About Dr Tom Hartley

Tom is the owner of Govern. He has over 18 years in the cybersecurity and IT industry at management level, and for the past 6 years has been a lecturer in cybersecurity at the Eastern Institute of Technology. He has earned certifications in ISO 27001 Lead Auditing, Lead Implementation, SOC2, and Ethical Hacking. These certifications are considered the international gold standard for business security.

The Parkerian Hexad: Elevating Information Security Beyond the CIA Triad

Posted on 3 April 2024 by Dr Tom Hartley

While you may or may not be aware of the CIA Triad, it is a well-known set of fundamental principles of information security – Confidentiality, Integrity, and Availability. It clearly defines the relationship between information and security.

Confidentiality: Often considered the most fundamental principle of the CIA Triad, this involves protecting information from unauthorised access. It ensures that sensitive data is only accessible to those with the proper permissions. Integrity: Also part of the CIA Triad, integrity ensures that data remains accurate and unaltered. It involves protecting information from unauthorised modification or tampering, ensuring that it retains its original state and reliability.

Availability: Another core principle of the CIA Triad is that availability ensures that information and resources are accessible and usable when needed. It involves safeguarding against disruptions or outages that could impact the availability of critical systems and data. The Parkerian Hexad is a security framework that extends and complements the Triad, to include three additional elements:

Possession, Authenticity, and Utility. It points to the potential vulnerabilities between the CIA attributes. “These attributes of information are atomic in that they are not broken down into further constituents; they are non-overlapping in that they refer to unique aspects of information. Any information security breach can be described as affecting one or more of these fundamental attributes of information.”

Possession: Possession emphasises the control and ownership of information. Possession ensures that authorised entities have the rightful ownership and control over the data or resources, preventing unauthorised entities from claiming possession. Information can be confidential and have integrity, but in the hands of the wrong person, it can threaten both attributes. “Suppose a thief were to steal a sealed envelope containing a bank debit card and its personal identification number. Even if the thief did not open that envelope, it’s reasonable for the victim to be concerned that the thief could do so at any time.”

Authenticity: This principle addresses the trustworthiness of information and the assurance that it is genuine and not falsified. Authenticity ensures that users can rely on the accuracy and origin of the information. “For example, one method for verifying the authorship of a handwritten document is to compare the handwriting characteristics of the document to a sampling of others that have already been verified. For electronic information, a digital signature could be used to verify the authorship of a digital document using public-key cryptography (could also be used to verify the integrity of the document).”

Utility: This is another extension introduced by the Parkerian Hexad, emphasising the usefulness of information. Utility involves ensuring that information serves its intended purpose and provides value to authorised users while also preventing misuse. “For example, suppose someone encrypted data on disk to prevent unauthorized access or undetected modifications–and then lost the decryption key: that would be a breach of utility. The data would be confidential, controlled, integral, authentic, and available–they just wouldn’t be useful in that form.” As we go into the new year, the Parkerian Hexad builds upon the CIA Triad by incorporating Possession, Authenticity,
and Utility, providing a clearer understanding of how to address various aspects of information security, ownership, trustworthiness, and usability. All quotes sourced from (https://en.wikipedia.org/wiki/Parkerian_Hexad)

Tom is the owner of Govern Cybersecurity.
He has over 18 years in the cybersecurity and IT industry at management level, and for the past 6 years has been a lecturer in cybersecurity at the Eastern Institute of Technology. He has earned certifications in ISO 27001 Lead Auditing, Lead Implementation, SOC2, and Ethical Hacking. These certifications are considered the international gold standard for business security.

Say Goodbye to Passwords: Welcome the Age of Passkeys!

Posted on 11 December 2023 by Dr Tom Hartley

2024 marks the beginning of a new era, bidding farewell to an old friend – the humble password – and embracing passkeys as the innovative gatekeeper of our digital security. Say goodbye to the days of cumbersome passwords and welcome a secure, convenient, and seamless login experience.

For years, passwords have played a vital role in safeguarding our digital identities and protecting our personal details, financial transactions, and other digital assets. However, as cyber threats have evolved, passwords alone are no longer sufficient.

