Category: Organisation Types

Organisation Types for membership

CISA and Partners Release Updated Advisory on Scattered Spider Group

Agency News, Cyber Security CII sector, Industry News
CISA, along with the Federal Bureau of Investigation, Canadian Centre for Cyber Security, Royal Canadian Mounted Police, the Australian Cyber Security Centre’s Australian Signals Directorate, and the Australian Federal Police and National Cyber Security Centre, released an updated joint Cybersecurity Advisory on Scattered Spider—a cybercriminal group targeting commercial facilities sectors and subsectors. This advisory provides updated tactics, techniques, and procedures (TTPs) obtained through FBI investigations conducted through June 2025.
Scattered Spider threat actors have been known to use various ransomware variants in data extortion attacks, most recently including DragonForce ransomware. While Scattered Spider often changes TTPs to remain undetected, some TTPs remain consistent. These actors frequently use social engineering techniques such as phishing, push bombing, and subscriber identity module swap attacks to obtain credentials, install remote access tools, and bypass multi-factor authentication.
The Mitigations section of the Scattered Spider joint Cybersecurity Advisory offers critical infrastructure organizations and commercial facilities recommendations to fortify their defenses.
Leave a comment

Cyber Preparedness and Incident Response to Critical Infrastructure

Cyber Security CII sector
Dr. Ron Martin, Professor of Practice, Capitol Technology University
Every organization worldwide must protect its cyber resources from unauthorized intrusions. Cyber preparedness against attacks is essential. Recently, NIST released the Cybersecurity Framework (CSF) 2.0. The CSF suggests that each organization acquire knowledge of six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.
NIST also released Special Publication (SP) 800- 61 Revision 3, titled “ Incident Response Recommendations and Considerations for Cybersecurity Risk Management. “ The purpose of NIST SP 800-61r3 is to assist organizations in incorporating cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities.
This integration aims to help organizations:
1. Prepare for incident responses by improving readiness.
2. Reduce the number and impact of incidents that occur.
3. Enhance the efficiency and effectiveness of incident detection, response, and recovery activities.
The article will focus on showing a nexus between these two publications. Before we discuss the initiatives outlined in SP 800- 61r3, let’s summarize CSF 2.0. The CSF provides guidance for organizations to manage and reduce cybersecurity risks. One important addition to the framework is the GOVERN function. Governance establishes a risk management strategy that establishes roles and responsibilities and enforces policies and procedures. Another function is the implementation of safeguards that can reduce the likelihood and impact of cybersecurity incidents.
Organizations must adopt CSF 2.0 because it will provide a flexible framework to effectively manage and reduce cybersecurity risks.  It assists organizations of all sizes to understand, assess, prioritize, and communicate their cybersecurity posture.  CSF 2.0 allows organizations to tailor their approach to unique risks, missions, and objectives by focusing on desired outcomes rather than prescriptive actions.  It integrates cybersecurity with enterprise risk management, supports continuous improvement, and enhances communication between executives, managers, and practitioners.  Its supplementary online resources, such as Quick Start Guides and Implementation Examples, make it accessible and actionable for organizations at any stage of cybersecurity readiness.
NIST SP 800-61r3’s purpose is to assist organizations in incorporating cybersecurity incident response recommendations and considerations into their cybersecurity risk management activities.
It organizes its recommendations and considerations using the NIST Cybersecurity Framework (CSF) 2.0 Functions.
Critical Infrastructure Protection Mechanisms are similar globally. They are part of a country’s legal requirements, and the basic tenets of protection, preparedness, and incident responses are similar.
The incident response life cycle model described in NIST SP 800-61r3 is based on the six NIST Cybersecurity Framework (CSF) 2.0 Functions. It reflects the integration of incident response into broader cybersecurity risk management activities.
Importance of Cybersecurity Risk Management Incident Response is outlined below:
• Minimizing Damage
• Ensuring Business Continuity
• Proactive Risk Management
• Improved Detection and Response
• Compliance with Regulations
• Building Stakeholder Confidence
• Learning and Continuous Improvement
• Reducing Long-Term Costs
• Adapting to Evolving Threats
• Protecting Sensitive Data
Cybersecurity risk management and incident response are essential for protecting an organization’s assets, ensuring operational resilience, and maintaining trust in an increasingly threat-prone digital environment. Critical infrastructure protection practitioners should review these documents to enhance their organizations’ cybersecurity posture.
SP 800-61r3 contains community profiles in Table 2, which outline CSF preparation and lessons learned. Table 3 contains the second part of the Community Profile: Incident Response. Both tables recommend an element priority with suggested considerations.
Since many NIST Publications are reviewed and used internationally, NIST provides translations of key publications to support the global understanding of cybersecurity and privacy resources. I recommend that the English version be reviewed alongside the translation.
Leave a comment

