Cyber Security Weekly Podcast

In this episode MySecurity Media's David Matrai talks with two Australian entrepreneurs based at the Australian Landing Pad @WeWork, San Francisco. An initiative of Austrade, Landing Pads help market-ready startups and scaleups take their business global.

Martin Cho of Vertex Security and Matthew Nevin of Cybermerc are two of the Australian entrepreneur residents at the Landing Pad and share their experience of moving into the American market. We’re also joined by Gabe Sulkes, Landing Pad Manager, Australian Trade and Investment Commission (Austrade) who has some terrific advice too. Enjoy the discussion!

Links:

Australian Landing Pad – San Francisco - https://www.australiaunlimited.com/landingpads/locations/san-francisco (https://www.australiaunlimited.com/landingpads/locations/san-francisco)

Vertex Security – https://www.vertextech.com.au (https://www.vertextech.com.au/)

Cybermerc – www.cybermerc.com (http://www.cybermerc.com/)

Recorded in San Francisco as Official Media Partners to the AustCyber USA Trade Mission to the RSA Conference 2019 #OzCyberinUSA2019

Interview with Andrew Kay, Systems Engineer with Illumio. The Illumio Adaptive Security Platform® (ASP) secures the inside of any data centre and cloud – running any form of compute – with micro-segmentation enabled by application dependency and vulnerability maps.

Illumio ASP delivers micro-segmentation that is enabled by combining vulnerability data with real-time traffic visibility. This combination enables organisations to understand how their applications work, see where they are most vulnerable, and use that visibility to create and enforce micro-segmentation policies.

Andrew Kay has over 15 years’ experience in security and quality assurance working with organisations across Asia Pacific to strengthen their resilience to cyber threats. Having worked with major industry players like Micro Focus and HPE, Andrew now represents Illumio South Pacific as he combines his knowledge of technology and industry to design and implement solutions that prevent attackers' lateral movement, protect high-value assets and achieve compliance goals.

Illumio is supporting the Cyber Risk Meetup events in Sydney and Melbourne in 2019 and is listed on the MySecurity Marketplace, including listed reports; How to secure your crown jewel applications (https://www.mysecuritymarketplace.com/product/how-to-secure-your-crown-jewel-applications/) and How to Build a Micro-Segmentation Strategy (https://www.mysecuritymarketplace.com/product/how-to-build-a-micro-segmentation-strategy/)

(https://www.mysecuritymarketplace.com/product/how-to-build-a-micro-segmentation-strategy/)For more information or to register interest visit https://www.mysecuritymarketplace.com/product/illumio-adaptive-security-platform/ (https://www.mysecuritymarketplace.com/product/illumio-adaptive-security-platform/)

(https://www.mysecuritymarketplace.com/product/illumio-adaptive-security-platform/)Recorded on Monday 4 March 2019 in Sydney, Australia

Recorded in San Francisco at the RSA Conference and part of #OzCyberinUSA2019, MySecurity Media's Dave Matrai interviews Paul McCarty of SecureStack.

This is a great story about an American that’s come to Australia, become an Aussie and is on a mission to take his company back to America! Already working with a number of government clients, Paul discusses his insights into DevOps and the journey he is undertaking as part of CyRise.

Recorded in San Francisco at WeWorks during #RSA2019 and in collaboration with AustCyber and AusTrade. MySecurity Media is the Official Media Partner to AustCyber for the West Coast USA Trade Mission & RSA Conference 2019.

For more information stay tuned with #OzCyberinUSA2019 or visit www.austcyber.com

Interview with Professor Dali Kaafar, Chief Scientist at Optus Macquarie University Cyber Security Hub and Professor at the Faculty of Science and Engineering at Macquarie University. Professor Kaafar and Macquarie University Lecturer Hassan Jameel Asghar, released a paper mid February, titled, ‘Averaging Attacks on Bounded Perturbation Algorithms’ (https://arxiv.org/pdf/1902.06414.pdf) that identifies and demonstrates a vulnerability of the Perturbation Algorithm used by the Australian Bureau of Statistics (https://www.abs.gov.au/) for its online tool, TableBuilder, that enables querying the Australian Census Data.