Based on the increasing ease in breaking passwords (or stealing them with usernames), the New Zealand Information Security Manual (NZISM), the government security rulebook, recommends a complex password length of ten characters, and Australia’s counterpart, the AISM, recommends sixteen characters. This increased measure drove businesses and individual users to subscribe to password managers in order to create and organise passwords for us.

However, not all users rely on password managers. Multifactor Authentication (MFA) lets us use our common eight-digit password, which is more secure but adds an extra step and, as a business owner, can cost you money. Enter passkeys – dynamically generated authentication keys that revolutionise the concept of password cracking.
With the rise of remote work and digital banking, we need robust, user-friendly security. Passkeys address both concerns, providing enhanced security without the inconvenience of manual password management. You are probably using it already without even recognising the term. Using passkeys is straightforward; your fingerprint, facial recognition, PIN or pattern unlocks access securely. Unlike passwords, there’s no need to memorise or write them down, eliminating common security risks.

All of the work is done in the background using private and public key cryptography. For example, the website you are visiting sends an encrypted challenge to your device
(computer, tablet, or phone) where you scan your face, fingerprint, or PIN, which the private key decrypts and sends a response back to the website for verification. If there’s a match, you’re in. It’s actually more complicated than that, but this is what you see.

You may have seen this the first time you signed into Netflix or another application using QR codes on Smart TVs. If you have a Netflix account, for example, and you try to sign into it on a TV, you are presented with a QR code to scan using your smartphone to authenticate your account. You may also be using Apple iCloud Keychain or Google passkeys. All businesses, especially those in e-commerce, will see a number of benefits from adopting passkeys, including higher login success, reduced drop-off rates, increased conversion rates, and reduced costs of separate two-factor authentication.

As we enter the new year, we will see a greater movement to passkeys – passwords have served us well, but as we evolve, so should our security measures. You can start your journey away from passwords, making your users’ digital lives easier and more secure. Welcome to the era of passkeys!

Artificial Intelligence – user beware Privacy and security are crucial

Posted on 5 September 2023 by Dr Tom Hartley

Artificial Intelligence (AI) has emerged as one of the most transformative and revolutionary technologies in recent history. From its humble beginnings to its widespread applications today, AI has garnered significant attention for its potential benefits as well as the inherent threats it poses.

Discussions and experiments in technology date back to 1946, when Alan Turing initiated the study of computer-based intelligence, and the term Artificial intelligence was coined as an academic discipline in 1956 by John McCarthy. Since then, AI has been central in many Sci-Fi TV shows and movies, but its potentially disruptive nature emerged with movies such as the 1984 War Games starring Matthew Broderick, 2004’s I Robot classic with Will Smith, and 2008’s Eagle Eye with Shia LaBeouf where it took on a threatening nature to human existence.

With the emergence of technologies like Alexa, Sari, ChatGPT, and other AI advancements, it is undeniable that science fiction has become a tangible reality. The impact of these
AI technologies has been profoundly beneficial across various sectors.

AI has increased efficiency and productivity in business, improved decision-making and problem-solving, making significant breakthroughs in healthcare and medical research, and automation and robotics. Despite its numerous advantages, AI also brings forth certain concerns that need to be addressed. Many are concerned that job displacements stand as a significant worry as automation and AI technologies potentially replace certain roles traditionally performed by humans. Focusing on reskilling and upskilling the workforce is crucial to adapt to the changing employment landscape.

Another major concern is the breach of personal data. As AI systems rely on vast amounts of data for training and operation, the privacy and security of this information become crucial.

For example, it isn’t common knowledge that ChatGPT knowingly records everything typed into it, and there is no clear warning that it is doing so.

This caused OpenAI to introduce in early April this year a “privacy feature”. This shift allows users to disable sharing their chat history in their user settings, but there isn’t a clear banner or other warning to point out this option (https://openai. com/blog/new-ways-to-manage-your-data-in-chatgpt). Safeguarding personal data from unauthorized access and misuse should be a top priority, ensuring that stringent measures and regulations are in place to protect individuals’ privacy. The history of AI is a testament to human ingenuity and our relentless pursuit of creating machines that can emulate intelligent behaviour. AI has the potential to revolutionise numerous industries, drive innovation, and improve our lives in countless ways.

