#NSBCS.095 - Why Simplifying Your Approach to Cyber Makes Sense

Written By Shane Bell

Source: NSB Cyber

 

Why Simplifying Your Approach to Cyber Makes Sense

There’s a common belief that cyber security needs to be complex. Dozens of policies, a stack of frameworks, hundreds of controls. Because the more controls, the more secure you are, right?

Not necessarily.

For large corporates and multinationals with extensive systems and dedicated security teams, a more complex program might make sense. But for most organisations, that level of complexity isn’t always realistic or necessary. A more pragmatic, simplified approach is often not only easier to manage but can be just as effective.

Start with the basics

The truth is, you don’t need a policy for every possible risk, or controls that your team doesn’t have the time or capacity to maintain. What you do need to do is to get the fundamentals right. Frameworks like the ACSC Essential Eight are valuable because they cover the controls that consistently make the biggest difference in reducing cyber risk. Things like patching systems promptly, implementing multi-factor authentication, restricting administrative privileges, and backing up critical data. If you can get these baseline controls right and apply them to the systems that hold your most sensitive data, you’re already addressing the majority of common attack vectors.

Progress over perfection

Once the basics are in place and working well, you can start layering on additional controls that make sense for your organisation. This might mean adding vulnerability scanning, improving logging and monitoring, or running tabletop exercises to test your incident response plan.

The key is to build maturity over time - in line with your risk profile, your resources, and your operational priorities. Trying to do everything at once often leads to fatigue, wasted effort, and gaps in the areas that matter most.

A simplified approach doesn’t mean less security. It means focusing on what counts. By getting the basics right first, you:

  • Tackle the highest risks early.

  • Avoid spreading resources too thin.

  • Make cyber something your team can actually understand and maintain.

Cyber security doesn’t have to be overwhelming. Start with a few core controls, apply them where they matter most, and build from there. Over time, you’ll find that simplicity not only strengthens your security but also makes it more sustainable. A strong cyber program isn’t doing everything - it’s about doing the right things, and doing them well.

For information on NSB Cyber’s Cyber Resilience capabilities or to book a meeting with our team, click here.

What we read this week

  • Hackers Claim Discord Breach Exposed Data of 5.5 Million Users - Discord has confirmed that attackers accessed a third-party customer support service, not its own systems, and are falsely claiming to have stolen data from 5.5 million users. The company said around 70,000 users may have had government ID photos exposed due to its vendor’s age-verification process, disputing the hackers’ claim of 2.1 million leaked IDs. According to the attackers, they compromised a support agent’s outsourced business process outsourcing (BPO) account to access Discord’s Zendesk instance for 58 hours, allegedly stealing 1.6 TB of data, including ticket attachments and transcripts. The hackers claimed this data contained user details such as emails, phone numbers, partial payment information, and demanded a ransom of $5 million, later reduced to $3.5 million. Discord has refused to pay the extortion demand, asserting that the figures shared are inaccurate and that it will not reward those responsible for the breach.

  • CrowdStrike Falcon Windows Sensor Vulnerability Let Attackers Execute Code and Delete Files on Host - CrowdStrike has patched two medium severity flaws in its Falcon sensor for Windows, CVE-2025-42701 and CVE-2025-42706, that could allow attackers with local code execution to delete arbitrary files. The first vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition (CVSS 5.6), and the second is a logic error in origin validation (CVSS 6.5). Although these do not permit remote code execution, exploitation could disrupt the Windows operating system or the Falcon sensor itself. All Falcon Windows sensors up to version 7.28 and some older builds for Windows 7 and Server 2008 R2 are affected, with fixes available in version 7.29 and corresponding hotfixes for earlier versions. CrowdStrike identified the issues internally, released coordinated patches, and confirmed that no exploitation has been observed in the wild.

  • Australia Can Help Build Digital Trust in the Indo-Pacific - Rapid and secure coordination across the Indo-Pacific is relying on trusted digital systems that function in low-connectivity environments and enable partners to act quickly and independently. This article recently written by the Australian Strategic Policy Institute (ASPI) recognises Australia can strengthen this capability by supporting interoperable, encrypted communication platforms such as ATAK, goTenna, and Signal, which enable real-time data sharing, offline operation, and precise access control for patrols and responders. Enhancing these tools with stronger encryption, scalable training, and local autonomy would empower regional partners while building long-term digital trust and operational continuity. By treating this digital coordination layer as critical infrastructure, Australia can deliver lightweight, flexible, and secure technologies capable of deepening regional trust and cooperation without imposing control.

  • Crimson Collective Leverages AWS Services to Exfiltrate Sensitive Data - Crimson Collective is a newly identified threat group conducting advanced data exfiltration and extortion campaigns against AWS environments, claiming to have stolen private repositories from Red Hat’s GitLab. The group exploits leaked long-term AWS access keys often found using TruffleHog and verifies them with the GetCallerIdentity API before moving laterally within compromised accounts. Once inside, they establish persistence by creating new users, generating additional access keys, and escalating privileges by attaching the arn:aws:iam::aws:policy/AdministratorAccess policy, granting full control over affected environments. Rapid7’s analysis of CloudTrail logs revealed consistent indicators such as the TruffleHog user agent and multiple compromised accounts.

  • APT Groups Abuse ChatGPT to Build Advanced Malware and Phishing Kits - Security researchers at Volexity have identified a China-linked threat group, UTA0388, using artificial intelligence (AI) platforms such as ChatGPT to enhance spear phishing and malware development operations targeting organisations across multiple continents. Since June 2025, the group has leveraged large language models to automate multilingual phishing campaigns, creating fake personas and research entities to socially engineer victims into downloading malicious payloads. Technical analysis uncovered GOVERSHELL, a custom malware family with five AI-assisted variants featuring rewritten network stacks, diverse command-and-control methods, and persistence through scheduled tasks and DLL hijacking. This AI driven evolution of cyber threats highlights the need for behaviour based email security, endpoint monitoring for persistence mechanisms, and AI-powered defensive tools to counter increasingly automated and large-scale threat activity.

References
Shane Bell
Next

#NSBCS.094 - TOKEN2049 Singapore 2025: Safeguarding the Digital Economy in a Time of Rapid Change