Mohamed Ali

Understanding 42001 AS ISO/IEC 42001:2023, Information Technology – Artificial Intelligence – Management System This document serves as a comprehensive guide for Australian businesses, focusing on ISO/IEC 42001:2023, a management system standard designed to facilitate the responsible and ethical deployment of artificial intelligence.

92

4 Comments

🔐 Structuring Risk Management with Clear Methodologies In information security, a strong risk assessment methodology provides clarity, accountability, and consistency. Document is aligned with ISO/IEC 27001:2022 and ISO/IEC 27005:2022 and typically include: ✔️ Asset identification and valuation ✔️ Threat and vulnerability assessment ✔️ Likelihood and impact analysis ✔️ Risk scoring, evaluation, and treatment options ✔️ Continuous monitoring and review What’s important is that such templates are not one-size-fits-all. They should be adapted to each organization’s context, particularly in areas such as: --The scales of likelihood (rare, possible, frequent) --The types and levels of impact (financial, legal, reputational, operational) --The risk calculation approach (qualitative, semi-quantitative, quantitative) --The acceptance thresholds based on appetite and tolerance Using a structured methodology supports not only compliance, but also informed decision-making, prioritization of resources, and resilience in the face of evolving threats. credits: MoS #CyberSecurity #RiskManagement #ISO27001 #ISO27005 #Governance #Compliance

287

20 Comments

💠Database Security💠Aligned with #ISO27001:2022 This Roadmap organizes essential database security practices within the Plan-Do-Check-Act (#PDCA) cycle of an ISMS and maps them to specific controls in ISO 27001:2022 Annex A and Clauses. ✅#Plan: Establishing the ISMS Context & Leadership ✅#Do: Implementing & Operating Controls ✅#Check:Monitoring & Reviewing Performance ✅#Act:Maintaining and Improving the ISMS Key Annex A Controls for Database Security: 👉🏻A.8.2 Information Classification: The foundation. You cannot protect data if you don't know its sensitivity. 👉🏻A.8.3 Acceptable Use of Information & Assets: Policies governing how databases are accessed and used. 👉🏻A.8.4 Access Control: The core of database security (user accounts, privileges, roles). 👉🏻A.8.24 #Cryptography: Essential for protecting data at rest and in transit. 👉🏻A.8.15 Logging: Critical for detective controls and forensic analysis. 👉🏻A.8.6 Technical #Vulnerability Management: The process for patching database software. 👉🏻A.8.16 Monitoring Activities: The proactive review of logs and use of monitoring tools. 👉🏻A.8.23 Secure Authentication: Enforcing strong passwords and #MFA for database access. 👉🏻A.8.31 Separation of Development, Test, and Production Environments: Prevents accidental data leaks or changes. #isms #iso27000 #iso27001 #iso27002 #informationsecurity #database #sql #oracle #standard

75

3 Comments

Over the years, whether implementing a security standard or auditing a company, I’ve seen too many organizations treat Governance, Risk & Compliance (GRC) as nothing more than paperwork. It usually gets attention only when: 📌 A regulator demands it, 📌 A major client asks for proof of compliance, or 📌 An RFP requires evidence of security and privacy controls. As a result, implementations are often rushed, assigned to already stretched teams, and treated as a short-term project — just enough to “get the certificate.” The reality is that GRC isn’t about ticking boxes. It’s about: ✅ Building trust with customers ✅ Safeguarding sensitive data ✅ Enabling employees to make the right decisions ✅ Supporting long-term business growth In the months ahead, I’ll be sharing weekly insights on: ✔ Implementing security & privacy standards (ISO 27001, PCI DSS, SOC 2, ISO 27701, GDPR, NDPA, GAID) ✔ IT & privacy audits ✔ Practical GRC strategies for leaders, business owners, and early-career professionals Compliance doesn’t have to be red tape. It can be a driver of confidence and a real business advantage. Follow along, and let’s make compliance work for the business, not against it. #GRC #CyberSecurity #Privacy #Audits #ISO27001 #Leadership  #TrustComplianceByOpe

