Munya Mufambisi

#RiskManagement "Critical infrastructure (CI) continues to be a target for state-sponsored cyber actors, cybercriminals and hacktivists. This is due to the sensitive data CI organisations hold and its role in providing services that support Australia’s national resilience, sovereignty and prosperity. " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

3

1 Comment

Some key highlights from Australian Signals Directorate (ASD)'s Cyber Threat Report 2024–2025: 1. There is a significant rise in cyber incidents and reports: The Australian Cyber Security Centre (ACSC) reported that in during 2024-2025 they have responded to over 1,200 major cybersecurity incidents which is a 11% increase from the previous year. 2. There is a steep rise in the financial impact due to cybercrimes: For businesses, the average loss due to cybercrimes is on the rise, Small businesses lost up to $56,571 a 14% increase from last year, Medium business lost up to $97,166 a 55% increase, and Large businesses lost up to $202,691 a 221% increase. It was also reported that an individual average self reported loss was $36,633 3. Critical infrastructure under increasing threat: Critical infrastructures have received notifications of 190 potential malicious cyber activity impacting their network which is a 111$ increase from last year. The Top 3 most common types of activity which led to infrastructure related incidents were: Scanning or Reconnaissance making up 41% DoS/DDoS making up 31% Phishing making up 20% 4. Credential compromise, email attacks and phishing remain the main methods of attack: It was reported that email compromise with no direct financial loss accounted for ~19% of business reports, Business email compromise with financial loss ~15%, identity fraud ~ 11% and phishing emails remains one of the most common attack methods. 5. New technologies are amplifying the risk like AI The report also warns the rise in the use of Generative AI by cybercriminals as they use these tools to automate the analysis of extensive datasets which allows them to find vulnerabilities, they also use generative AI to create content like videos, text, fake voices, websites etc. to help them trick their target easier. 💡 The big moves organisations must take: a. Implement Effective event logging - You can't defend what you can't see b. Manage legacy IT risks - Legacy technology lets threats thrive c. Effective Third-Party Risk Management (TPRM) - Shut the back door, choose sercure and verifable technologies d. Start preparing for Post Quantum Cryptography (PQC) more details: https://lnkd.in/gCVf9fSq

7

For someone who has worked in the financial services sector across the Pacific including NZ, the managing of technology and cybersecurity risk exist on enterprise platforms. These platforms are not available for the small to medium businesses and even to government agencies due to the high cost. Excel has been the go to tool for risk registers and management of risk. Whilst other platforms targeting SMEs exist I felt a more tailored one for the Pacific was needed. So for the last few months maybe a year I've been putting together this light weight GRC tool called /thatsit risk with the help of Ai tools. It is now LIVE and ready. Feedback welcome. app.thatsitconsultants.com

15

1 Comment

📢 The Australian Signals Directorate has released CI Fortify. A new framework providing practical, high-level cybersecurity guidance to help critical infrastructure (CI) operators strengthen their operational technology (OT) resilience during crisis or disruption. 🧩 What it is CI Fortify sets out clear actions to ensure essential services can continue even under sustained cyberattack or system isolation. 🎯 Why it exists Australia’s Critical Infrastructure remains a prime target for both state-sponsored and criminal actors. These systems were never designed to endure today’s cyber threats, making proactive resilience a national priority. ⚙️ What it requires CI Fortify challenges operators to: 🔹 Isolate vital OT systems for up to 3 months while maintaining operations. 🔹 Rapidly rebuild those systems from trusted backups. Preparation steps include: 1. Maintaining a current OT asset inventory 2. Identifying vital systems critical to service continuity 3. Defining isolation points and manual contingency workflows Don't wait for a cyber incident to be the first time in verifying operational resilience. In my recent presentation 'Safeguarding water utilities: From Reliability to Resilience' 👉 "Confidence in resilience comes from experience. Test and verify your controls — assumptions are never assurance." 💪 Who's up for the CI Fortify Challenge?? For more information on CI Fortify can be found here: https://lnkd.in/gQ9Z9iQs https://lnkd.in/gknZfqCX #CyberSecurity #OperationalTechnology #CriticalInfrastructure #Resilience #ASD #CIFortify #Australia #EA #CyberEngineer

32