Critical Infrastructure Protection & Resilience Europe announces Preliminary Conference Programme

Agency News, Cyber Security CII sector, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
The 10th Critical Infrastructure Protection & Resilience Europe, taking place in Brindisi, Italy on 14th-16th October, has announced its Preliminary Conference Programme, with a fantastic line up of international expert speakers sharing their thoughts, experiences and expertise at this premier conference.
Download your guide at www.cipre-expo.com/guide
The second ‘Critical Infrastructure Protection Week in Europe’ will take place in Italy, Brindisi and will see the International Association for CIP Professionals (IACIPP) host the ‘Critical Infrastructure Protection & Resilience Europe’ conference and exhibition and ‘The International Emergency Management Society (TIEMS)’ conference as the two key events as part of the initiative.
Download your preliminary conference guide now
The Preliminary Conference Programme guide provides you with the latest conference agenda, speakers and information to plan your attendance to the premier conference for the critical infrastructure protection, civil contingencies and safer cities professionals.
Download your guide at www.cipre-expo.com/guide
Register online today at: https://www.cipre-expo.com/buy-tickets/
#criticalinfrastructure #criticalinfrastructureprotection #cybersecurity #resilience #emergencymanagement #transport #energy #communications #security #criticalassets #criticalcommunications #firstresponders #nis2 #cerdirective #uas #drones #riskmanagement #riskmitigation
Leave a comment

CISA and Partners Urge Critical Infrastructure to Stay Vigilant in the Current Geopolitical Environment

Agency News, Cyber Security CII sector, Industry News
CISA, in collaboration with the Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center (DC3), and the National Security Agency (NSA), released a Fact Sheet urging organizations to remain vigilant against potential targeted cyber operations by Iranian state-sponsored or affiliated threat actors.
Over the past several months, there has been increasing activity from hacktivists and Iranian government-affiliated actors, which is expected to escalate due to recent events. These cyber actors often exploit targets of opportunity based on the use of unpatched or outdated software with known Common Vulnerabilities and Exposures or the use of default or common passwords on internet-connected accounts and devices.
At this time, we have not seen indications of a coordinated campaign of malicious cyber activity in the U.S. that can be attributed to Iran. However, CISA, FBI, DC3, and NSA strongly urge critical infrastructure asset owners and operators to implement the mitigations recommended in the joint Fact Sheet, which include:
• Identifying and disconnecting operational technology and industrial control systems devices from the public internet,
• Protecting devices and accounts with strong, unique passwords,
• Applying the latest software patches, and
• Implementing phishing-resistant multifactor authentication for access to OT networks.
Review the joint Fact Sheet: Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest and act now to understand the Iranian state-backed cyber threat, assess and mitigate cybersecurity weaknesses, and review and update incident response plans to strengthen your network against malicious cyber actors.
Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest
CISA, the Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center (DC3), and the National Security Agency (NSA) published Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest. This joint fact sheet details the need for increased vigilance for potential cyber activity against U.S. critical infrastructure by Iranian state-sponsored or affiliated threat actors.
Defense Industrial Base companies, particularly those possessing holdings or relationships with Israeli research and defense firms, are at increased risk.
At this time, we have not seen indications of a coordinated campaign of malicious cyber activity in the U.S. that can be attributed to Iran. However, CISA urges owners and operators of critical infrastructure organizations and other potentially targeted entities to review this fact sheet to learn more about the Iranian state-backed cyber threat and actionable mitigations to harden cyber defenses.
Leave a comment

DHS S&T Releases New Tool to Strengthen Global Navigation Satellite Systems for Critical Infrastructure