Dali Kaafar has disclosed “In a nutshell, the algorithm named TBE, perturbing answers to the queries by adding noise distributed within a bounded range is faulty and puts the highly sensitive original census data at major risk of being revealed. We demonstrated how an attacker, who may not know the perturbation parameters, can not only find any hidden parameters of the algorithm but also remove the noise to obtain the original answer to any query of choice. None of the attacks we presented depend on any background information. Implications of go beyond re-identification risks. The attack reveals values intended to be hidden by the TBE algorithm and hence reconstructs the original census data. While the attack is applicable to the actual Australian census data available through TableBuilder, for ethical considerations we only show the success of the attack on synthetic data. We note however, that the perturbation method used in ABS TableBuilder tool is proven vulnerable to this attack.

In response to the research, an ABS spokesperson stated, “The ABS is strongly committed to privacy.  With emerging data analytics techniques, the ABS needs to be on the front foot of any emerging risks to the data we hold.  We have been working,  and will continue to work, with leading experts to ensure we are using the best approaches possible to protect individuals’  data.

The ABS has been working with Dr Kaafar and his co-researchers on Table Builder, and strategies to mitigate the vulnerability discovered by the researchers since early 2017. The ABS has already implemented measures to address the vulnerability.  This includes reducing the amount of details to be accessed by certain Table Builder applications, strengthening the terms of use of Table Builder and also regularly monitoring the job logs to forestall any possible attacks.

There is no evidence of anyone’s privacy being compromised with the use of Table Builder.”

The discussion includes consideration to the Differential Privacy framework and the application of provable privacy versus probable privacy for the 2020 USA Census.

Interview recorded in Sydney on 26 February 2019.

Original release on the Australian Cyber Security Magazine website is available here (https://australiancybersecuritymagazine.com.au/census-data-at-major-risk-of-being-revealed-vulnerability-discovered-in-the-australian-bureau-of-statistics-tablebuilder-tool/)

(https://www.mysecuritymarketplace.com/wp-content/uploads/2018/12/CyberBreach.jpg)This interview starts with a book review but dives into Peter's long and fascinating journey, starting as the CEO of the Internet Industry Association in 1997 and through to his observations of today's contemporary cyber environment and potential for the next cyber crisis - including an existential threat with an apparent escalating Cyber War between the major powers of USA and China.

Peter is the CEO of Icon Cyber (https://iconcyber.com/) and the APAC Regional Head for CyAn - CyberSecurity Advisors Network (https://www.cyan.network/)

For a full book review visit https://issuu.com/apsm/docs/asm_oct_dec_2018/58 (https://issuu.com/apsm/docs/asm_oct_dec_2018/58)

To purchase the book visit https://www.mysecuritymarketplace.com/product/the-cyber-breach-communication-playbook/ (https://www.mysecuritymarketplace.com/product/the-cyber-breach-communication-playbook/)

This book, co-authored with Michael Parker, starts at 2:30am. Waking to the news of a serious cyber security breach, this is a time as a Director or Executive you are best already prepared, rather than scrambling to get with the cyber jargon and have the first read of the Notifiable Data Breach legislation. There are new obligations and an ever increasing expectation on companies and organisations subject to the Privacy Act to get the response right.

As a ‘playbook’, Peter and Michael have set out to provide clear guidance of a practical nature, so that if organisations are faced with, say a ransomware demand, they have a decision-making framework to help ask the right questions.

Recorded in Sydney, 20 February 2019.

Recorded in St Leonards, NSW, Sunil Sharma, Digital Risk & Cybersecurity Leader with GHD Digital provides insight into the firm’s digital and cybersecurity services, predominantly delivered to industry, resources, mining and critical infrastructure such as Energy, Water and Transport sectors. With increasing data analytics capability, the importance of cybersecurity and network protection rises accordingly and adherence to the Australian Critical Infrastructure Act or Singapore’s Cybersecurity Act. With 10,000 staff across the world, GHD Digital is a leading consultant and engineering firm at the forefront of a digitally transforming industry mindset and regulatory environment.

GHD Digital were sponsors of the Cyber Risk Meetup in Sydney (October 18 - No Longer a Secret (https://www.cyberriskmeetup.com/nolongerasecret)) and Perth (November 19 - All Industry All In (https://www.cyberriskmeetup.com/allindustryallin)) and will be supporting the next Perth CyberRiskMeetup on April 10. For more information visit www.cyberiskmeetup.com (https://www.cyberiskmeetup.com)

First of the year catch up with Shamane Tan, organiser of the Cyber Risk Meetup events in Australia and Singapore. We discuss the recent CISO Town Hall Twitter event and the key takeways from CISOs around the world, upcoming event with the Australian Information Security Association on February 20 in Sydney discussing Prudential Standard CPS 234 and Open Group FAIR (now a Sold Out event) and Cyber Risk Meetups scheduled in Sydney, Melbourne, Perth, Brisbane and Singapore from February through to October.

