Cyber Security Weekly Podcast

Azul is the largest provider of commercial support for OpenJDK, supporting more versions of Java than any other vendor, including Oracle.

The University of Sydney has recently selected Azul as the institution’s sole Java provider, switching from Oracle Java. The announcement takes place amid major changes to Oracle Java pricing and a rapid increase in the adoption of OpenJDK-based Java runtimes. By some estimates, usage of Oracle Java has fallen from roughly 75 per cent in 2020 to 34 per cent in 2022.

We speak with Scott Sellers, President, CEO and Co-Founder of Azul, visitng Australia from the USA to meet with customers and partners.

With more than 30 years of successful leadership in building high technology companies and delivering advanced products to market, Scott provides the overall strategic leadership and visionary direction for Azul Systems. Scott has a consistent proven track record of vision, leadership, and success in enterprise, consumer and scientific markets.

Prior to co-founding Azul Systems, Scott founded 3dfx Interactive, a graphics processor company that pioneered the 3D graphics market for personal computers and game consoles. Scott served at 3dfx as Vice President of Engineering, CTO and as a member of the board of directors and delivered 7 award-winning products and developed 14 different graphics processors. After a successful initial public offering, 3dfx was later acquired by NVIDIA Corporation.

Prior to 3dfx, Scott was a CPU systems architect at Pellucid, later acquired by MediaVision. Before Pellucid, Scott was a member of the technical staff at Silicon Graphics where he designed high-performance workstations. Scott graduated from Princeton University with a bachelor of science, earning magna cum laude and Phi Beta Kappa honors. Scott has been granted 8 patents in high performance graphics and computing and is a regularly invited keynote speaker at industry conferences.

Read more - https://chiefit.me/university-of-sydney-boards-the-azul-train/

#azul #java #mysecuritytv

Jane Lo, Singapore Correspondent speaks with Dagmawi Mulugeta, Threat researcher with Netskope Threat Labs.

Dagmawi has his OSCP and has previously worked at Cyrisk (a subsidiary of 4A Security), Sift Security (acquired by Netskope), and ECFMG as a researcher, security engineer, and developer. He has innate interests in public CTFs, exploit development, and abuse of cloud apps.

He has his MSc in Cybersecurity from Drexel University.

In this interview, Dagmawi shared the behavioural insights found for employees preparing to leave, and how these indicators could enable organizations to protect their data more effectively.

He noted the concern that many organisations have with “flight risk” users – that is, employees that are getting ready to leave – taking corporate data with them.

A common question to address this concern, is how to efficiently identify such risks - without sifting through hundreds of alerts and spending hundreds of man-hours.

Dagmawi shared how they approached this problem by analysing anonymized data of over 4 million users from more than 200 different organizations worldwide., and some interesting key revelations:

(i) 15% of leavers used personal cloud apps (e.g. Google drive, Gmail) to take data with them

(ii) 2% were violating corporate policy (exfiltrating sensitive corporate information)

(iii) majority of the data movement happens 50 days before leaving.

Dagmawi highlighted how they identified three key signals to filter out alerts with potential flight risks:

a) volume – identifying whether the data being moved is anomalous for the individual in the organisation

b) nature of data – whether the data being moved is sensitive

c) direction – whether the cloud application is outside of the organisation’s management (e.g. google drive).

Wrapping up, Dagmawi recommended that encoding the three signals into the detection systems could help reduce the size for reviews by 43x – that is, for every 50 alerts, the signals could help to filter out the 1 or 2 concerning ones.

Recorded 11th May 2023, 3.30pm, Black Hat Asia 2023, Singapore Marina Bay Sands.

#bhasia

#mysecuritytv

#insiderthreat

We speak with Connell Perera, NEC Australia Cyber Security Portfolio Manager.

NEC Australia offers a comprehensive range of assessments and managed security services to provide businesses and government departments with peace of mind.

NEC Security is focussed on rapidly reducing your risk with a threat focused defence, maximising your security investment through automation and machine learning, and reducing your threat landscape by applying global expertise executed by local experts.

Founded on a Zero Trust mindset, NEC Security, with our global partners, continually apply our intelligence to grow your cyber security competency and to build your confidence as a security decision-maker, backed by a complete cyber security defence underpinned by the best people, intelligence, and technology.

Protecting your assets, increasing the return on your security investment and effort all whilst reducing your risk is our trusted NEC Security approach.

To find out more visit https://www.nec.com.au/solutions/cyber-security

#necsecurity

#nec

#mysecuritytv

We speak with Dr Daniel Floreani, Principal Consultant and Director of CyberOps, a security and blockchain consultancy.

Some of Daniel's achievements during 25+ years of experience in the communications industry, in very diverse roles include:

- A PhD in communications and experience in the fundamental concepts of Networking and Defence communications.

- Experience in very large Defence projects and complex engineering environments.

- Exposure to Business Development and Market Creation activities in Space and Internet of Things domains

The Agora High-Tech with support by CyberOps and Flinders University Present is holding the First Australian Cyber Space Forum, Tuesday 10 October 2023.