Agency News, Industry News, Space Sector
The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) launched an important new resource on GitHub to help safeguard critical infrastructure: the Global Navigation Satellite System (GNSS) Test Vector Suite and Distribution Methodology. This effort supports Executive Order 13905, which aims to protect essential Positioning, Navigation and Timing (PNT) systems used in industries like energy, transportation and telecommunications.
PNT systems rely on accurate GNSS signals to function properly. If these signals are disrupted – whether by natural events, technical failures, or cyber threats – critical services could be impacted. To address this risk, the GNSS Test Vector Suite and Distribution Methodology provides critical infrastructure owners and operators the tools to independently identify and define appropriate test scenarios that support standards conformity assessments, to help evaluate and improve the resilience of their systems.
“Accurate and precise Positioning, Navigation, and Timing information is vital to the nation’s critical infrastructure and is the backbone of the many services we depend on daily, from keeping our lights on to ensuring planes land safely,” said Julie Brewer, DHS Acting Under Secretary for Science and Technology. “This new toolset gives people responsible for safeguarding these systems a way to independently test and strengthen them, ensuring our nation’s infrastructure is more secure against potential disruptions.”
The GNSS Test Vector Suite includes a standardized set of test scenarios and tools that allow developers and testers to assess how well their equipment can handle challenges like signal interference or spoofing attempts. The process works as follows:
- The GNSS Test Vector Suite generates simulated data - The data is converted into signals that mimic real-world GNSS systems - These signals are fed into designated GNSS devices or other PNT equipment, enabling users to evaluate how their systems respond to simulated disruptions
By offering this testing capability, S&T is helping critical infrastructure operators identify vulnerabilities in PNT systems and ensure they meet established resilience standards. This is a critical step in protecting the essential systems that Americans rely on every day.
Leave a comment

EU Space Act - Strengthening Safety, Resilience and Sustainability in Space

Agency News, Industry News, Space Sector
The EU Space Act is a legislative initiative by the European Commission that introduces a harmonised framework for space activities across the Union. The proposal, launched on 25 June 2025, aims to ensure safety, resilience, and environmental sustainability, while boosting the competitiveness of the EU space sector.
Europe’s current regulatory landscape is fragmented—13 different national approaches increase complexity and costs for businesses. The EU Space Act will create a single market for space activities, making it easier for companies, particularly start-ups and SMEs, to grow and operate across borders.
What will the EU Space Act do?
The proposal is structured around three key pillars:
- Safety
The Act introduces robust rules for tracking space objects and mitigating space debris, preserving Europe’s secure and uninterrupted access to space.
- Resilience
Tailored cybersecurity requirements will strengthen protection of European space infrastructure and ensure business continuity.
- Sustainability
Operators will need to assess and reduce the environmental impact of their space activities, while benefiting from support for innovation in emerging technologies like in-orbit servicing and debris removal.
The new rules will apply to both EU and non-EU operators providing space services in Europe. Proportional requirements will be scaled based on company size and risk profile, ensuring a fair, innovation-friendly regulatory environment.
Support for Industry and Member States
A targeted support package will help businesses and Member States transition smoothly. Special attention is given to reducing administrative burdens and facilitating compliance, especially for start-ups, SMEs and small mid-caps.
Next Steps
The legislative proposal will be negotiated under the ordinary legislative procedure by the European Parliament and the Council.
For more details visit: EU Space Act - European Commission
Leave a comment

ENISA develope European Vulnerability Database (EUVD) as provided for by the NIS2 Directive

