April 2019 – The SECOND Advisories Limited

Direction

21st April 201922nd April 2019 By cliangNo Comments

Establishing cyber directives (policies) is challenging. On one hand, the language must be chosen not too specific for flexibility but on contrary too loose will be difficult to enforce practically. The bottom line is to establish organization specific directive per its line of business based on commonly recognized best practices and industry regulations (e.g. CIP, PCIDSS, HIPAA, SOX, GDPR). Over time, regular review among stake holders is required to fine tune the language based on experience of adoption to address any limitations. And this regular review process shall also be specified in the directive itself as part of the compliance....

End of Road

13th April 201913th April 2019 By cliangNo Comments

In physical journey, there is always an end such as End of vacation, back to workRoad blocked by obstacle, detour or get back In cyber journey especially digital transformation, it is never-ending. The target is rolling, compliance to new regulations are demanding, expectations from stake holders are uplifting over time. You need to upkeep security protection against emerging threats even if your business or technologies deployed remain unchanged. New solutions or even new protections will bring new risks. Essentially, regular assessment is required the business environment, technologies deployed and threat landscape, and review how much risks are acceptable to run the business. After all there is never 100% secure system. ...

Big or Small

5th April 20195th April 2019 By cliangNo Comments

Cyber assets, no matter big or small, must be managed via the same practice and same maintenance regarding cybersecurity as long as they are hosted in the same ecosystem. Zoning might make certain difference but things could be broken due to many reasons. Defense-in-depth must be adopted. ...