However, it is essential to approach AI with caution, addressing the challenges it presents, such as job displacement, ethical concerns, privacy, and the potential risks of autonomous weapons. By navigating these challenges thoughtfully, we can harness the immense power of AI while ensuring its responsible and beneficial integration into society.

Tom is the owner of Govern Cybersecurity. He has over 18 years in the cybersecurity and IT industry at management level, and for the past 6 years has been a lecturer in cybersecurity at the Eastern Institute of Technology. He has earned certifications in ISO 27001 Lead Auditing, Lead Implementation, SOC2, and Ethical Hacking. These certifications are considered the international gold standard for business security.

Learning from Disaster: What we should take away from Cyclone Gabrielle

Posted on 17 May 2023 by Dr Tom Hartley

Over the course of the last several years, we have seen three major events that forced us to reassess our business continuity and disaster recovery planning. The Christchurch earthquake of 2011 initiated a shift towards cloud technology in preparation for office access becoming more unpredictable. 2020’s COVID-19 pandemic solidified remote working and online collaboration as an essential part of modern businesses, while Cyclone Gabrielle reminded us just how vital power and communications networks are during turbulent times. No business could have predicted the unpredictable.

Yet, despite all these unforeseen events disrupting businesses everywhere, one thing is certain: now more than ever, we must plan for and manage potential disruptions from any source – natural disasters, cyber-attacks, data breaches or pandemics included. Our approach towards continuity planning and disaster recovery will determine our ability to come out stronger on the other side.

Cyclone Gabrielle recently caused devastating destruction along the east coast of New Zealand. The repercussions of this storm will take years to overcome and have prompted an examination of the risks individuals and businesses face. As authorities investigate ways they can better prepare for future disasters like these, key insights garnered from Cyclone Gabrielle are helping create a solution-oriented approach moving forward. Herein lies several key lessons businesses can consider for the future:

Businesses should develop a comprehensive disaster recovery and continuity plan that is tailored to their particular risks, including the possibility of natural disasters like earthquakes, tsunamis or cyclones. Particularly important for coastal businesses would be preparation against potential tsunamis – so far, an untested but promisingly survivable force of nature!

A good backup system should be put in place to recover data even if major damage occurs to the business premises or IT infrastructure.
Business owners should take extra precautions with important documents, such as making electronic copies of those documents and storing them off-site or in the cloud.
Employees should be prepared for potential disasters through training courses on emergency response and crisis management protocols.
Businesses should allocate an emergency budget that includes emergency funds to cover any losses incurred due to a disaster and additional expenses associated with rebuilding operations afterwards.
Businesses should consider their supply chains and the likelihood of disruption to services if their suppliers are affected by a disaster. More importantly, businesses need to think beyond just the restoration of services and focus on ways to build resilience so they can better handle such events in the future and avoid disruption from occurring again down the line.

Following the devastation of Cyclone Gabrielle, communities banded together to help one another in remarkable ways. Volunteers and agencies donated food, clothing and other necessary items as people exchanged desks and computers for shovels and gumboots to undertake the reconstruction efforts.

Though we will never forget the people and property we lost or the destruction caused by this disaster, there is light at the end of this tunnel; together, we shall overcome these trying times – but not without first considering our future through preventive planning. For a more detailed look at Business Continuity and Disaster Recovery Planning, along with free templates and resources, go to https://govern.co.nz/resources.

Tom Hartley is a certified ISO 22301 Business Continuity Lead Implementor and is available for free consultations. He can provide guidance on implementing an effective Disaster Recovery Plan and help with any questions you may have.

Tom is the owner of Govern Cybersecurity. He has over 18 years in the cybersecurity and IT industry at management level, and for the past 6 years has been a lecturer in cybersecurity at the Eastern Institute of Technology. He has earned certifications in ISO 27001 Lead Auditing, Lead Implementation, SOC2, and Ethical Hacking. These certifications are considered the international gold standard for business security.

