information security

The Evolution of Cybersecurity: NIST Cybersecurity Framework 2.0

/ bugejajoseph / Leave a comment
Photo by Tima Miroshnichenko on Pexels.com

The National Institute of Standards and Technology (NIST) reached a significant milestone on August 8, 2023, with the release of the draft for NIST Cybersecurity Framework (CSF) 2.0. This step marks a positive advancement since its inception in 2014. The CSF is a cornerstone in reducing cybersecurity risks, offering comprehensive guidance to organizations in comprehending, evaluating, prioritizing, and communicating these risks, along with actionable measures to mitigate them.

CSF 2.0 extends its influence, delivering invaluable cybersecurity insights to organizations of diverse sizes and industries. A pivotal change is evident in the revised title, which omits the term “Critical Infrastructure” (previously named “Framework for Improving Critical Infrastructure Cybersecurity”), highlighting its broader applicability.

At the core of CSF 2.0 lies an intensified emphasis on the indispensable role of governance in the realm of cybersecurity. Acknowledging its foundational significance, strong governance emerges as the bedrock of an effective cybersecurity program. By positioning governance as the cornerstone, the framework guides organizations in steering the other five functions—identify, protect, detect, respond, and recover—aligned with their mission and stakeholder expectations.

A compelling highlight of the draft pertains to the criticality of supply chain risk management. It underscores the imperative need for holistic risk management programs that address the vulnerabilities associated with suppliers. Additionally, a clarion call for proactive third-party risk monitoring resonates throughout the document, underscoring the importance of a vigilant stance.

In an era characterized by dynamic cyber threats, the adoption of advanced frameworks becomes an inescapable imperative. The integration of NIST CSF 2.0 into our strategic cybersecurity approach is paramount. Furthermore, forging alliances with industry leaders amplifies our collective efforts in fortifying our digital defenses against the ceaselessly evolving landscape of digital threats.

In conclusion, NIST Cybersecurity Framework 2.0 signifies a monumental stride towards bolstering our digital resilience. By embracing its principles and fostering collaborative partnerships, we equip ourselves to navigate the complex challenges posed by the digital age.

Read more here: https://www.nist.gov/news-events/news/2023/08/nist-drafts-major-update-its-widely-used-cybersecurity-framework

Securing the University: My Information Security Awareness Session

/ bugejajoseph / Leave a comment
Photo by ThisIsEngineering on Pexels.com

As technology continues to advance, so do the risks and threats associated with it. To protect ourselves and our institutions, it is crucial to remain informed and updated with the latest security trends and best practices. This was the main focus of my recent 45-minute security awareness session with the university technical staff.

In addition to discussing fundamental security measures, I also covered the latest threat actors and threats in the cyber security landscape affecting universities and public institutions. This included state-sponsored actors, cybercriminals, hacker-for-hire groups, and hacktivists. I emphasized the potential consequences of a cyber attack, which can be severe and damaging, such as financial losses, reputational harm, and legal liability.

One alarming statistic I shared was that according to estimates from Statista’s Cybersecurity Outlook, the global cost of cybercrime is expected to surge in the next five years, rising from $8.44 trillion in 2022 to $23.84 trillion by 2027. This underscores the importance of taking proactive steps to mitigate potential risks.

While technical measures are essential, we also discussed the human element of security, including social engineering tactics like phishing emails or pretexting phone calls. Information security starts and ends with all of us, and it is crucial that everyone takes responsibility for protecting sensitive information and assets.

Here is a redacted version of the presentation. Additionally, I recently co-authored an article titled “Human Factors for Cybersecurity Awareness in a Remote Work Environment”, which delves into relevant and relatable cyber security aspects for remote employees.”

2020 academic semester kickoff

/ bugejajoseph / Leave a comment

Today, was the kick-off to the new academic (Spring) semester.  I took the opportunity to present an overview of what is expected to be covered in the Information Security course. During this lecture, I also motivated students why it is important to study information security, introduced the course syllabus, and talked about the learning outcomes of the course.

This year, I have about 150 students taking my course. This is a great achievement especially considering that the course is an elective course. Talking to such large groups is always exciting and fun! You can see me below testing the microphone and preparing my laptop before the students start heading to the class.  All the lectures are delivered in a classroom setting but all the material including slides, supplementary material, and any assignments are uploaded on the course portal.

Getting ready at Malmö university (2020)

In addition to inviting two external academics as guests, this year, I invited two speakers from the industry. The speakers have many years of experience working with real-life security use cases and are working with international companies TrueSec and Fingerprints.