Cyber Security News Update - Feb 2025
A brief summary of significant developments in the rapidly evolving world of cyber security. New Cyber Security Law in Australia * The little book of scams * New IMS software * Content Credentials and more.
New Cyber security law in Australia
In November 2024, the Cyber Security Act 2024 became law in Australia and affects organization doing business in that jurisdiction. The Act addresses legislative gaps to bring Australia in line with international best practice, ensuring Australia is on track to become a global leader in cyber security.
The Cyber Security Act includes measures to:
- Mandate minimum cyber security standards for smart devices
- Introduce a mandatory ransomware and cyber extortion reporting obligation for certain businesses to report ransom payments.
- Introduce a Limited Use obligation for the National Cyber Security Coordinator to encourage industry engagement with the government following cyber incidents
- Establish a Cyber Incident Review Board to conduct reviews of significant cyber incidents and share lessons learned.
The mandatory ransomware and cyber extortion reporting obligation applies to businesses with an annual turnover that exceeds $3 million. The obligation is reported to kick in from late May 2025.
The Limited Use component is aimed at ensuring that organizations suffering a security incident feel comfortable engaging and sharing information with the government without worrying about it being passed on to regulators or law enforcement.
This hyperlink is provided for your convenience. If you prefer not to click on hyperlinks, you can search for the information at homeaffairs.gov.au.
IMS Software updated
This week sees the conclusion of the v347 update to our Qudos3 IMS software. The update includes new document management functionality that makes it even easier to comply with the acknowledgement requires in ISO 27001, enhanced security user management, and improved features / workflow in the Actions, Meetings, Training, and Supplier Management modules in particular.
Cloud installations have been updated on an agile basis over the past several months, and a waterfall release will take place next week for our self-hosted clients.
Development on the 348 update has commenced - to include a powerful, new BI-style dashboard and enhanced Risk management tools.
The small (but significant) change in ISO 27001
The headline news in the 2022 update of the ISO 27001 Information security standard, was, of course, the Annex Controls. The whole concept of those was changed from 14 groups (or domains as they were referred) down to just 4. A large number of the individual controls were also added, deleted, combined or changed in some way. We recently published an article about just one of those changes that it would be easy to miss, but may have implications for your business. Read the full article here or navigate to the article from our blog menu.
The Little Book of Scams
The best way to protect yourself against scams is through awareness and education. The Little Book of Scams is recognised internationally as an important tool for consumers and small businesses to learn about scams. It includes:
- The most common scams to watch out for
- The different ways scammers can contact you
- The tools scammers use to deceive you
- The warning signs
- How to protect yourself against scams
- Where you can find help.
The book is published by the Australian Government's National Anti-Scam Centre and may be useful for information security awareness training.
A PDF download of the book is available here: Download
This hyperlink is provided for your convenience. If you prefer not to click on hyperlinks, you can search for the information at scamwatch.gov.au.
LinkedIn, AI, and your data
In late 2024, we also published an article about an update to LinkedIn's user agreement relating to the use of your content for 'model training'. Other platforms may also be following a similar path. The model training has been suspended by LinkedIn for users in UK, the EEA (European Economic Area - which includes the EU countries, Switzerland, Iceland, Liechtenstein, and Norway), and Hong Kong. Users are essentially opted out. However, in other countries such as Australia, New Zealand and Singapore, individual LinkedIn users will need to decide whether to opt out or stay opted in. If you haven't already done so, now is a good time to consider which option suits you.
This hyperlink is provided for your convenience. If you prefer not to click on it, you can search for the information on our blog menu.
Content credentials
While many people are using generative AI to create (or modify) and distribute useful creative content faster, there are risks when the technology is used for malign purposes. For example, malicious actors can use manipulated or fully synthetic media in cyber threat, criminal, or other malign activity against organizations and individuals to impersonate and misinform. Due to this widespread ability to create or modify media, verifiable media is becoming critical for ensuring transparency by providing context about the media’s provenance and integrity. Provenance is the term used for a source's 'background' - including its origin and purpose.
Content Credentials™ are a provenance solution that uses cryptographically signed metadata to describe the provenance of media.
An information sheet has been jointly published by security agencies in the US, UK, Canada, and Australia.
For more information, download PDF document here:
Content Credentials: Strengthening multimedia integrity in the generative AI era
This hyperlink is provided for your convenience. If you prefer not to click on hyperlinks, you can search for the information at cyber.gov.au.
Are you ready to start your journey to ISO 27001?
The first step to commencing a management system based on ISO 27001 is to conduct a Gap Analysis. We can provide a qualified, experience certification auditor to perform a professional Gap Analysis service for you.
Contact us today to discuss your needs!
Click the LinkedIn Follow button below to receive notification of further articles and webinars.
There's nothing like word of mouth to share creative content. So, if you found this blog informative, please share it with a colleague or business associate.