Cyber Security Weekly Podcast

As Russia commences military operations in Ukraine, we speak with Associate Professor Alexey Muraviev, National Security & Strategic Studies from Curtin University in Perth. Dr Muraviev discusses why Russia feels “so confident” with its Ukraine deliberations, given its new partnership arrangements with China, and why China “must walk a fine line”: “Perhaps the most powerful draw card in Putin’s back pocket is China. While Russia and China have been growing closer in recent years, a summit between Putin and Chinese President Xi Jinping at the start of the Olympics sent alarm bells ringing in Western countries”. Alexey research interests focus on problems of maritime security (modern naval power, maritime terrorism), Russia’s strategic and defence policy and military modernisation, Russia as a Pacific power, alliances in the Asia-Pacific, regional balance of power, Australian national security and defence, contemporary terrorism, future wars, and other. Recorded 4:00pm AEDT, Thursday 24 February 2022. To watch the MySec.TV version visit https://mysecuritymarketplace.com/av-media/chinas-support-for-russia-how-far-does-it-go/ (https://mysecuritymarketplace.com/av-media/chinas-support-for-russia-how-far-does-it-go/) Further reading https://theconversation.com/why-vladimir-putin-is-so-confident-in-his-ukraine-strategy-he-has-a-trump-card-in-china-177534 (https://theconversation.com/why-vladimir-putin-is-so-confident-in-his-ukraine-strategy-he-has-a-trump-card-in-china-177534)#mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv) #russiaukraine (https://www.youtube.com/hashtag/russiaukraine) #war (https://www.youtube.com/hashtag/war) #china (https://www.youtube.com/hashtag/china) #aukus (https://www.youtube.com/hashtag/aukus) #quad (https://www.youtube.com/hashtag/quad) #india (https://www.youtube.com/hashtag/india)

The Australian Department of Home Affairs is in the process of overhauling Australia's electronic surveillance framework. We speak with Dr William Stoltz following a public submission authored by Dr. Dominique Dalla-Pozza of the ANU College of Law and Dr. William A. Stoltz of the ANU National Security College and informed by an ANU CoL-NSC Joint Dialogue held in December 2021 during which a number of scholars from across the ANU. To read the submission visit https://law.anu.edu.au/sites/all/files/public_submission_-_electronic_surveillance_reform_-_anu_college_of_law_and_national_security_college_11.02.22.pdf (https://law.anu.edu.au/sites/all/files/public_submission_-_electronic_surveillance_reform_-_anu_college_of_law_and_national_security_college_11.02.22.pdf) This follows our interview with Dr Nick Tate, President of the Australian Computer Society - available here https://youtu.be/t_QDUhWoVYA (https://www.youtube.com/watch?v=t_QDUhWoVYA&t=0s)

We speak with Dr Nick Tate, President of the Australian Computer Society (ACS). Nick is also President of the South-East Asia Regional Computer Confederation (SEARCC) and an Adjunct Professor of IT and Electrical Engineering at the University of Queensland.The ACS has recommended the Australian Government change the way electronic surveillance is performed by the nation’s law enforcement agencies.In a written response to the Department of Home Affairs’ Reform of Australia’s electronic surveillance framework Discussion Paper last week, ACS called on the government to stop ‘deputising’ IT professionals and technology companies.This follows ACS’ objection to the 2018 Assistance and Access Bill requiring Australian IT companies and professionals to secretly assist in cracking electronic protections when called upon to do so by agencies.To read more visit https://australiansecuritymagazine.com.au/call-out-to-stop-deputising-tech-companies/To view the MySec.TV version visit https://mysecuritymarketplace.com/av-media/call-out-to-stop-deputising-tech-companies/

