F.A.

Still not sure whose views mine are.

[F.A. @RecedingLights]

NZ Defence Industry Strategy just dropped: https://t.co/po3NThhmv7

[The Diplomat @Diplomat_APAC]

NATO diplomacy signals New Zealand’s shift toward Europe, and its ambitions to expand dual-use technology exports to the region. https://t.co/1xcGpoqcZu

[F.A. @RecedingLights]

NZ takes a major step toward digital sovereignty & resilience. The new all-of-government Mātai data centre—run by the GCSB and housed in an NZDF base—offers a state-owned and locally-hosted alternative to private infrastructure (for government agencies).

https://t.co/XCBCy13s6c

[F.A. @RecedingLights]

@lukOlejnik Securitization

[F.A. @RecedingLights]

@UK_Daniel_Card WOULD we see it, if the main risk consequence wasn't intrusion but leakage? When actors know shit they shouldn't, are we often able to confidently articulate the source of that info?

psa - I'm not sure I believe what I'm saying - you've just been sucked into my neural whirlpool.

[F.A. @RecedingLights]

@HostileSpectrum What do you think is incentivizing such naming behavior? I've heard people boiling down to a CTI marketing/clout tactic, but not sure I'm fully on board with that explanation.

[F.A. @RecedingLights]

@McGrewSecurity It's completely fine to want to solve problems IN the status quo - especially if solving the problems OF the status quo means broadening beyond just a technological perspective.

[F.A. @RecedingLights]

"The biggest financial impact has been on the city’s neediest: the young, the old, and those with issues tapping in and out of stations."

https://t.co/joa7MGs63F

[New Zealand Institute of International Affairs @NZIIA_live]

Looking with Five Eyes: Attitudes to China across the “Anglosphere” https://t.co/KJMdkubkJw

[F.A. @RecedingLights]

NCSC (lead cyber agency) update on absorption of CERT-NZ - https://t.co/EGSmUTBxn9 Tl;DR: "phasing out ‘CERT NZ’ as a brand and name", and "NCSC delivering CERT NZ functions and services"

[Ravi Nayyar @ravirockks]

@stephendziedzic Great reporting.

I'm assuming those roving cyber response units are part of the single 'regional cyber crisis response team' housed within DFAT, as committed to under our 2023 cyber strategy?

[Stephen Dziedzic @stephendziedzic]

Update: NZ has confirmed this hack on PIF (without attributing to China) and publicly confirmed that Australia assisted, saying response from Canberra was "deeply appreciated"

DFAT more circumspect, simply saying cyber teams have responded to "a range of incidents" in Pacific

[F.A. @RecedingLights]

An example of what regional cybersecurity cooperation can look like in the Pacific. Australia sent cyber incident responders to Fiji after Chinese hackers (attribution by the ACSC) conducted espionage operations against Pacific Islands Forum systems.
https://t.co/Stn4YvA3d6

[F.A. @RecedingLights]

@GregDAustin If we confine CISOs to a technical scope then aren't we just replicating the unhelpful 'cybersec is ICT' paradigm? IMO the CISO should sit across the entire scope of breach impacts - responsible for preparing the entire org for what to do when an incident hits.

[F.A. @RecedingLights]

@GregDAustin This makes sense, but I disagree with the confinement of CISO scope to mostly technical concerns. As you know - impacts aren't just technical, they're social.

In my view a CISO that only writes technical system recovery plans is bad at their job.

[F.A. @RecedingLights]

@GregDAustin @AICDirectors Ah I see. I think what I'm saying is that we should judge a CISO by their failure to build organizational cyber resilience - not their failure to prevent a specific incident from happening.

[F.A. @RecedingLights]

@GregDAustin From my perspective I'd say that if a CISO has done the job properly, the plans of what EVERYONE needs to do post-breach should be in place.

They should be like a conductor - helping the band players know what the hell to do when its all falling apart.

[F.A. @RecedingLights]

@ravirockks @GregDAustin @withers_glenn @AdamPeter_Henry To clarify I think that resilience has always been the end-goal of GOOD cybersec risk mgmt.

I define it as the ability of an information system and its users to withstand, recover from, and adapt to breaches of confidentiality, integrity, availability.

[F.A. @RecedingLights]

@ravirockks @GregDAustin @withers_glenn @AdamPeter_Henry I'll confess I'm slightly baffled by the separation of these concepts.
Separating resilience from security is like splitting up impact and likelihood. Since when did 'cybersecurity' not care about impact management?