Plan to Make 2023 Your Safest Year Yet

Posted on 21 December 2022 by Dr Tom Hartley

2022 has seen two notable cybersecurity incidents: the significant data breach of the Pinnacle Midlands Health Network and the white-hat hacking of the Christchurch Hot Pools.

While the Christchurch breach was downplayed as having been conducted by an “ethical hacker” intentionally identifying security vulnerabilities, the important takeaway in both cases is that a security hole in the systems was breached, and many customers’ data was exposed. In businesses that no doubt thought they would not be targeted. Businesses were not the only victims this year either.

It was recently reported that a pensioner lost $134k after his online bank accounts were hacked, and customers of Unity Bank in Hastings were victims of a Bank Identification Number (BIN) attack – proving kiwi banks are a growing cybercriminal target. This uptick was recently explained by Forbes Magazine who said “Cybercriminals thrive in times of uncertainty.” And that during this time of economic downturn businesses should be aware that “Threats like phishing, ransomware and business-email compromises have a significant impact on the health and viability of a business.

Beyond financial consequences, a breach can also lead to loss of customer trust and significant reputational damage.” Closer to home, CERTNZ responded to 2,001 cyber incidents in Q2, 2022 with a direct financial cost of $3.9m. Phishing and credential harvesting, scam and fraud cases and unauthorized access incidents accounted for 94% of these incidents – confirming that human connection is still the weakest link when it comes to cybersecurity.

And just to drive the point home, if Q4 2021 (with a reported financial impact of cybercrime in NZ of $6.6m) is any indication, this holiday season will see a major cybercrime impact on businesses and individuals in NZ, and an increase in cybercrime can be expected in 2023.

So, what can you do about this?

Identify your vulnerabilities with a comprehensive cybersecurity audit by an independent, trained professional. You wouldn’t get your accountant to complete your financial audit, and neither should your IT department/MSP undertake your cybersecurity audit. Impartiality is imperative.
Determine your potential for damage with a risk assessment. Understanding your risks goes a long way to protecting your company. Assessing your risks means understanding the “what if’s” that threaten you every operations, identifies gaps and provides opportunities to take preventive measures.
Create a robust risk management program. There are a few ways to handle risk treatment. Avoid the risk- remove the opportunity completely. Mitigate the risk – put measures in place to lower the risk. Accept the risk- the cost of protection outweighs the threat.

These are the three most common responses to risk treatment and set the countermeasures against each scenario in the assessment. We have identified that the lack of robust risk analysis and treatment plans is common across New Zealand.

Throwing cybersecurity technologies and employee awareness training at the problem can only go so far. Moving into 2023, the focus needs to shift at the Board, owner, and executive level to understanding cybersecurity gaps and the risks to businesses and plugging them.

Cybercrime is unpredictable, and the New Year is a good time to start taking a top-down cyber risk management approach to ensure your business is secure.

Introducing GOVERN. From 2023 Hartley & Associates will now be known as GOVERN Cybersecurity. www.govern.co.nz We are excited to continue to work with businesses to master their cybersecurity resilience, and look forward to introducing tailored training packages for board members and C-Suite executives.

Cybersecurity Governance – the four cores to know

Posted on 7 October 2022 by Dr Tom Hartley

In past articles, we have looked at the four cores of managing cybersecurity – securing your people, your communications, your data, and your technology.

This is achieved through awareness training, best-practice policies and procedures, and selective technologies. These are the foundational components that every business is expected to implement for security. Oversight of these policies and procedures however, falls to the Board, and C-Suite executives.

According to the New Zealand National Cyber Security Center, “Boards and executives are ultimately responsible for the outcomes of any cyber incident, including the impact on stakeholder and customer confidence.” This therefore demands that these business leaders have a clear understanding of what is required to create an optimally secure business.

To this point, Gartner predicts that at least 50% of C-level executives will have performance requirements related to cybersecurity risk built into their employment contracts by 2026. In order to meet these demands, a sound knowledge of the four cores of cybersecurity is a must. In this instance the four cores relate to the governance, legal, financial, and insurance practices of the business. The NZ Privacy Act of 2020 stated that an organisation must now report any breach to the Privacy Commissioner, along with their clients, stakeholders, and interested parties. To add insult to injury, all breaches are accompanied by a financial penalty.

