Australian regulated cloud environments, four terms come up often: PSPF, ISM, Essential Eight, and IRAP A simple way to remember them: PSPF = broad government security policy ISM = detailed cyber security controls Essential Eight = top-priority technical baseline IRAP = independent assessment against those requirements Here is how I think about them in Azure solution design: PSPF: This is the big-picture security lens. Example: before storing sensitive data in Azure, confirm its classification, residency, access model, and governance obligations. Ask: Does this design meet broader government security and information-handling obligations? ISM: This is where detailed security controls come in. Example: design Azure workloads with private access, segmentation, logging, monitoring, encryption, and strong privileged access controls. Ask: Have I implemented the right security controls in the Azure architecture? Essential Eight: This is the practical baseline. Example: use MFA, separate admin accounts, and PIM instead of permanent privileged access. Ask: Have I built the practical baseline protections into admin, endpoints, and user access? IRAP: This is about independent assessment and evidence. Example: design Azure environments with strong documentation, policy evidence, logs, and clear control mapping from the start. Ask: Can this Azure design be independently assessed and evidenced? For anyone working in Azure cloud, security architecture, or government projects (especially in Australia), understanding the relationship between these four is very important. They are not just compliance terms. They directly influence how we design secure, supportable, and defensible cloud solutions. #CyberSecurity #Azure #CloudSecurity #IRAP #ISM #PSPF #EssentialEight

10

A new active exploit targeting Microsoft SharePoint’s ToolShell has been confirmed. If your school or agency uses SharePoint, flag this to your IT team for immediate review—it's a critical reminder of why proactive threat detection and patching matter https://hubs.la/Q03DgdhY0

1

National Cyber Security Centre of New Zealand just released the Cyber Threat Report for 2025-https://lnkd.in/gUNijapF they identif y 5 key Judgements 1) State-sponsored actors are actively targeting New Zealand - https://lnkd.in/gBSe3PDG 2) The commercialisation of cybercrime means cybercriminals have more tools - https://lnkd.in/gmTbZEci 3) Hacktivists are targeting New Zealand organisations as global conflicts escalate. - https://lnkd.in/gU-RGVup 4) Threat actors are exploiting supply chains, hidden dependencies, and organisational blind spots to cause impact. - https://lnkd.in/g7pX4GSD 5) Known weaknesses and unpatched vulnerabilities are providing threat actors with easy access. - https://lnkd.in/gGr5UBFz

19

🧭 Identity risk grows quietly when access reviews slip. ASD guidance continues to highlight privilege creep and weak identity governance as key contributors to incidents. You don't need perfect IAM tooling to start. You need: ✔ MFA everywhere ✔ regular access reviews ✔ removal of shared accounts That's access discipline. Source: Australian Signals Directorate — Annual Cyber Threat Report 2024–25 https://lnkd.in/ggFg_BYu #IdentityGovernance #AccessManagement #IncightInsights #Hospitals #Schools #AgedCare #OperationalResilience #ASDReport

2

Critical Alert: Australian Threat Landscape Update (23 Dec 2025) The last 24 hours have been pivotal for Australian cyber defenders. We are tracking a new maximum-severity vulnerability, "React2Shell" (CVSS 10.0), which is actively being weaponized by state-sponsored actors to target React and Next.js environments. This poses an immediate risk to the SaaS and FinTech sectors. Beyond this technical crisis, our latest intelligence briefing covers significant escalations in other key sectors: - Healthcare: Major ransomware activity targeting fertility services provider Genea. - Education: A significant data breach at the University of Sydney stemming from DevSecOps failures. - Supply Chain: Critical vulnerabilities in n8n workflow automation and WooCommerce APIs. SaaS providers, healthcare organizations, and educational institutions must move quickly to patch systems and review data sanitization protocols. For the full technical breakdown, mitigation strategies, and indicators of compromise, please read the full article on the Lean Security website. https://lnkd.in/gteCkJwD #CyberSecurity #InfoSec #Australia #CISO #ThreatIntel

2

1 Comment

AI is advancing, so it's crucial to leverage our knowledge of cybersecurity and AI to develop the best solution. The Cybersecurity Team must partner with the Executive Team to make this transformation successful. AI is no different than other types of technology when it comes to basic needs like infrastructure, Cloud, and energy. The same cybersecurity controls listed in ISO/IEC 27001 ISMS can be applied to ISO/IEC 41001 AIMS without any issues. AI will increase risks, so due diligence is necessary, beginning with Cybersecurity AI Architecture. I will share a side-by-side comparison of ISO/IEC 27001 ISMS and ISO/IEC 41001 AIMS to help your learning curve.

17

1 Comment

IT CYBER SECURITY : SKILLS SHORTAGE MYTH 214 applications sent. Still zero interviews. Recruiters say “urgent demand”—but profiles vanish silently. Then feedback hits: “Not aligned with Australian security frameworks.” Saw this last week — 6 years experience, still filtered out. STAT: 67% of Cyber Security applicants fail ACS due to missing ISO 27001 & local framework mapping. BRIDGE (24–48 HRS): Map 2 projects to ISO 27001 controls (Annex A) Add 1 incident response case (threat → action → outcome) Show tools: SIEM (Splunk), firewall, risk assessment Align tasks with ANZSCO 262112 QUESTION: Which part is hardest to prove — tools, frameworks, or real incident experience? For daily 482 job alerts, updates, and community support, you may also  📱 Join our WhatsApp group here: [https://lnkd.in/gzMCNbxw] For regular updates on 482 sponsorship jobs, skills assessments, and migration insights, follow Ruby Malik| Sachin K. | 482 Sponsorship Jobs In Australia | Skills Assessment School Australia | What To Study for PR Pathway (Australia). We do not sell jobs, sponsorships, or guaranteed migration outcomes. We are not a recruitment agency. Migration advice is provided only by a MARA-registered migration agent under a formal agreement. All decisions remain with employers and relevant authorities. #482Cyber #AussieTech #ANZSCO262112

21

2 Comments