Cyber Security Weekly Podcast

Interview by Jane Lo, Singapore Correspondent with Lim Thian Chin (Director, Critical Info Infrastructure Division, Cyber Security Agency of Singapore) Thian Chin is leading the Critical Information Infrastructure (CII) Division at the Cyber Security Agency of Singapore (CSA). The division is responsible for building the cyber resilience of the Nation’s essential services across 11 CII sectors covering government, utilities, transport and services clusters. His team works with sectoral regulators to strengthen the cyber resilience of CII owners, to promote confidence-building measures and to deepen the public-private partnership between the government and CII stakeholders. Thian Chin also represents Singapore in International and regional cybersecurity forums where he shares his knowledge on cybersecurity resiliency and capability building. Thian Chin has over 19 years of experience in Information & Technology governance, risk management, resilience and compliance, and Operational Technology cybersecurity. Prior to joining CSA in August 2015, he was responsible for the regional Technology Governance function in United Overseas Bank. He also led the Technology Risk function in GIC from 2008 – 2013. In his earlier years, he was a Manager and had led a team of auditors in Information Technology in Ernst & Young. Thian Chin holds an Executive Masters (Cybersecurity) with Brown University, a bachelor’s degree in Computer Engineering from Nanyang Technological University and is an alumnus of the George C Marshall European Center for Security Studies. He is certified as a GICSP, CGEIT, CDPSE, CRISC, CISM, CISSP, CISA, and SABSA practitioner. In this podcast, Thian Chin shared some highlights* on cybersecurity and operational technology (OT) at the Singapore International Cyber Week (SICW 2021), and the OT Cybersecurity Expert Panel (OTCEP), organized by the Cyber Security Agency of Singapore. Touching on cybersecurity incidents highlighted in the “Singapore Cyber Landscape 2020” such as ransomware and supply chain, he noted the increasing complexity of the threat landscape. He discussed some common perceptions of the cybersecurity professionals and the engineers running the operating infrastructure, including infrastructure “air gap” and cultural differences such as skills and language, and security goals (“CIA” - versus “SRP”). Referring to one of Singapore’s largest cyber incidents in the CII sector, and the recent threats, he shared perspectives on how government policies such as the OT-ISAC, the OT Cybersecurity Code of Practice (updated in 2019) and the Cybersecurity Competency Framework (2021) help to boost cyber defenses. With the recent release of the “Singapore Cyber Security Strategy 2021”, he also several areas of focus for the CII cybersecurity ecosystem, including structuring an approach to managing supply chain risks and building cyber resiliency profiles. *also included highlights from OT-ISAC (Operational Technology Information Sharing and Analysis Centre) and ISACA Singapore Chapter Recorded: 15th October 2021 (SGT 8.30am)

Today we're joined by Cybersecurity Advisors Network (CyAN) International Vice President and Zero Day Legislative Project leader, Peter Coroneos. CyAN is a Paris-based global not-for-profit association representing cybersecurity professionals in 22 countries. They have announced the formation of a global partnership to secure legal protections for good faith (bona fide) zero day researchers. READ MORE: https://cyberriskleaders.com/global-coalition-builds-to-protect-cyber-researchers/ (https://cyberriskleaders.com/global-coalition-builds-to-protect-cyber-researchers/)The OECD* recognised the need for action in their 2021 guidance for policy makers observing: In many countries, researchers face significant legal risk when reporting vulnerabilities to vulnerability owners. Vulnerability owners can threaten researchers with legal proceedings instead of welcoming their vulnerability reports. This legal risk, aggravated when stakeholders are located across borders, creates powerful disincentives [for responsible disclosure]. * Source: https://www.oecd-ilibrary.org/docserver/0e2615ba-en.pdfThanks for tuning in and stay tuned for more... #mysecuritytv #whitehat #zeroday #cybersecurity #cybercrime #cyanRecorded Tuesday 19 October 2021 – video version is available here https://youtu.be/etf3MtxvK1c (https://youtu.be/etf3MtxvK1c)

