#NSBCS.147 - Building a Risk Culture
Risk management is not a document, a register or a quarterly committee meeting.
It is a culture.
In the last few weeks, I have spent some time refreshing our risk management process at NSB. The frameworks, templates and governance matter, of course, but the process itself is only part of the equation.
Two things make the biggest difference.
The first is leadership buy in.
If the most senior people in a business see risk management as a blocker, everyone else will too. If leaders actively welcome challenge, ask “what are the risks?”, expect assessments before material decisions are made and support people who raise concerns, risk awareness starts to become part of how the business operates.
The second is making risk easy for people to understand and participate in.
Most staff do not need a 20 page policy. They need short guidance, TLDR versions, simple processes and regular conversations about risk in language that makes sense to them.
The goal is for people to naturally think:
What could go wrong?
What does that mean for the business?
Are we comfortable with that?
What should we do about it?
And this is particularly important for cyber security.
Cyber security should not sit in its own little technical box. A cyber incident can create financial, operational, legal, regulatory and reputational consequences, which makes cyber security fundamentally a business risk.
The more we can bring cyber into normal business risk conversations, rather than treating it as something owned by the IT or security team, the stronger and more resilient our organisations become.
Good risk culture is not about making everyone scared of risk.
It is about making people comfortable talking about it.
Build lasting cyber resilience. Book your meeting with NSB Cyber today.
What we read this week
Compromised eMudhra Intermediate CA Keys Trigger Global Browser and Trust-Store Blocks - The private keys of eight eMudhra intermediate certificate authority certificates were compromised, allowing potential issuance of fraudulent TLS certificates trusted by major browsers and operating systems. Mozilla, Google Chrome, Apple and Microsoft rapidly blocked the intermediates via OneCRL, CRLSets and related mechanisms, with further updates removing associated roots from NSS and other stores. The keys appear to have been weakly generated due to a flaw in key-generation processes. No widespread malicious use in Certificate Transparency logs has been reported so far, but the incident underscores risks to embedded systems, Linux distributions and non-browser clients that update more slowly. Organisations should ensure browsers and trust stores are current and monitor for anomalous certificate activity.
Joint Advisory Warns of SafePay Ransomware Hitting 600+ Victims Including Australia - The FBI, CISA, US Secret Service, German Landeskriminalamt Rheinland-Pfalz, UK National Crime Agency and North West Regional Organised Crime Unit released a joint #StopRansomware advisory on SafePay. Active since August 2024 and among the most prolific groups in 2026, SafePay has targeted businesses and critical infrastructure across North America, South America, Europe and Australia. Initial access typically involves stolen or guessed credentials, phishing, and exploitation of older vulnerabilities in Cisco ASA/FTD, Veeam Backup & Replication and SonicWall devices. Actors escalate privileges, disable security tools, move laterally and encrypt data while threatening leaks. Defenders are urged to patch internet-facing systems, enforce multi-factor authentication, limit administrative access, segment networks and maintain offline backups.
OpenCode Console Breach Exposes AI Provider API Keys - Open-source AI coding platform OpenCode confirmed a security incident affecting its Console service, impacting approximately 1.4% of Console users who had stored external provider API keys. Attackers accessed a legacy system, potentially exposing OpenAI, Anthropic and Google keys that were subsequently used to run up unauthorised charges. The core open-source application and CLI were not affected. Providers have revoked compromised keys and begun refunds. Users who stored keys in Console should immediately revoke and rotate them at the provider dashboards, review recent usage and billing from mid-October onwards, and avoid storing long-lived secrets in third-party workspaces.
Qilin and INC Ransomware Groups Exploit Palo Alto GlobalProtect Flaw to Bypass MFA - Palo Alto Networks Unit 42 continues to observe ransomware operators, including Qilin (Spikey Scorpius) and INC (Tarnished Scorpius), exploiting the previously patched authentication-bypass vulnerability CVE-2026-0257 in PAN-OS GlobalProtect and Prisma Access. The flaw enables unauthorised VPN connections that can circumvent multi-factor authentication. Successful exploitation has been followed by reconnaissance, credential dumping (including from virtualisation layers) and ransomware deployment. Organisations running affected versions should ensure all portals and gateways are fully patched, hunt for indicators of compromise, and review VPN session logs for anomalous activity.
Critical PHP2Shell Flaws (CVE-2026-109618 & CVE-2026-109619) Prompt ACSC Critical Alert and Global Scramble - Two critical unauthenticated remote code execution vulnerabilities in the PHP core, collectively known as PHP2Shell, were disclosed after details leaked ahead of the planned release. Rated CVSS 9.2, the flaws affect PHP from version 5.4 onwards and can allow remote code execution with the privileges of the web server process before application code even runs (highest risk on mod_php). The Australian Cyber Security Centre issued a Critical Alert: Act Now, and cyber.gov.au was among government sites temporarily disrupted while mitigations were applied. Emergency patches (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) were released on 21 October; older branches require migration or vendor backports. Organisations must identify all PHP instances, apply patches immediately, and monitor for exploitation attempts, which have already started.