This is effective governmental leverage for implementing best-practice cybersecurity assurance in industries across New Zealand. Legislation is also currently being written that will hold Board and C-Suite members more directly accountable for the cybersecurity posture of any organisation they manage as it is in other countries. Simply approving or cutting a cybersecurity budget is no longer enough.

As the saying goes, if you think compliance is expensive, try non-compliance. Restoring a ransomware breach and achieving the correct cybersecurity management structure is far more costly than putting the right controls in place from the start. here is no Return On Investment when it comes to cybersecurity implementations. Its purpose is to protect the ROI on the products and services that make you profitable and keep you in business.

Cybersecurity insurance packages come in different configurations based on multiple factors for each case. Picking the suitable suite depends on knowing the protections and gaps in your business. Knowledge at the Board level of what is in the Risk Assessment and Treatment plan is a requirement for purchasing cyber risk insurance. Each of these areas is relational to the knowledge that the Board and C-Suite have of the organisations cybersecurity posture – its governance.

It’s no longer enough to blindly approve policies and budgets without knowing what’s in them, and more pressure and accountabilities will be emphasised at the C-Suite level to get it right. Discount it at your peril. We understand that most business leaders “don’t know what they don’t know” when it comes to cybersecurity governance. We therefore always recommend (and offer) that a professional cybersecurity audit is the best place to start.

An assurance audit conducted by an independent professional outside your IT department or service provider will offer a fact-based objective report of your current cybersecurity governance and management posture. This gap analysis helps determine where resources need to be directed and, in some cases, might help recommend an international certification such as ISO 27001.

Cybersecurity is the right balance of governance and management; one depends on the other. Commitment at the Board and C-Suite levels demonstrates leadership and sets the tone for staff to follow.

Getting the Basics Right

Posted on 25 June 2022 by Dr Tom Hartley

Every business, regardless of industry or size, is vulnerable to cybersecurity attack- that’s just a fact; your business is not immune. As of the writing of this article, there’s an uptick in attacks across New Zealand in both the retail and manufacturing sectors, businesses that normally would be considered low on the radar, and that will only increase in these and other unexpected segments during the year.

According to CertNZ, 2021 was a busy year with 8,831 cyber incidents reported and a combined loss over $16.8 million (these are just reported cases). The primary causes of these incidents were phishing and credential harvesting, scams & fraud, and malware; where phishing had a significant increase in numbers.

I often hear, “We don’t know what we don’t know,” with many businesses adding that they’re not experts in cybersecurity. Covering the basics doesn’t require a specialized skillset or a large financial expenditure. There are four pillars of cybersecurity that every company should cover; securing people, securing communications, securing data (note: this was inadvertently missing from our last article), and securing technology.

Securing People

As noted above, the primary cause of cybersecurity breaches begins with phishing, credential harvesting, scams, and fraud- all due to direct interaction with people. Training employees to look for anything out of the ordinary and taking precautionary steps helps reduce the risk of exposure. Employees trained properly become your human firewall and first line of defense.

Securing Communications

Using technology to secure your inbound email and other communications works in concert with securing your people to reduce the initial attack surface. Products such as Trustifi can also help businesses secure outbound email traffic which is the main source of cyberactivity. Intercepting and misrepresenting emails in transit to recipients are ways cybercriminals deliver malware and harvest business and employee information. Protecting confidential information such as invoices, contracts, etc is especially important.

Securing Data

As our businesses grow and we’re on the move more, the flexibility of having our data up to date and accessible everywhere increases. Platforms like Office 365 and Google allow us to work collaboratively and provide us with that mobility and some extraordinary powerful tooling. SharePoint, office applications, OneDrive and email everywhere is important in today’s business world. In addition to protecting access, securing data means the ability to back it up and retrieve it if lost. These platforms offer limited and complex backup options which spells trouble if you need it now and it’s vanished. There are however some very good cloud-to-cloud solutions to secure your data and give peace of mind.