The Australian Space Cyber Forum will provide an excellent opportunity for Australian stakeholders to meet and network with key national and international space cyber experts. Participation in this forum is targeted at researchers, entrepreneurs, academics, private consultants, public employers, and others with an interest in the space and cyber sectors.

The first national edition of the Space Cyber Forum will contain a welcome introduction followed by international speakers such as Prof. Olaf Maennel from Tallinn University of Technology in Estonia, Ms. Clemence Poirer and Mr. Marco Alberti from the European Space Policy Institute in Vienna, and more to come, followed by three specific panels. Each panel will include a discussion on approaches to solving real world issues to help organisations understand what the risks are and how to start to mitigate them, now and into the future.

· Panel 1 – ‘Space Cyber – The increasing use of cyber-attacks in the space domain’,

· Panel 2 – ‘Cyberspace and Outer Space: between regulation and militarisation’,

· Panel 3 – ‘Quantum in Space and its Security Impacts’,

Registration Link: https://lnkd.in/gNkAW7et

#auspaceforum

#australiainspacetv

Michael Vrettos is a senior Marine Cyber Security Expert for RINA Classification Society in Piraeus. 

He is responsible for Marine Cyber Security Services and represents RINA in IACS and EMSA related activities.* (* IACS – International Association of Classification Societies, EMSA – European Maritime Safety Agency)

His past experience includes working for the EU, NATO & the Defense sector. Among other things, he’s been involved in developing a Network Security Operations Center and projects on Cyber Technologies for the European Defense Agency, European Space Agency, EU & NATO.

In this interview, Michael gave an introduction to the Maritime sector, and the stakeholders in the industry who are involved in setting the cybersecurity policy and technical standards (for example, IMO (International Maritime Organisation) and IACS (International Association of Classification Societies). 

He gave a glimpse into how digitalisation in shipping with applications for route optimization, fleet performance and engine automation, (to name a few) driven by increased connectivity and bandwidth along with innovations in satellite technologies, have transformed the sector, with implications for cybersecurity. Hence, in some ways, the ship is increasingly becoming part of an overall “IoT” network. 

Whilst the NotPetya incident that disrupted the sector in 2017 was an important lesson, Michael also noted the additional complexity of cyber defenses due to “Operational Technology” onboard ships using sensors, PLCs (programmable logic controllers), and various software to control ships systems such as bridge, ballast, engine, navigation, etc.

For example, the “always-on” mode means that systems cannot be easily scheduled for patching or for pen-testing in order to avoid an inadvertent disruption. 

Besides basic cyber hygiene and standard cyber protection at network level, Michael also noted other vessels important systems such as the AIS (automatic identification systems) and ECDIS (Electronic Chart Display and Information System) operating with proprietary software thus making difficult to install typical cyber security measures such as antivirus or antimalware. 

Wrapping up, Michael shares his views on the digital evolution and emerging cyber threats, such as those introduced by AI (artificial intelligence), and the importance of not only utilizing the benefits of technology but also investing in cyber security considering the potential risks.

Recorded 25th April 2023, 10.30am, Marina Bay Sands Singapore, Singapore Maritime Week 2023.

Ong Chin Beng is the Chief Information Security Officer at MPA (Maritime Port Authority, Singapore). Prior to this, Chin Beng overseen cybersecurity across the transport sector at the Ministry of Transport. Chin Beng graduated from Mechanical Engineering at the National University of Singapore and Cybersecurity and Management at the University of Warwick.

In this interview, Chin Beng introduced the responsibilities and roles that Maritime Port Authority, Singapore (MPA) undertakes as well as the stakeholders that MPA collaborates with to develop and grow the maritime domain and Port of Singapore.

He also gave a glimpse into the rapid pace of digitalisation in the maritime sector and the benefits to improving supply chain efficiency, vessel performance, uplifting the welfare of seafarers, and aids to progression of decarbonisation goals.

As part of the designated 11 Critical Information Infrastructure under the 2018 Singapore Cybersecurity Act, Chin Beng elaborated on some of the initiatives taken by the maritime sector to respond to the regulations, support the risk management of critical information infrastructure of MPA and port operators, and enhance cyber resilience and readiness. 

One example is “Exercise CyberMaritime”, which saw MPA, holding an inaugural sector-wide maritime cybersecurity exercise to put to test, the sector’s coordination on cybersecurity incident management, emergency response plans, and crisis communications – in events such as a ransomware.

Another is the establishment of “PACC-Net” (Port Authorities CIO Cybersecurity Network), a global network that involves 11 port authorities collaborating on maritime cybersecurity to facilitate early sharing of cyber threat information, such as rules of engagement and TLP (traffic light protocol).

Chin Beng also pointed out that MPA will establish the Maritime Cyber Assurance and Operations Centre (“MCAOC” - an expansion of the Maritime Cyber Operations Centre (“MSOC”) by 2025, to progressively raise cyber resilience of onshore information systems, vessel and offshore operational technology, through collaboration among industry players, research community and firms to undertake joint development projects.

Wrapping up, Chin Beng emphasized the importance of development skills and retaining talent, and shared initiatives on growing the talent pool through work with higher institutes of learning (HIL), as well as bridging the gap between “OT” and “ICT” specialists.