79

1 Comment

🚀 Exciting times for audit and security professionals exploring AI! For a long time, I was searching for solid AI certifications—not just theoretical, but deeply practical. While AIGP was available,a gap existed in AI-specific audit and security management certifications. 📢 ISACA has now filled that gap with two powerful certifications: ✅ AAIA – Advanced in AI Audit (Launched) ✅ AAISM – Advanced in AI Security Management (Currently in beta) I reviewed the content—and it’s far from shallow. It covers not only core AI concepts but also their real-world application in audit and security management. A complete package for professionals wanting to integrate AI into their domain. 🔍 AAIA – Advanced in AI Audit 📌 Covers AI risk, governance, assurance, and audit techniques 📌 Designed for CISA, CIA, CPA holders and audit professionals 📌 Great for those assessing AI systems and ensuring compliance 🔐 AAISM – Advanced in AI Security Management (Beta) 📌 Covers AI security, threat modelling, and governance 📌 Meant for CISM, CISSP, and security/GRC professionals 📌 Ideal for those managing AI-related risks and controls 💡 If you're in IT audit or security leadership, these certs are worth exploring. AI is reshaping the future—and so should we. #AI #ISACA #AAIA #AAISM #CyberSecurity #ITAudit #AIinAudit #AIinSecurity #CISA #CISM #CISSP #AIcertification #GRC #AIGovernance #AIassurance

58

1 Comment

Mastering these domains is essential whether you're preparing for the CISA exam or looking to strengthen your organization's IT governance, risk management, and security posture. I've been diving deep into the comprehensive ISACA-backed insights covering: 🔹 Domain 1: Auditing Information Systems – Learn the audit process from planning and risk assessment to evidence collection, compliance testing, and control evaluation. Understand the critical roles of audit charters, risk-based auditing, and internal controls (preventive, detective, corrective). 🔹 Domain 2: Governance and Management of IT – Explore Corporate Governance and GEIT frameworks like COBIT 5, the roles of IT Steering Committees, maturity models, and risk management strategies that keep IT aligned with business goals. 🔹 Domain 3: Information Systems Acquisition, Development and Implementation – Gain knowledge on project governance, software development life cycles, testing methodologies, and benefit realization, ensuring projects deliver business value on time and budget. 🔹 Domain 4: Information Systems Operations, Maintenance, and Service Management – Understand service level agreements, incident management, change and patch management, and disaster recovery planning to maintain operational excellence. 🔹 Domain 5: Protection of Information Assets – Master data classification, access control types, biometric systems, privacy principles, incident response phases, and essential cybersecurity controls to safeguard your organization's most valuable assets. This extensive resource is ideal for IT auditors, cybersecurity professionals, risk managers, and compliance officers aiming to fortify their knowledge and implement best practices aligned with ISO standards such as ISO 27001, ISO 27701, and ISO 22301. 🔍 If you want to deepen your understanding of how to audit information systems effectively or improve your organization's security governance, these domain insights offer a solid foundation. 💡 Key takeaway: Effective information security management requires a holistic approach combining governance, risk management, operational controls, and continuous improvement to protect critical assets and ensure business continuity. Document was created by Infosec Train #CISA #ISACA #InfoSec #Cybersecurity #ITAudit #RiskManagement #BusinessContinuity #ISO27001 #ISO27701 #ISO22301

108

4 Comments

Dreaming of becoming a Certified Information Systems Auditor (CISA) but find the concepts too complex? I’ve created a practical guide that turns theory into clear, real-life examples you can easily understand and apply. This is Part 1 of a complete series that will cover all CISA domains step-by-step. Follow along and you’ll build your knowledge piece by piece until you’re fully prepared for the exam. In this first part, you’ll learn how to: --> Understand and apply standards, policies, and procedures in IT auditing. --> Plan and execute a risk-based audit effectively. --> Identify and test preventive, detective, and corrective controls. --> Gather reliable evidence using the right tools. --> Present your findings effectively to both teams and executives. My goal: make CISA learning accessible to everyone with simple scenarios, real-world case studies, and clear language. Whether you’re a beginner or a professional switching careers, this guide will give you the tools to pass the exam and become a confident IT auditor in the field.