Agency News, Cyber Security CII sector, Industry News
The European Union Agency for Cybersecurity (ENISA) has developed the European Vulnerability Database - EUVD as provided for by the NIS2 Directive. The EUVD service, to be maintained by ENISA, is now operational.
The database provides aggregated, reliable, and actionable information such as mitigation measures and exploitation status on cybersecurity vulnerabilities affecting Information and Communication Technology (ICT) products and services.
The objective of the EUVD is to ensure a high level of interconnection of publicly available information coming from multiple sources such as CSIRTs, vendors, as well as existing databases. In order to meet this objective, the platform is building on a holistic approach. As an interconnected database the EUVD allows for better analysis and facilitates the correlation of vulnerabilities by facilitating the open-source software Vulnerability-Lookup, thereby enabling enhanced cybersecurity risk management.
The EUVD offers therefore a trusted, more transparent and broader source of information and further improves situational awareness while limiting exposure to threats.
The aggregated information of the database is displayed through dashboards. The EUVD offers three dashboard views: for critical vulnerabilities, for exploited ones, and for EU coordinated ones. The EU Coordinated Vulnerabilities lists the vulnerabilities coordinated by European CSIRTs and includes the members of the EU CSIRTs network.
The collected and referenced vulnerability information comes from open-source databases. Additional information is added via advisories and alerts issued by national CSIRTs, mitigation and patching guidelines published by vendors, together with exploited vulnerability markings. EUVD data records may include:
- A description of the vulnerability;
- ICT products or ICT services affected and/or affected versions, the severity of the vulnerability and how it could be exploited;
- Information of existing relevant available patches or guidance provided by competent authorities including CSIRTs, and addressed to users on how to mitigate risks.
To meet the requirement of the NIS2 Directive, ENISA initiated a cooperation with different EU and international organisations including MITRE’s CVE Programme. ENISA is in contact with MITRE to understand the impact and next steps following the announcement on the funding to the Common Vulnerabilities and Exposures Program. CVE data, data provided by ICT vendors disclosing vulnerability information via advisories, and relevant information such as CISA’s Known Exploited Vulnerability Catalogue are automatically transferred into the EUVD. This will also be achieved with the support of Member States who established national Coordinated Vulnerability Disclosure (CVD) policies and who designated one of their CSIRTs as the coordinator, ultimately making the EUVD a trusted source for enhanced situational awareness in the EU.
As a CVE Numbering Authority (CNA), ENISA can register vulnerabilities and support vulnerability disclosure since January 2024, in relation to:
- vulnerabilities in IT products discovered by EU CSIRTs themselves; and
- vulnerabilities reported to EU CSIRTs for coordinated disclosure as long they are not in the scope of another CVE Numbering Authority.
Leave a comment

20,000 malicious IPs and domains taken down in INTERPOL infostealer crackdown

Agency News, Cyber Security CII sector, Industry News
More than 20,000 malicious IP addresses or domains linked to information stealers have been taken down in an INTERPOL-coordinated operation against cybercriminal infrastructure.
During Operation Secure law enforcement agencies from 26 countries worked to locate servers, map physical networks and execute targeted takedowns.
Ahead of the operation, INTERPOL cooperated with private-sector partners Group-IB, Kaspersky and Trend Micro to produce Cyber Activity Reports, sharing critical intelligence with cyber teams across Asia. These coordinated efforts resulted in the takedown of 79 per cent of identified suspicious IP addresses.
Participating countries reported the seizure of 41 servers and over 100 GB of data, as well as the arrest of 32 suspects linked to illegal cyber activities.
Infostealer malware is a primary tool for gaining unauthorized access to organizational networks. This type of malicious software extracts sensitive data from infected devices, often referred to as bots. The stolen information typically includes browser credentials, passwords, cookies, credit card details and cryptocurrency wallet data.
Additionally, logs harvested by infostealers are increasingly traded on the cybercriminal underground and are frequently used as a gateway for further attacks. These logs often enable initial access for ransomware deployments, data breaches, and cyber-enabled fraud schemes such as Business Email Compromise (BEC).
Following the operation, authorities notified over 216,000 victims and potential victims so they could take immediate action - such as changing passwords, freezing accounts, or removing unauthorized access.
Vietnamese police arrested 18 suspects, seizing devices from their homes and workplaces. The group's leader was found with over VND 300 million (USD 11,500) in cash, SIM cards and business registration documents, pointing to a scheme to open and sell corporate accounts.
House raids were carried out by authorities in Sri Lanka leading to 12 arrests and the identification of 31 victims.
The Hong Kong Police analysed over 1,700 pieces of intelligence provided by INTERPOL and identified 117 command-and-control servers hosted across 89 internet service providers. These servers were used by cybercriminals as central hubs to launch and manage malicious campaigns, including phishing, online fraud and social media scams.
Neal Jetton, INTERPOL’s Director of Cybercrime, said:
“INTERPOL continues to support practical, collaborative action against global cyber threats. Operation Secure has once again shown the power of intelligence sharing in disrupting malicious infrastructure and preventing large-scale harm to both individuals and businesses.”
Leave a comment