Recorded 27th April 2.30pm, Marina Bay Sands Singapore, Singapore Maritime Week 2023.

Interview with Errol Weiss, Chief Security Officer, Health Information Sharing & Analysis Center (H-ISAC).

Errol has over 25 years of experience in Information Security. He began his career with NSA conducting vulnerability analyses and penetrations of highly classified US Government systems and then spent ten years with consulting firms delivering information security services such as Managed Security Services, Security Product Implementations and Secure Network Designs for Fortune-100 companies.

In 1999, Errol was a key member of the team responsible for the creation, implementation and operation of the Financial Services ISAC. He’s one of the four named inventors on the patent for Trusted and Anonymous Information Sharing.

Errol was with Citigroup from 2006 to 2016 where he created and ran the Cyber Intelligence Center, a global organization that provided actionable intelligence to thousands of end-users across the entire enterprise. From 2016 to 2019, Errol was a Senior Vice President with Bank of America’s Global Information Security team where he ran the global Cyber Threat Intelligence team. During his time with Citi and Bank of America, Errol was an active user of FS-ISAC. He served on the FS-ISAC board of directors for six years, was on the FS-ISAC Threat Intelligence Committee for 10 years and volunteered on several industry committees.

Errol has a M.S. in Technical Management from Johns Hopkins University and a B.S. in Computer Engineering from Bucknell University.

In this interview, held a day after the conclusion of the inaugural APAC Health-ISAC Summit held in Singapore, Errol shared his insights on APAC cyber threats and defenses in the health sector.

Highlighting the Health-ISAC Executive Summary Annual Threat Report 2023 “Current and Emerging Healthcare Cyber Threat Landscape”, Errol also noted the evolution of ransomware threat actors and motivations, since the 2016 WannaCry ransomware that hit the U.K. Health sector with significant impacts. 

He also shared his perspectives on the changing cybersecurity landscape, including cyber defense postures, the level of awareness at the board level, and regulations such as mandatory breach reporting, over the last decade.

Errol also touched on the increased sophistication of social engineering threats potentially posed by ChatGPT, flagged as a concern at the summit.

Errol wrapped up the interview with a short introduction to Health-ISAC (Information Sharing and Analysis Centre), and the membership scope and services.

Recorded 10am, 24th March 2023, Resort World Sentosa Singapore.

More information on www.h-isac.org

The WA Cyber Security Innovation Hub is excited to be delivering the second CyberWest Summit, 10-11 May, 2023 at the Pan Pacific, Perth WA. CyberWest Summit is WA’s flagship event providing cyber security education and awareness to key sectors and highlighting WA cyber security capabilities.

The conference will deliver three content streams: Critical Infrastructure & Supply Chain Cyber Uplift, Securing Local & State Government, and Cyber Skills & Education ​Pathways.

Troy Hunt, a world leading security researcher and commentator, will deliver a top-rated keynote on security and other technology concepts from around the world.

We speak with Cecily Rawlinson, Director of the Cyber Security Innovation Hub.

For more information visit

https://www.cyberwestsummit.com.au/

https://haveibeenpwned.com/

https://www.troyhunt.com/

#haveIbeenpwned #troyhunt #cyberwest2023 #cyberwestsummit2023

Jane Lo, Singapore Correspondent speaks with Mark ter Hove, Senior Manager, UAV &UTM, Inmarsat Aviation at Geo Connect Asia (GCA) 2023.

Over a period of 28 years, Mark has worked across Commercial, Military, Business and AAM/UAM Aviation segments as well as with the world’s largest OEM’s (Airbus, Boeing, Cobham, etc) and national governments.

Mark is considered a 'Connected Aviation' industry SME in addition to understanding how to connect the dots between navigational and operational industry solutions.

Today, Mark shapes and drives the Advanced, Innovative and Urban Air Mobility market(s). Bringing together innovators, regulators, and industry whereby through the introduction of new technologies will bring positive change to global communities.

In this interview, Mark shares the latest in UAVs (uncrewed aviation vehicles) and its role in developing the next era in aviation known as Aviation 2.0.

Mark notes the diversity of use cases in Aviation 2.0, compared to “legacy” aviation which traditionally focused on transportation of passengers and cargo. Aviation 2.0 on the other hand, is driving use cases ranging from uncrewed transportation aircrafts to drones from inspection and surveillance, and delivery.

Mark also highlights key technological requirements to power Aviation 2.0, including weight considerations of satellite communication terminals and reliability of communication links.

He also notes that contrary to most perceptions, when it comes to security and safety of UAVs, much still needs to be done to address privacy concerns.

On the topic of urban mobility, Mark predicts that we will see the reality of air taxis in 5 to 6 years.

Recorded 16th March 2023, 9am SGT, Marina Bay Sands, at the third edition of Southeast Asia’s flagship geospatial and location intelligence conference Geo Connect Asia (GCA) 2023 and the co-located inaugural edition of Drones Asia, a platform designed to capture the commercial demand for aerial, unmanned and ground-based solutions amid the region’s expanding UAV ecosystem.

#uav #airmobility #utm #uncrewedflight #drones #dronetechnology #australiainspacetv