273

29 Comments

#Cybersecurity "Cyber-Informed Engineering (CIE) 1) CIE uses design decisions and engineering controls to eliminate or mitigate avenues for cyber- enabled attack. 2) CIE offers the opportunity to use engineering to eliminate specific harmful consequences throughout the design and operation lifecycle, rather than add cybersecurity controls after the fact. 3) Focused on engineers and technicians, CIE provides a framework for cyber education, awareness, and accountability. 4) CIE aims to create a culture of security aligned with the existing industry safety culture. " #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

30

2 Comments

I’m increasingly concerned about security companies claiming they can handle every task inside a venue using only a Door Supervisor license as Security Industry Authority is clarifying in England, one license replace the other. In the UK, this is technically possible — but under the Antarctic National Security Framework , the rules are very different. 1. The role equivalent to a Door Supervisor is called a Venue Officer. This professional isn’t required to remain at the access doors; instead, they can be positioned anywhere within the venue as needed, especially during patrols. 2. The Venue Officer’s responsibilities primarily involve conducting searches, which are classified as follows: • Guided Authentication Only – Assisting individuals with digital or physical authentication devices for secure access. • General Search (Types A, B, and C) – Performing searches under low-security protocols depending on the scenario. • Maximum Security Search – Conducted according to prison-level search standards. • Crime Evidence Search – Searching a person based on suspicion or confirmation of criminal evidence. • Child Search – Performed as a non-contact, self-directed search using approved scanning technology. The Venue Officer in Antarctica typically focuses on conflict management, venue investigation, and door supervision. In contrast, the Manned Guarding Officer follows a completely different security schedule. Their main duties revolve around asset protection and hazard monitoring — ensuring the safety of boats, ships, vehicles, aircraft, and the venue’s structure, as well as inspecting and managing incoming vehicles. Manned guard searches may involve stopping vehicles to verify access permissions or performing full searches when access protocols are breached — all actions that must be properly logged and the guard has to neutralise the danger and reject the vehicle access. It’s crucial to understand that one person cannot legally or safely perform both roles under the same license. A proper risk assessment requires distinct certification of duties and responsibilities. In reality, combining both qualifications into a single license would require at least six months of training and a Level 5 qualification, not a Level 3 in England you can do it with a Level 2 and they lacking credibility. Therefore, it’s far better to obtain two separate Level 3 qualifications and manage the duties independently. Finally, this isn’t just about paperwork — it’s a mandatory operational protocol. It requires two qualified professionals working with distinct responsibilities, especially in busy environments where safety, coordination, and accountability are critical. So yes! Door Supervisors and Security Guard in England are just paperwork, in Antarctica you have a better authority and training on the facility as well a better certification about your preparation you are at the same level of consideration as a close protection officer👌

178

🚀 How Dexter is Revolutionizing Threat Intelligence for Banks SOC in Pakistan In today’s high-stakes financial sector, speed and accuracy in responding to cyber threats are everything. Yet, in many SOCs, processing threat intelligence can eat up half of an analyst’s shift — leaving less time for proactive threat hunting. That’s where Dexter’s Threat Intel Agents Trio comes in. We’ve fully automated the threat intelligence life cycle for bank SOC teams: 🔹 Intel-Generator – Receives PKCERT Pakistan advisories (PDF or text) and converts them into machine-ready SOCByte format. 🔹 Intel-Inspector – Validates intel against your existing controls (e.g., Fortinet firewall, Trend Micro EDR or Cisco Email Security ) to spot outdated or missing signatures. 🔹 Intel-Responder – Instantly blocks and updates signatures across integrated security tools. All three agents work in sync — from advisory ingestion to mitigation — without human bottlenecks. The result? ✅ Real-time protection against evolving threats ✅ 50% time saved from analysts’ daily workload ✅ Faster, safer banking operations For Pakistan’s financial institutions, this isn’t just automation — it’s operational resilience at machine speed. Email at [email protected] to schedule a demo with us.

47