ClearSale’s statistical technology and in-house fraud analysts have combined to create card-not-present (CNP) fraud prevention that reduces chargebacks and false positives. As the pandemic shifted consumers in many regions from in-store to online shopping and fraud attacks on ecommerce merchants increased, ClearSale’s 2020 net revenue grew by 65.7%, compared to 2019 growth of 35.5%. ClearSale has announced its July 30 initial public offering on Brazil’s B3 stock exchange generated the equivalent of US$254 million (R$1.3 billion) following the company’s historic revenue growth in 2020. The company’s 2020 net international revenue grew by 132.7% to comprise 11% of the total. Account takeover (ATO) fraud is big business for criminals, and it’s on the rise. One study found that ATO attacks on ecommerce retailers selling physical goods increased by 378% during the second quarter of 2020, compared to the same period in 2019. What’s driving this increase? In many cases, it’s personal data that’s all too easy to find online, and it doesn’t even need to be sensitive information like passwords in order to fuel ATO attacks. Recent news about Facebook and LinkedIn user data underscores just how much material fraudsters have at their fingertips and how they can use even publicly available information to commit fraud. In April, news broke that personal data such as phone numbers, email address, birthdates and genders from more than 500 million accounts on each of the two social networks had been collected by data-scraping tools and shared on the dark web. Facebook in particular took heat for not notifying users at the time the data-scraping incident was first reported, back in 2019. Both Facebook and LinkedIn have noted that the exposed data was shared by users and wasn’t the result of a breach of secured data. However, security experts quickly outlined a number of ways that the scraped data could be used to commit fraud. Ralph Kooi is the Country Manager Australia at ClearSale, a full-service cloud based platform that automates Fraud Prevention, allowing businesses to increase sales while reducing risk. ClearSale is the only company that never automatically declines an order before a manual review process, which allows us to achieve industry-high approval rates while eliminating false declines and brings in additional revenue for our customers. Ralph Kooi has previously worked for several International SaaS businesses while based in Australia. David Fletcher serves as Senior Vice President at ClearSale, a card-not-present fraud prevention operation that helps retailers increase sales and eliminate chargebacks before they happen. As a serial entrepreneur, he understands the particular pain points that affect business owners today, and how fraud management can provide real-world solutions to those problems. At ClearSale, he spearheads business development, sales, partnerships and alliances with top e-commerce organizations. Streamed on MySec.TV on 13 October 2021 – view the video version at

Today, we're joined by Michelle Price, CEO of AustCyber to discuss the return of the annual Australian Cyber Week, a week-long series of events and activities, this year to be held from 25-29 October 2021. The week combines virtual and in-person sessions to generate awareness about the Australian cyber security industry and showcase local innovation. It will also support increased understanding of cyber security by debating topical issues, risks and solutions, and facilitate national and global networking. FOR DISCOUNT TICKETS VISIT https://mysecuritymarketplace.com/event/australian-cyber-week-2021/ (https://mysecuritymarketplace.com/event/australian-cyber-week-2021/)Thanks for tuning in and stay tuned for more... #mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv) #austcyber (https://www.youtube.com/hashtag/austcyber) #AUcyberweek2021 (https://www.youtube.com/hashtag/aucyberweek2021) #cybersecurity (https://www.youtube.com/hashtag/cybersecurity)