Also a mention for cyber and security industry events being held in Sydney and Melbourne as part of International Women’s Day on 8 March 2019 and a special All Women edition of the Australian Cyber Security Magazine.

Relevant links for more information are:

CISO Town Hall takeaways – Shamane Tan Linkedin post (https://www.linkedin.com/feed/update/urn:li:activity:6499033288336900098)

(https://www.linkedin.com/feed/update/urn:li:activity:6499033288336900098)CyberRiskMeetup.com (https://www.cyberriskmeetup.com)

(https://www.cyberriskmeetup.com)Illumio Whitepaper - How to Secure Your Crown Jewel Applications (https://www.mysecuritymarketplace.com/product/how-to-secure-your-crown-jewel-applications/)

(https://www.mysecuritymarketplace.com/product/how-to-secure-your-crown-jewel-applications/)AISA.org.au (https://www.aisa.org.au/)

(https://www.aisa.org.au/)Australian Cyber Security Magazine – #WomeninCyber Edition to be released for International Women’s Day – 8 March 2019 (https://australiancybersecuritymagazine.com.au/australian-cyber-security-magazine-womenincyber-edition-to-be-released-for-international-womens-day-8-march-2019/)

In this interview we speak with MobileIron’s Frédéric Gillant, Vice President Sales Asia-Pacific and Jonathan Andresen Senior Director, Marketing, Asia-Pacific.

MobileIron provides cloud and endpoint security which allows enterprise to enforce conditional access based on device posture to protect cloud services, provide and protect cloud apps on the endpoint and segregate business apps and data from personal apps and data on mobile devices. MobileIron allows the CISO to configure and deploy consistent app policies across endpoints and clouds, including a per-app VPN which enables users to access corporate resources behind the firewall.

For more information visit www.mobileiron.com

Recorded at the Canalys Channels Forum, Asia Pacific, held in Hong Kong, 4 - 5 December 2018. MySecurity Media attended the event courtesy of Canalys. @CanalysForum #Canalys

In this episode we sit down with Lenovo’s Australia and New Zealand Managing Director, Matt Codrington, alongside the company's General Manager, Asia Pacific SMB Segment, Takeshi Okuma.

In Hong Kong for the Canalys Channels Forum, Lenovo boasts a network of over 10,000 channel partners across Asia Pacific, with 95% of its business coming through the channel. The company claims a steadfast commitment to supporting channel partners’ businesses in navigating an age of disruption and has implemented a comprehensive channel program. Interview discussion includes Lenovo’s overall business strategy and most recent performance in Australia, including a DaaS case study with KPMG and Takeshi Okuma provides a regional overview and insights to a joint Venture between Lenovo and Fujitsu.

Recorded at the Canalys Channels Forum, Asia Pacific, held in Hong Kong, 4 - 5 December 2018. MySecurity Media attended the event courtesy of Canalys. @CanalysForum #Canalys

Vlad Vyshnivetskyy is the Cyber Security Program Lead at AC3 (https://www.ac3.com.au/services/managed-services). AC3 is an Australian owned, operated Managed Services Provider, including Managed Security Services.

In this interview, recorded in Hong Kong, we discuss the role of MSSPs, importance of Service Level Agreements (SLAs) and Vlad makes mention of the Prudential Standard CPS 234 Information Security, scheduled to come into affect 1 July 2019, which aims to ensure that an APRA-regulated entity takes measures to be resilient against information security incidents (including cyberattacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats.

Prudential Standard CPS 234 Information Security is https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf (Prudential Standard CPS 234 Information Security)

Vlad is an experienced Cyber Security manager with 20+ of IT experience, certified Project Management Professional (PMP, PRINCE2 and Scrum Master) and with a broad knowledge of information systems, Cyber security solutions, practices, processes, vendors and products, including Palo Alto, IBM, F5, zScaler, HPE, MicroFocus, Cisco, Trend Micro, EMC/RSA. Recorded 5 December, 2018 at the Canalys Channels APAC Forum, Hong Kong. MySecurity Media attended the forum courtesy of Canalys.

@CanalysForum #Canalys