From heatwaves to cyber threats: a comprehensive new guide to today’s hazards

Agency News, Cyber Security CII sector, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
The United Nations Office for Disaster Risk Reduction (UNDRR) and the International Science Council (ISC) have released an updated edition of their comprehensive hazard guide, offering clear, standardized information on 282 hazards - from wildfires and earthquakes to cyberattacks and pandemics.
The new edition reflects the complex and interconnected nature of today's global risk landscape. Hazards increasingly occur together, cascade across systems, and amplify one another. In response, the updated profiles emphasize a multi-hazard approach-critical for effective early warning systems, emergency planning, and disaster resilience. Originally launched in 2021 as the first resource of its kind, the hazard definitions and classification provide an authoritative technical foundation for disaster risk reduction efforts worldwide. This updated edition builds on that foundation with:
- 282 reviewed hazards across 8 types and 39 clusters
- Improved, machine-readable format to support their use across digital tools and systems. E.g. the updated hazard taxonomy with standard definitions enables the new generation UNDRR-UNDP-WMO disaster tracking system.
- Clearer articulation of hazard interactions and multi-hazard scenarios
- User-informed revisions and new content to support real-world planning and response
"From local governments to humanitarian agencies, the need for consistent, science-based hazard information is universal. These profiles reflect the best available scientific understanding of hazards and offer a foundation for evidence-based policies that reduce risk and build resilience," said Salvatore Aricò, CEO, International Science Council.
"Reliable and standardized hazard data are essential for informing disaster risk reduction strategies. This update helps countries implement the Sendai Framework for Disaster Risk Reduction to reduce losses by 2030," said Kamal Kishore, the Special Representative of the United Nations Secretary-General for Disaster Risk Reduction.
"This updated edition reflects what we've learned: hazards are not standalone events. They are part of a complex web of risk. By bringing together diverse expert and user input, we've made these profiles more actionable, more interconnected, and more immediately useful," said Professor Virginia Murray, Chair of the Hazard Information Profiles Steering Group.
The revision process engaged over 270 experts, reviewers, and users from across sectors and regions. A dedicated User Group, Multi-Hazard Group, and Machine Actionability Group ensured the profiles remain practical, future-ready, and inclusive of diverse perspectives and needs.
Since the initial release, the hazard profiles have been widely used by national disaster management agencies, UN bodies, researchers, and humanitarian organizations for planning, monitoring, risk assessments, and training. This success has prompted the current update to ensure that they remain relevant and up to date.
Leave a comment

UK and allies expose Russian intelligence campaign targeting western logistics and technology organisations

Agency News, Cyber Security CII sector, Industry News
The UK government and international allies have today exposed Russia’s military intelligence service for a campaign of malicious cyber activity against western logistics entities and technology companies.
In a new advisory, the UK's National Cyber Security Centre – a part of GCHQ – and partners from ten countries have revealed details about how military unit 26165 of Russia’s GRU has conducted a malicious cyber campaign against both public and private organisations since 2022.
This has included targeting of organisations involved in the co-ordination, transport and delivery of support to Ukraine, and across the defence, IT services, maritime, airports, ports and air traffic management systems sectors in multiple NATO members.
Unit 26165 – also known as APT 28 – was able to gain initial access to victim networks using a mix of previously disclosed techniques, including credential guessing, spear-phishing and exploitation of Microsoft Exchange mailbox permissions. They also targeted internet-connected cameras at Ukrainian border crossings and near military installations to monitor and track aid shipments to Ukraine.
The UK’s support for Ukraine remains steadfast as it continues to suffer Russia’s barbaric war. In total, the UK has committed £13 billion in military aid, and this week 100 new sanctions on Russia were announced, targeting entities supporting its military, energy, and financial institutions. This followed Russia launching its biggest drone attack of the war last weekend.
Supporting UK organisations to stay resilient to cyber threats is helping to secure the foundations for the government’s Plan for Change in a more volatile and unstable world. Along with details of the threat, the advisory includes mitigation advice to help defend against the malicious activity.
Executives and network defenders at technology and logistics companies should recognise the elevated threat of targeting and take immediate action to protect themselves.
Actions include increasing monitoring, using multi-factor authentication with strong factors – such as passkeys – and ensuring security updates are applied promptly to manage vulnerabilities.
The NCSC has co-sealed this advisory alongside agencies from the United States, Germany, Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France and the Netherlands.
Leave a comment
1 … 4 5 6 7 8 … 60