After 3 years it came down to just seconds! Interview with Leader of team CSIRO’s Data61 and CSIRO’s Robotics group leader, Dr Navinda Kottege. Robotics experts led by Australia’s national science agency, CSIRO, have beaten teams from NASA JPL/MIT, California Institute of Technology, and Carnegie Mellon University to claim second place in a world leading robotics competition dubbed the ‘Robot Olympics’. Organised by the US Government research agency DARPA and spanning a three-year-period, the Subterranean Challenge was designed to push the boundaries of autonomous robotic technology. Scientists were tasked with remotely running the robots in an underground environment that simulated a real-world scenario. This included locating models representing lost or injured humans, backpacks, or phones, as well as variable conditions such as pockets of gas. The $US1 million ($AUD1.3) prize money will be reinvested into team CSIRO’s Data61’s research and development of Australian technology. Further reading: https://drasticnews.com/australia-claims-historic-top-two-spot-in-the-robot-olympics/ (https://drasticnews.com/australia-claims-historic-top-two-spot-in-the-robot-olympics/) #robotics (https://www.youtube.com/hashtag/robotics) #darpa (https://www.youtube.com/hashtag/darpa) #drones (https://www.youtube.com/hashtag/drones) #emersent (https://www.youtube.com/hashtag/emersent) #data61 (https://www.youtube.com/hashtag/data61) #csiro (https://www.youtube.com/hashtag/csiro) #subtchallenge (https://www.youtube.com/hashtag/subtchallenge)

2021 is shaping up to be a seminal year for Critical Infrastructure organisations when it comes to both physical and cybersecurity. The twin imperatives of COVID-19 (and its contingent lockdowns and impact on international travel to and from Australia) and the amendments to the Critical Infrastructure Act mean that its more important than ever for the sector to get their security in order. In this interview we talk to Genetec’s ANZ Country Manager George Moawad about how has risk management at Critical Infrastructure organisations has changed over the last 12-18 months and what are the biggest security concerns of current and prospective critical infrastructure clients. Further Reading Cybersecure solutions for protecting the everyday - https://www.genetec.com/trust-cybersecurity/cybersecurity (https://www.genetec.com/trust-cybersecurity/cybersecurity) Tools to help implement a cybersecurity strategy - https://www.genetec.com/blog/cybersecurity/how-to-maintain-a-strong-cybersecurity-strategy (https://www.genetec.com/blog/cybersecurity/how-to-maintain-a-strong-cybersecurity-strategy)

The ACSC Annual Cyber Threat Report 2020–21, the second unclassified annual cyber threat report since ASD became a statutory agency in July 2018, highlights the key cyber threats affecting Australian systems and networks, and uses strategic assessments, statistics, trends analysis, and case studies to describe the nature, scale, scope and impact of malicious cyber activity affecting Australian networks. It also provides advice to Australian individuals and organisations on what they can do to protect their networks from cyber threats.Over the 2020–21 financial year, the ACSC received over 67,500 cybercrime reports, an increase of nearly 13 per cent from the previous financial year. The increase in volume of cybercrime reporting equates to one report of cyber attack every 8 minutes compared to one every 10 minutes last financial year.As part of an Industry Sector Review and recognition of the report, we speak with Amit Chaubey, NSW Cyber Security Ambassador, Virginia Calegare, Cyber Security Advisor and Elliot Dellys, Cyber Security Advisor.Thanks for tuning in and stay tuned for more… #mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv) #acsc (https://www.youtube.com/hashtag/acsc) #cybersecurity (https://www.youtube.com/hashtag/cybersecurity) #threatlandscape (https://www.youtube.com/hashtag/threatlandscape)Further Reading & LinksACSC – cyber.gov.auhttps://www.cyber.gov.au/acsc/view-all-content/reports-and-statistics/acsc-annual-cyber-threat-report-2020-21MySecurity Marketplace – ACSC Report Posthttps://mysecuritymarketplace.com/reports/acsc-annual-cyber-threat-report-2021/MySec.TV Episode - recorded Livehttps://mysecuritymarketplace.com/av-media/acsc-annual-cyber-security-threat-report-20-2021-industry-sector-review/

