Christian Wickham

192

Christian Wickham 's Posts

On International Women’s Day, I am reminded of the need for diversity in the workforce, and want to pose the question of what does diversity mean to you? Diversity is not just the inclusion of other races, genders and backgrounds. More than just a blind quota of non-white, non cisgender,… Continue Reading What does diversity mean to you?

Terminology around privacy and security often will use the term “PII” – to refer to “Personally Identifiable Information”. However, PII in Australia is not a valid term – the definition by the OAIC is “personal information”, and it differs from the US term (from NIST) and the legal obligations around… Continue Reading PII in Australia and personal information

Data Sovereignty with cybersecurity is a hot question that many organisations consider to be one of their early considerations when selecting a service provider for storing their data. The intention is that important data needs to not be held in foreign datacentres, so that foreign governments cannot withhold the data… Continue Reading Cybersecurity and Data Sovereignty

The English journalist Louis Theroux has a reputation for interviewing “difficult” and unusual people and subcultures, and getting a large amount of information and knowledge from people who otherwise do not open up to outsiders. The techniques and patterns that he uses to get people to open up are methods… Continue Reading Get information the Louis Theroux way

Cybersecurity is more than just firewalls and anti-virus, goes further than just zero-trust approaches and cultural changes, and is beyond just policy and compliance. Cybersecurity is not an ‘action’ or a ‘solution’ – it is an ongoing activity that needs constant review and updating. Cybersecurity Planning will vary for each… Continue Reading Cybersecurity planning

What is your strategy for patching and updates? Whilst it might be tempting to just leave your systems on auto-update, the alternative to manually delay updates to always be one behind the latest (also known as an N-1 update strategy), may also be a problem. Updates and patching of software… Continue Reading N-1 update strategy

With the ever-increasing levels and frequency of attacks and impact, businesses of all sizes should consider specific cyber insurance. However there are some Cyber Insurance myths that need to be dispelled. Myth #1 – My other insurance will cover me Unless your other insurance specifically covers cyber events, you are… Continue Reading Cyber Insurance myths

I have posted a few articles about different security standards and frameworks, such as PCI-DSS, The Essential 8, ISO27001, NIST and others – and in my experience, there are some organisations that focus on compliance instead of security. People desperately chase the dogma of maturity levels or complying with every… Continue Reading Focus on Compliance or Security?

As the world becomes more aware of cybersecurity risks and issues, company boards need to become more aware of the issues that cybersecurity poses for their businesses. However, it can be difficult for non-technical people to learn the new terminologies and concepts. The question still remains on how we educate… Continue Reading Educate Boards in Cybersecurity

A question that has been around my mind for a while is “does the CISO need to become the CSO”? Is the responsibility of the Chief Information Security Officer too limiting, and should they be the Chief Security Officer? The issue with a CISO is that they often are limited… Continue Reading Does the CISO need to become the CSO?

Last month, I wrote an article on the Essential 8. The article pointed out that for most of the measures, they should be the absolute minimum measures that organisations take with their systems. For those who work in the area of security, most of the Essential 8 are common-sense and… Continue Reading Obvious PCI-DSS benefits

The Australian Cyber Security Centre, working alongside the Australian Signals Directorate (formerly Defence Signals Directorate) created a list of eight essential mitigation strategies to act as a baseline for cybersecurity. These are very much basic and essential measures, and they are an absolute minimum. As a cybersecurity professional, these are… Continue Reading What is wrong with the Essential 8?

It is a well-known adage in cybersecurity that there is a balance between usability and security – if you increase the security and control, you decrease usability. Conversely, to make a system user-friendly and easy to use, it has to be done at the cost of lowering security. This has… Continue Reading Challenging the balance between security and usability

In times where you need to run through your BCP drill, it is important to know and understand the reasons why you need to exercise your Business Continuity Plan drill, and where it fits in with the rest of your Disaster Recovery Plan (DRP or DR Plan). Your BCP Drill… Continue Reading The BCP Drill

Cybersecurity is a culture, not an action – but for organisations starting in their efforts to implement a cybersecurity culture, there are some steps in getting started with cybersecurity. This article will outline the basics to get started with cybersecurity, for small to medium sized businesses, and for larger business… Continue Reading Getting started with cybersecurity

With the hack of Optus Telecommunications on 22 September 2022, where the personal information of up to 11.5 million Australians (nearly half of all people in Australia) was stolen, this has highlighted the need for cybersecurity reform in Australia. Unlike other countries, there are no mandated fines and penalties for… Continue Reading Cybersecurity reform in Australia