Damien Manuel

New Zealand’s National Cyber Security Centre (NCSC) has joined the Australian Signals Directorate’s ACSC and international partners to release three practical publications on implementing Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. The series includes: ▪️Implementing SIEM and SOAR (Executive Guidance) - defines platform value and challenges, tailored for executive decision-makers. ▪️Implementing SIEM and SOAR (Practitioner Guidance) - outlines detection, visibility, and integration principles for cyber teams. ▪️Priority Logs for SIEM Ingestion - provides detailed guidance on what log sources to ingest and why, across endpoint, network, cloud, and OT domains. 🛡️ Key technical takeaways from the Priority Logs guidance: ▪️Prioritised by risk and value: Start with EDR, firewalls, and domain controller logs (e.g. DCSync, GPO changes), then scale based on risk profile, threat surface and deliberately selected use cases. ▪️ Architecture tips: SIEMs are NOT archives - use centralised collection with selective ingestion. Prioritise logs with analytical value and avoid overwhelming your SIEM with noisy sources. ▪️ Mapped log categories: ✔EDR: DLL mismatches, DNS cache entries, BAM activity, PowerShell script blocks ✔Network: Denied connections, config changes, VLAN NetFlow, auth failures ✔AD/Windows: Sysmon Event ID 1, scheduled tasks (4698), AppLocker blocks, audit log clearance ✔OT/ICS: Data diode architecture, passive protocol-aware monitoring, safe enrichment of log telemetry ✔Cloud: AWS (CloudTrail, SecretsManager), Azure (Unified audit, Entra logs), GCP (Access Transparency), Google Workspace (Drive, Gmail, OAuth events) ▪️SIEM/SOAR model compatibility: Applies to standalone or integrated deployments. Emphasis on high-fidelity log sources and detection tuning over ingesting "everything". Full advisory and access to all three documents: 👉 https://lnkd.in/gvqxRZ55 #SIEM #SOAR #CyberSecurity #ThreatDetection #SecurityMonitoring #SOCArchitecture #EDR #CloudSecurity #OTSecurity #LogManagement #NZCyber #NCSC #ACSC #SecurityEngineering #BlueTeam

18

Good security practice for domain registrars The National Cyber Security Centre has shared key outcomes and recommendations to encourage good practice and help reduce harmful domain registrations. This guidance is for domain registrars and operators of Domain Name System (DNS) services. It sets out outcomes and recommendations to promote good practice in a set of principles, and aims to reduce the prevalence of malicious and abusive domain registrations. It builds on existing industry good practice from international bodies such as ICANN and the NetBeacon Institute. It is consistent with other UK government guidance issued to registrars and other infrastructure service providers to tackle other issues such as fraud, extremist and illegal content. Read the guidance here: https://lnkd.in/dbbM_yqy

1

Is your security posture built on a generic checklist or real-world experience? A standard security checklist isn't enough.  Our Secure Config Reviews are based on industry-recognized guides from sources like Microsoft, the Center for Internet Security (CIS), the Australian Cyber Security Center (ACSC), plus our own checks built from years of penetration testing experience. Stop making it easy for attackers. Learn more: https://lnkd.in/gT9Tszuf

3

📢 New Report Released: Cyber Security Priorities for Boards (2025–26)   The Australian Cyber Security Centre has published its latest guidance for directors here https://lnkd.in/gHMPdEVX   Key themes:   ✅ Secure by Design ✅ Legacy IT Risk Management ✅ Quantum-Ready Cryptography   I've create a report on how to align these priorities using Microsoft 365 Business Premium. If you want a free copy of the report just reply here.

4

1 Comment

The ACSC has released its 2024-25 Annual Cyber Threat Report. This is a must read for any organisation responsible for protecting networks against cyber threats - which are increasing again! ☠️ Average reported cost of cyber crime were up with business impacted the most: Medium business: $97,200 (up 55%) Large business: $202,700 (up 219%) ☠️ Many incidents were discovered by the ASC's ACSC, notifying businesses of suspicious activity. ☠️ State-sponsored cyber actors also compromise home devices connected to the internet, such as home routers, to create botnets that support further targeting around the globe. IoT and OT security is vital not only as the first line of defence, but to protect networks from compromises spreading! ☠️ State-sponsored cyber actors use built-in network administration tools to evade detection by blending in with normal system and network activities, to cause harm at a time of their own choosing. This 'living off the land' tradecraft requires network defenders to think like the malicious cyber actor, studying abnormal behaviours on systems rather than through traditional means such as intrusion detection systems. The best advice for staying secure - you can't control what you can't see. Its crucial that enterprises have visibility into their networks. #ACSC #ASD #cybersecurity #cyberthreats http://bit.ly/48uWTdu

2

Cisco has released findings from Splunk’s annual CISO Report, From Risk to Resilience in the AI Era, highlighting how the chief information security officer role is expanding as organisations accelerate AI adoption and face a more complex threat landscape. Download report📥 https://lnkd.in/g9pKHyn9 #Cisco #Splunk #CISOReport #CybersecurityLeadership #AIinSecurity #ANZCyber #RiskToResilience #InfoSec

4