G M Faruk Ahmed, CISSP, CISA

🚨 Email Delivery Issues – Investigation & Resolution Update 🚨 Issue 2: External Emails Not Received by Shared Mailbox “user@nccbank.com.bd” (On-prem) Symptoms: The shared mailbox was not receiving emails from two specific external domains — ***-bd.com and dhaka****.com. Emails from all other domains were delivered successfully. Findings: 🔹 Edge Transport message tracking showed no entries for affected domains — messages were not reaching the Edge server. 🔹 Edge anti-spam, connection filtering, IP block lists, and firewall configurations were reviewed and confirmed clean. 🔹 Test emails from other domains were received without issue. Conclusion: No domain- or IP-based blocking detected on the Edge server. The issue likely originates from the sending domain side. #EmailSecurity #ExchangeServer #Microsoft365 #ITOperations #IncidentResponse #NCCBank #CyberResilience

১

🚨 Email Delivery Issues – Investigation & Resolution Update 🚨 Issue 1: External Emails Not Received by “user@nccbank.com.bd (On-Prem)” Symptoms: The user was able to receive internal emails but was not receiving any messages from external domains. Root Cause: The mailbox was missing the required LegacyExchangeDN (X500) proxy address — a key component for proper external address resolution. Without this entry, external routing to the on-premises mailbox could not complete successfully. Resolution: ✅ Added the missing X500 proxy address ✅ Ran Entra Connect synchronization to update directory information ✅ Verified mailbox routing and address resolution ➡️ Mailbox is now functioning normally and remains under monitoring. #EmailSecurity #ExchangeServer #Microsoft365 #ITOperations #IncidentResponse #NCCBank #CyberResilience

১২

৩ মন্তব্যসমূহ

________________________________________ Recommendation & Justification Recommended Approach: Hybrid Framework (NIST CSF + ISO 27001) Combining NIST CSF with ISO 27001 offers a robust solution tailored to the unique needs of a healthcare technology company expanding globally. Justification: • Strengths of NIST CSF: o Flexibility allows for easy tailoring to local regulations. o Strong focus on risk management is critical in the healthcare sector where data breaches can have severe consequences. • Strengths of ISO 27001: o Provides an internationally recognized certification, boosting credibility in global markets. o Thorough documentation standards promote a culture of security and compliance. • Weaknesses: o NIST CSF may lack the rigorous audit requirements present in ISO 27001. o ISO 27001 can be more resource-intensive to implement and maintain. Addressing Regulatory Compliance: • HIPAA: The combination ensures that all patient data is controlled, logged, and protected via strict access controls and response planning (NIST), along with comprehensive ISMS policies (ISO). • GDPR: The strong data governance and privacy considerations in both frameworks ensure commitments to data protection requirements are met. Business Needs: • The hybrid approach addresses the need for agile responses to emerging threats while ensuring international compliance and building trust with clients.

১

Free certification Cyber Hygiene awareness ✔️ Registration ( Only for Bangladesh ) :https://lnkd.in/gzGEPUEn ✔️ This certificate is just a basic level on cybersecurity awareness. This is an initiative of Google, The Asia Foundation, Sajida Foundation, CyberPeace Institute and Global Cyber Alliance. The goal of this initiative is to enhance the cyber capabilities of 300,000 underserved micro and small businesses, non-profit organizations, and social enterprises in Bangladesh. ✔️ There are six modules to achieve this. After completing these modules, you'll be able to know on ✅ Cyber risks and their impact ✅ Ways to secure devices and apps ✅ Software updates and business security ✅ Strong passwords and authentication ✅ Protection from phishing and fraudulent messages ✅ Business data backup and data security I'd like to thank The Asia Foundation , SAJIDA Foundation,Google, for the free and to enhance the cyber capabilities. credit : Uzzwal Chandra Deb #NeverStopLearning hashtag #alwayslearning hashtag #google hashtag #informationsecurity hashtag #ngo hashtag #sajidafoundation hashtag #asiafoundation hashtag #cybersecurity hashtag #security

১৪

২ মন্তব্যসমূহ

🏅 The ISO/IEC 27001 Information Security Associate certification (often offered by providers or as an entry-level equivalent to Foundation courses from PECB/APMG) focuses on foundational knowledge of the ISO/IEC 27001 standard for Information Security Management Systems (ISMS) 🏅 🎯 Key focus areas include: ✔️ Fundamental concepts and principles of information security and ISMS ✔️ Core requirements of ISO/IEC 27001 (clauses 4–10), including context, leadership, planning, and support ✔️ Risk assessment, analysis, evaluation, and treatment processes ✔️ Information security policies, objectives, and top management responsibilities ✔️ Statement of Applicability (SoA) and selection of controls (reference to Annex A) ✔️ Operational planning, control, monitoring, measurement, and internal audits ✔️ Nonconformity handling, corrective actions, and continual improvement Roles, responsibilities, and awareness in an ISMS ✔️ Benefits of ISO 27001 implementation and certification It emphasizes understanding the standard for supporting ISMS establishment/maintenance, rather than advanced implementation or auditing.

৯

১ মন্তব্য

The ISO 37003 provides guidance for organisations to develop, implement and maintain a fraud control management system (FCMS). It addresses the full lifecycle of fraud risk — from prevention and detection to response and continual improvement. The Fraud Control Management System (ISO 37003:2025) Lead Implementer certification is intended for individuals seeking to validate their advanced knowledge of Fraud Control Management System according to ISO 37003. This exam covers topics such as the scope of ISO 37003:2025, terms and definitions, context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. https://lnkd.in/dcHmhFxf

৩৩

২ মন্তব্যসমূহ

🚀 ⭐ISO/IEC 27001 Incident Management Policy🚀 ⭐ ⭐An Incident Management Policy under ISO/IEC 27001 defines how an organization prepares for, identifies, reports, analyzes, responds to, and recovers from information security incidents. The goal is to minimize the impact of security breaches, ensure timely response, and maintain business continuity. ⭐This policy ensures that: All security incidents are detected early, reported promptly, and logged consistently Roles and responsibilities for handling incidents are clearly defined A standardized incident handling process is followed from identification to closure Communication protocols are established for internal teams, management, and external stakeholders Root cause analysis is performed to prevent recurrence Lessons learned are integrated into continuous improvement of the ISMS Evidence is preserved to support forensic investigations and regulatory compliance The policy applies to all employees, contractors, systems, networks, and information assets within the ISMS scope. Overall, the Incident Management Policy ensures a structured, efficient, and repeatable incident response process, supporting ISO/IEC 27001’s objective of maintaining the confidentiality, integrity, and availability of information. #ISO27001 #IncidentManagement #InformationSecurity #ISMS #CyberSecurity #SecurityOperations #IncidentResponse #RiskManagement #InfoSecPolicy #BusinessContinuity #CyberResilience #DataProtection #ThreatManagement #SecurityGovernance

৭২

২ মন্তব্যসমূহ