Interview with Dr Gay Jane P. Perez, Deputy Director General for Space Science and Technology (DDG-SST), Republic of the Philippines - Office of the President - Philippine Space Agency.Dr. Perez serves as the Deputy Director General for Space Science and Technology (DDG-SST) at the Philippine Space Agency (PhilSA). She is also a Professor at the Institute of Environmental Science and Meteorology of the University of the Philippines Diliman.She was a postdoctoral fellow at the NASA Goddard Space Flight Center (2010-2011). She is a graduate of the National Institute of Physics at the University of the Philippines Diliman, from which she received Bachelor of Science in Applied Physics (2003), Master of Science (2005), and Doctor of Philosophy in Physics (2009).Dr. Perez has led various programs on satellite development in the Philippines as well as other projects that utilized satellite and remotely sensed data for environmental applications and climate studies.Dr. Perez is a recipient of The Outstanding Women in the Nation's Service (TOWNS) Award (2019) and is the first Filipino woman to receive the ASEAN-US Science Prize for Women (2018).Her research interests include Earth observation satellite product development, drought monitoring and forecasting, forest change detection, land cover/land use change, other satellite remote sensing applications for the environment, seasonal and climate prediction, climate change and variability, complex systems, and interdisciplinary applications of Physics.In this podcast, Dr Perez shared the latest developments at the Philippine Space Agency, and some of the highlights she presented at GSTC 2022 (Global Science and Technology Conference 2022). She touched on the efforts to build the downstream Space Technology infrastructure, including the challenges to ingest the immense volume of data gathered from satellites, and turned them into meaningful insights in applications ranging from hazard management to drought management.Dr Perez also gave the listeners a glimpse into the evolution of the Philippine upstream activities, including the launch of the first Philippine satellite Diwata 1 in 2016, to today’s development of CubeSat(s) for research.Wrapping up the podcast, Dr Perez pointed to the importance of capacity building and international partnerships, echoing the words of many in this fast growing sector: “if you want to run fast, do it alone; if you want to run far, we need to do it together.”Recorded 10th February 2022, Singapore/Philippines Standard Time 11am. Interview as part of the ASITII International Space Bridge Series 2022 - Register interest at www.asitti.space

New research from ISACA explores the latest trends in enterprise privacy—from privacy workforce and privacy by design to privacy challenges and the future of privacy—in its new Privacy in Practice 2022 survey report, sponsored by OneTrust. The report, which examines responses from the global ISACA State of Privacy survey conducted in the third quarter of 2021, highlights the persistent understaffing that is impacting enterprise privacy teams. Respondents indicate that both legal/compliance (46 percent of respondents) and technical privacy roles (55 percent of respondents) at enterprises are understaffed, and the issue has only worsened since last year. Forty-one percent also report that the biggest challenge in forming a privacy program is a lack of competent resources. We speak with Jo Stewart-Rattray, Information Security Advisory Group, ISACA and Safia Kazi, ISACA Privacy Professional Practice Advisor. Recorded 8 February 2022 #mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv) #privacy (https://www.youtube.com/hashtag/privacy) #cybersecurity (https://www.youtube.com/hashtag/cybersecurity) #compliance (https://www.youtube.com/hashtag/compliance) #isaca (https://www.youtube.com/hashtag/isaca)

We speak with Adam Denyer-Hampton, International Lead for the Pre-Sales Engineering team at SecurityScorecard. We discuss the key security metrics and the basis for developing a Security Strategy for the Board to Monitor. We also discuss what to measure or what can be measured, as well as real-time versus intermittent monitoring. Adam has 15 years of experience in successfully delivering large and complex IT security solutions for major global companies, across Europe and APAC, including the defence and government agencies. Prior to joining SecurityScorecard, Adam held key technical roles at companies such as SafeNet, SourceFire (part of Cisco Systems) and IT Security Experts, where he managed solution deployments and technical consultations/trainings to meet customer requirements and successfully onboard them to new solutions. For further information and insights, attend a special virtual event with MySecurity Media & SecurityScorecard on Thursday 10 February, 1:30pm SGT - Presenting the Cyber Security Strategy to the Board of Directors - Key Metrics | Third Party Risk | Cyber Insurance - REGISTER HERE https://www.eventbrite.com/e/presenting-the-cyber-security-strategy-to-the-board-of-directors-tickets-251046265137 (https://www.eventbrite.com/e/presenting-the-cyber-security-strategy-to-the-board-of-directors-tickets-251046265137)MySec.TV version visit https://mysecuritymarketplace.com/av-media/key-security-metrics-measuring-monitoring-the-cybersecurity-strategy/ (https://mysecuritymarketplace.com/av-media/key-security-metrics-measuring-monitoring-the-cybersecurity-strategy/) #cybersecurity (https://www.youtube.com/hashtag/cybersecurity) #securityscorecard (https://www.youtube.com/hashtag/securityscorecard) #securitymetrics (https://www.youtube.com/hashtag/securitymetrics) #cyberinsurance (https://www.youtube.com/hashtag/cyberinsurance)