Securing Technology

Securing PC’s, laptops and other mobile devices is the last line of defense. Should something slip through your people and communications layers, having next generation Anti-virus technology on those devices is critical. Reliance on the off the-shelf brands that we’ve long known is not going to stop many of the advanced malware and attack methods. You need something built for a business environment.

All or any combination of the pillars mentioned here will go a long way to establishing reliable, resilient cybersecurity as the key to defending your business. Carefully selecting the right products and combinations is important, and the good news is that many of the technologies cost about the price of a coffee per month. A small price to pay for a big sense of relief.

Making Security awareness a habit

Posted on 21 March 2022 by Dr Tom Hartley

Looking forward to 2022, we can expect another period of dealing with the invisible and deadly COVID-19 virus. Three years in, it has changed how we live, work and interact with others nationally and globally. We have trained ourselves to keep to our one-metre distance in public places, wash our hands thoroughly, and use sanitisers.

We wear masks and use technology to track our activity in case of possible exposure and communicate sites of interest, more recently, as a vaccine pass. It’s true to say that these measures have worked, and it is also true that we will have these methods at the ready once we get past this season of the disease and see another pandemic coming our way. But, as much as it has disrupted our personal lives, it has also affected our businesses. It has upset inbound and outbound global supply chains, put burdens on hospitality, increased remote working from home (turning our homes and lives on end), and meant meeting online at all hours of the day and night, not to mention reading and responding to more emails than we would like to.

And that has also seen us come across an increase in other invisible, deadly killers to business- forms of malware, delivered primarily via email phishing to unsuspecting individuals or vulnerabilities to weak and underperforming technologies. So for every notable reported attack (the NZX in 2020 and the Waikato DHB in 2021, for example), there are an untold number of those that go unrecognized and unreported.

All of the cybersecurity predictions for 2022 and beyond are pretty much alike- expect more, expect worse, and expect harsher damages from attacks. We will see an increase in ransomware and attacks against mobile and IoT devices, a rise in frequency, and sophisticated methods of avoiding detection.

What can you do?

An Information Security Management System (ISMS) is not just an assortment of technology; it is the collective series of methods that a company employs to achieve their cybersecurity goals. Most companies have some form of implementation (or parts thereof) but different requirements and ways to achieve them, typically letting them down. Here are four common suggestions and steps for every business in 2022:

Conduct a Cybersecurity Assessment

I hear a lot of, “We don’t know what we don’t know,” and that is precisely what hackers exploit. An audit performed by an independent cybersecurity professional outside of your organisation or service provider will ensure an evidence-based, impartial review, define gaps, and make appropriate recommendations and is well worth the cost. You wouldn’t let your accounting department do your financial audit, and you should look outside for your cybersecurity review.

Understand and incorporate good governance

The NZ Privacy Commissioner revised the Privacy Act of 2020. It has new rules and penalties around digital information and for failure to recognise and protect the privacy of your stakeholders.

They have a free short 30-minute e-Learning course that will help you and your employees get to know the regulation. Combined with appropriate policies and procedures, they set the tone that management takes the security of the business seriously, thereby protecting the needs of all employees, suppliers, and customers.

Apply 3 pillars for protection

There are three foundational pillars to cyber protection that every business and individual should take to defend themselves against harmful threats; training (securing people), email filtering (securing communications), and deploying next-generation Antivirus (securing technology). These three methods are similar to the preventive measures we apply to COVID-19. Individually, they won’t prevent an attack, but together, they help reduce the risk and damage from one.

Stay aware.

CERTNZ, SecurityBrief NZ, and other security bulletin websites can provide knowledgeable, timely information about what is happening in New Zealand. Just ten minutes a day is all it takes to stay ahead of the game.

Unlike COVID, threats from cybersecurity attacks will never go away, and like COVID, everyone is a target. So vigilance and resilience are our number one defence, and the approach to taking it seriously now and every day is the only way to guarantee your cybersecurity looking forward.

The Profit

Inspiring Business in Hawke's Bay

Author Archives: Dr Tom Hartley