Curated advice, guidance, learning and trends in cybersecurity and privacy, as chosen by our consultants.
Experienced security advice on demand
Ideally, every organisation would have a chief information security officer who can guide its cybersecurity efforts. In reality, resources, risk appetite, and budgets often stand in the way. The virtual CISO is a practical, cost-effective alternative: an external, independent expert who gives strategic security advice and guidance on an as-needed basis, and puts in place policies, processes, procedures, people and technical solutions to strengthen your defences against cyber threats. Your business benefits from an experienced professional without the overhead of hiring a fulltime role. To find out more, visit BH Consulting’s CISO as a Service page, or contact us today for a no obligation conversation on +353 1 440 4065 or email info@bhconsulting.ie.
Government launches National Cyber Security Strategy
The Government published the National Cyber Security Strategy 2030 during the EU Presidency Cyber Security Conference. The plan has 29 specific actions intended for the next four years, including setting up a National Detection Network to identify threats early, a National Cyber Hub for collecting and sharing threat information with Irish and European partners, and a national system for coordinating how security flaws are reported and communicated. The Government has committed over €30 million over the life of the strategy which identifies cybercrime such as fraud and ransomware as the biggest threat to Ireland. It also flags growing risks from state-linked hackers and AI-powered attacks.
The strategy is built on three pillars: detect and defend; enhance national resilience; and strengthen the cyber ecosystem. The plan aims to strengthen the State’s incident-response capabilities, advance NIS2 implementation, deepen civil-military cooperation, support SMEs to improve their cyber resilience, and address emerging risks associated with AI and post-quantum cryptography. As part of strengthening the ecosystem, the strategy aims to train more people through workforce roadmaps and a national skills report. On a related note, the ‘Skills for Digital Specialists’ report from the Expert Group on Future Skills Needs identified cybersecurity as the fastest-growing technology domain in Ireland. While anticipating growing demand for those skills, the report forecasts a shortfall by 2030, saying current education, training and talent pipelines are “unlikely to fully meet demand without appropriate policy interventions”.
BH Consulting’s BH Haven service shortlisted for AI Awards
BH Haven, the new service from BH Consulting to help small businesses address cybersecurity, regulatory, data protection, AI, and resilience challenges, has been shortlisted in the AI Awards. It’s nominated in the category for best application of AI in cybersecurity. BH Haven is an ongoing service that combines the judgement and oversight of an experienced and accountable cybersecurity professional with a proprietary AI solution used for analysis, evidence review, documentation, regulatory mapping, and reporting.
It’s available in four tiers depending on company size and the number of consulting days involved. Already, the service has received extensive media coverage from Help Net Security, Irish Tech News, Techcentral.ie, and Techopia. For more information, visit bhhaven.com. The AI Awards ceremony will be held at the Radisson Blu Hotel in Dublin on 17 November.
Data Protection and privacy roundup: guidelines galore and a GitHub gaffe
The European Data Protection Board (EDPB) has adopted draft guidelines on determining when a GDPR infringement should attract an administrative fine. The guidelines are intended to help organisations to assess their exposure to enforcement from the supervisory authority. Other forms of corrective action are open to regulators such as warnings, reprimands, orders, limitations including bans and withdrawal of certification. The guidelines are open for public consultation until 13 November.
The EDPB has also adopted guidance on the interplay between the Digital Services Act and the EU GDPR. The guidelines aim to harmonise a consistent interpretation of the DSA where some of its provisions relate to the processing of personal data. The Act includes several provisions relating to the data protection legal framework, such as rules on profiling and special categories of data as outlined in the GDPR.
In other privacy news, Meta said a hacker broke into its GitHub repository and stole personal data about nearly 1,500 people, most of whom work for the company in the USA. Source code accounted for 99 per cent of the take, Meta told SecurityWeek. The company didn’t say what type of personal data was compromised in the breach. Separately, reports emerged that the company’s smart glasses may be recording conversations even when they’re not supposed to. Meta said it has since resolved the issue.
Links we liked
The NCSC national hub for coordinating vulnerability disclosures is now open. MORE
Vulnerabilities exposed in Europe’s renewable energy assets. MORE
APNIC’s interesting look at the resilience of submarine internet cables. MORE
Pricing your bad days: cyber risk quantification for security leaders. MORE
The cyber risk discourse is broken, argues Trillium Labs’ Nathan Lambert. MORE
It turns out this ransomware mediator just paid crooks to get data back. MORE
Enough with the ‘rogue AI agents’ narrative, please. MORE
Sophos CEO Joe Levy warns against logical fallacies in the AI/cyber debate. MORE
Vanta’s excellent guide to writing (and AI) has pearls aplenty for security pros. MORE
SecurityWeek rounds up exploits uncovered at Pwn2Own Ireland. MORE
Have you signed up to our monthly newsletter? Every month we send out the latest cybersecurity and data protection news, trends and advice from around the globe.
Sign up here