Ransomware has captured the attention of many due to its far-reaching impacts on industrial control systems (ICS). Once a problem that only affected IT infrastructure, ransomware that now targets ICS / OT can significantly impact or even shut-down control processing, logistics, distribution, and delivery of critical goods. We speak with Dr. Tom Winston, Director of Intelligence with Dragos Inc, based in Virginia. Dr. Winston is a Cyber Security subject matter expert focused on threats to critical infrastructure (ICS/SCADA) systems, as well as foreign cyber threat intelligence and threat analysis. Tom has extensive public and private sector experience in IT/OT threat environments to include hunting, detection engineering and reverse engineering. Tom has extensive experience in mobile devices, removable/fixed media digital forensics. Tom is also a seasoned manager of people, technology, projects, and programs. Multilingual, and with extensive experience in international relations, intelligence, and foreign policy analysis. Dr Winston has extensive private and public sector experience in IT/OT threat environments to include hunting, detection engineering and reverse engineering. Formerly, a highly sought after and award-winning professor Dr Winston was an undergraduate and graduate student advocate and champion; student success is critical - not just in school, but after graduation as well. He built cyber security engineers one student at a time and continues to assist them even well past their graduation by providing career and other professional guidance.Recorded 18 January 2022 courtesy of Dragos.To view the video version visit https://mysecuritymarketplace.com/av-media/assessing-risk-in-ics-environments/Further readingBlog post – Tom WinstonAssessing Ransomware Risk in IT and OT Environmentshttps://www.dragos.com/blog/industry-news/assessing-ransomware-risk-in-it-and-ot-environments/ (https://www.dragos.com/blog/industry-news/assessing-ransomware-risk-in-it-and-ot-environments/)Blog post – DragosAssessment of Ransomware Event at US Pipeline Operatorhttps://www.dragos.com/blog/industry-news/assessment-of-ransomware-event-at-u-s-pipeline-operator/ (https://www.dragos.com/blog/industry-news/assessment-of-ransomware-event-at-u-s-pipeline-operator/)Blog post – Sergio CaltagironeRecent Ransomware Attacks against Governments and Critical Infrastructurehttps://www.dragos.com/blog/industry-news/recent-ransomware-attacks-against-governments-and-critical-infrastructure/ (https://www.dragos.com/blog/industry-news/recent-ransomware-attacks-against-governments-and-critical-infrastructure/)Webinar recording – Tom WinstonProtect your ICS environments from Ransomware with Risk Assessmentshttps://www.dragos.com/resource/protect-your-ics-environment-from-ransomware/ (https://www.dragos.com/resource/protect-your-ics-environment-from-ransomware/)#ICS #OTcybersecurity #cybersecurity #insiderthreat

Joseph Weiss (www.controlglobal.com/unfettered (http://www.controlglobal.com/unfettered)) is an industry expert on control systems and electronic security of control systems, with more than 40 years of experience in the energy industry. Mr. Weiss spent more than 14 years at the Electric Power Research Institute (EPRI), the first 5 years managing the Nuclear Instrumentation and Diagnostics Program. He was responsible for developing many utility industry security primers and implementation guidelines.In this podcast, he shares his insights on Industrial Control System risks, from an engineer’s perspective.  By highlighting differences in concepts (such as Purdue versus OSI, Zero trust versus 100 percent trust), he explains how a control engineer’s focus on actual devices (such as sensors) is critical to safely managing control system risks. For example, while data sent from devices could be manipulated by malicious actions such as hacking, there are other threats that are yet to of focus in cybersecurity discussions. These include deliberately compromised hardware at source and hardware “drift”.  He urges the need for a paradigm shift from “cyber physical” to “physical cyber” in managing control system risks, where attention is to be paid to physical risks, supported by cyber risk management. This is what he calls “go back to the future”, to manage control system risks by engineers monitoring process anomalies, of which network is part. Mr. Weiss serves as a member of numerous organizations related to control system security. He is also an invited speaker at many industry and vendor user group security conferences, has chaired numerous panel sessions on control system security, and is often quoted throughout the industry. He has published over 80 papers on instrumentation, controls, and diagnostics including chapters on cyber security for Electric Power Substations Engineering and Securing Water and Wastewater Systems. He coauthored Cyber Security Policy Guidebook and authored Protecting Industrial Control Systems from Electronic Threats. In February 2016, Mr. Weiss gave the keynote to the National Academy of Science, Engineering, and Medicine on control system cyber security. Mr. Weiss has conducted SCADA, substation, nuclear and fossil plant control system, and water systems vulnerability and risk assessments and conducted short courses on control system security. The risk assessments include utility-scale solar farms and wind turbines. He has amassed a database of almost 12 million actual control system cyber incidents. He was a member of Transportation Safety Board Committee on Cyber Security for Mass Transit. He was a subject matter expert to the International Atomic Energy Agency on nuclear plant control system cyber security. Mr. Weiss has received numerous industry awards, including the EPRI Presidents Award (2002) and is an ISA Fellow, Managing Director of ISA Fossil Plant Standards, ISA Nuclear Plant Standards, ISA Industrial Automation and Control System Security (ISA99), a Ponemon Institute Fellow, and an IEEE Senior Member. He has been identified as a Smart Grid Pioneer by Smart Grid Today. He is a Voting Member of the TC65 TAG and a US Expert to TC65 WG10, Security for industrial process measurement and control – network and system security and IEC TC45A Nuclear Plant Cyber Security. Mr. Weiss was featured in Richard Clarke and RP Eddy’s book- Warning – Finding Cassandras to Stop Catastrophes. He has patents on instrumentation, control systems, and OT networks.