A landmark defence and security partnership has been agreed by the leaders of the UK, the United States and Australia which will protect and defend shared interests in the Indo-Pacific. Under the ‘AUKUS’ alliance, the three countries will enhance the development of joint capabilities and technology sharing, as well as foster deeper integration of security and defence-related science, technology, industrial bases and supply chains. The first major initiative of AUKUS will be to deliver a nuclear-powered submarine fleet for Australia. We speak with Dr. Malcolm Davis, Senior Analyst with the Australian Strategic Policy Institute (ASPI)in Canberra and Zack Cooper, Senior Fellow with the American Enterprise Institute (AEI) in Washington on this arrangement and the implications for Australia and Indo-Pacific. #mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv) #AUKUS (https://www.youtube.com/hashtag/aukus) #nationalsecurity (https://www.youtube.com/hashtag/nationalsecurity) #indopacific (https://www.youtube.com/hashtag/indopacific)Further Reading - Asia Pacific Security Magazinehttps://www.asiapacificsecuritymagazine.com/australia-to-acquire-nuclear-powered-subs-under-new-aukus-security-partnership/https://www.asiapacificsecuritymagazine.com/australia-uk-and-us-launch-new-security-partnership/MySec.TV version - recorded 17 September 2021 https://mysecuritymarketplace.com/av-media/aukus-strategic-security-alliance-announcement-and-implications/

We speak with Relativity's CSO & CIO, Amanda Fennell and the APAC Managing Director, Georgia Foster for an insight into the company and trends in the APAC region. Relativity is on the mission to help organizations organize data, discover the truth, and act on it. This is especially resonant for customers who are dealing with sensitive data, demanding investigations and complicated litigation. The changing security threat landscape for APAC has made risk mitigation and data protection strategies more crucial than ever. Relativity’s security team, Calder7, frequently conduct research on the threat landscape to help readers stay up to date on the latest threats. Security Sandbox is a Relativity podcast aiming to help listeners learn about new fields and fortify their security programs. The goal is to share insights and inspire a few laughs, reward curiosity, and bring a little more excitement to the day-to-day work of our industry. LINKShttps://www.relativity.com/ (https://www.relativity.com/)https://mysecuritymarketplace.com/courses/security-sandbox/ (https://mysecuritymarketplace.com/courses/security-sandbox/)#securitysandbox (https://www.youtube.com/hashtag/securitysandbox) #relativity (https://www.youtube.com/hashtag/relativity) #calder7 (https://www.youtube.com/hashtag/calder7) #womenincyber (https://www.youtube.com/hashtag/womenincyber) #womenincybersecurity (https://www.youtube.com/hashtag/womenincybersecurity) #mysecuritytv (https://www.youtube.com/hashtag/mysecuritytv)

Dr. Arsenia Chorti is a Professor at ENSEA (École Nationale Supérieure de l'Électronique et de ses Applications, Paris, France) and a Visiting Research Fellow at Princeton University. She is also the Head of the Information, Communications and Imaging (ICI) Group of the ETIS Lab.  She is also a chartered engineer from the Technical Chambers of Greece, and a member of the IEEE P1951.1 Working Group on Smart Cities Standardization, the IEEE INGR Working Group on Security, and the IEEE P1940 Standardization Workgroup on Standard profiles for ISO 8583 authentication services.  Her research spans the areas of wireless communications and the design of security schemes for 5G and 6G with a particular focus on physical layer security, including context aware security, wireless security, 6G and IoT, intrusion detection in IoT networks and machine learning for communications. In this podcast, Professor Chorti gives an introduction on 6G, and how the sheer scale of applications and network delivering on a full range of diverse requirements - data rate, latency, energy and complexity constraints – will power “networks that for the first time, can ‘see’, ‘hear’ and ‘sense’.”  She cautioned how the nature of information will change, such as the volume of sensitive and private data transmitted over the air, and how the heterogeneous nature of 6G networks requires a rethink of today’s security solutions built on cryptography. Highlighting how existing protocols could be complemented by incorporating the physical characteristics of the wireless environment (“physical layer security”), she pointed out various areas of applications. These include device authentication using the physical location information of the device, distilling entropy available in the wireless medium to generate keys. Additionally, the risks of existing physical layer attacks such as jamming would increase under 6G, and security measures would likely rely on physical layer solution.  Interview by Jane Lo, Singapore Correspondent. Recorded 3rd September 2021, 4.30pm SGT/ 10.30am France.