Haventec, a Sydney-based award-wining cyber security company founded in 2015, has secured US$10M in capital and launched their expansion into the US market after tremendous demand for their passwordless authentication and data storage solutions. Macquarie Group and Future Now Capital led the raise which will predominantly fund Haventec’s growth plans in the financial services, government and health sectors handling sensitive data. We speak with CEO of Haventec David Maunsell who outlines the recent hires in the US and the strategy for the next couple of years as the company continues to grow and expand beyond Australian shores. Recorded 21 December 2022 for MySec.TVTo view the video version visit https://mysecuritymarketplace.com/av-media/aussie-cyber-security-innovation-secures-over-us10m-for-us-expansion-plans/ (https://mysecuritymarketplace.com/av-media/aussie-cyber-security-innovation-secures-over-us10m-for-us-expansion-plans/) #cybersecurity (https://www.youtube.com/hashtag/cybersecurity) #austcyber (https://www.youtube.com/hashtag/austcyber) #gameon (https://www.youtube.com/hashtag/gameon) #haventec (https://www.youtube.com/hashtag/haventec) #passwordless (https://www.youtube.com/hashtag/passwordless) #authentication (https://www.youtube.com/hashtag/authentication) #datastorage (https://www.youtube.com/hashtag/datastorage)

Jane Lo, Singapore Correspondent speaks with Kyoung-ju Kwak is a head of TALON, CTI Group of S2W. Kyoung-ju currently works on threat intelligence. He was previously Adjunct Professor at Sungkyunkwan University and audited the National SCADA system and the Ministry of Land with “the Board of Audit and Inspection of Korea” as an Auditor General in 2016. He currently acts as a member of the National Police Agency Cybercrime Advisory Committee. Kay is the main author of the threat intelligence report “Campaign Rifle: Andariel, the Maiden of Anguish”, published in 2017. In the report, he firstly attributed new threat actor, Andariel. He has spoken at various international conferences such as BlackHat Europe, BlackHat Asia, Kaspersky SAS, HITCON, PACSEC, and more. In this podcast, Kay provided insights on the cyber activities of North Korea, given his expertise in darkweb intelligence and experience in understanding the North Korea cyber threat landscape, and his firm’s (S2W) support to Interpol’s recent Operation Cyclone. He shared his views on how North Korea cyber activities under threat actor groups such as Lazarus and Andariel (APT39), compared to other nation state actors in terms of levels of sophistication (for examples, reconnaissance and social engineering) and attacking styles. Notwithstanding the challenges in attributions, he pointed to the extra care the cyber threat intelligence (CTI ) researchers exercised in publishing their work in reverse engineering and the risks of over disclosure. Given North Korea high profile cyber attacks and its evolution into an advanced threat actor, he also gave his thoughts on how the nation group gained their cyber skills and expertise over the years. Despite the relative decline of number of cyber incidents attributed to North Korea last year, and the successful efforts by Europol and Interpol, Kay cautioned cyber defenders against jumping too quickly to the conclusion of a slow-down in the cyber threat landscape of North Korea. Recorded 10th December 2021, Korea Standard Time (9am)/Singapore (8am).