What security controls really matter?

There's a wide range of security standards these days, but they are quite varied and different. Are some of them wrong and out-of-date? What security controls should we really prioritise?

We'll consider cyber security 20 years ago - how much has changed, and what hasn't changed.

[Particularly focusing on changes to threat actors, security technology, and security standards.]

We'll explore how threats have evolved, how they target different industries, and what this means for security standards.

[This analysis uses NIST CSF to illustrate how sector-based targeting results in different security priorities for industry sectors.]

We'll also explore the security standards for various industry sectors in Australia - which ones are mature, and where are significant gaps?

[Reviewing Energy, Financial services, Government, Small-to-Medium Business, Telecommunications and Health sectors.]

Finally we'll analyse the Essential Eight in more detail - is it still effective for threat actor behaviour? Or do we need to adapt how we apply it, to reflect the updated risks?

[Analysis using MITRE ATT&CK to illustrate effectiveness of E8 control areas against threat behaviour - and where the controls seem to be misaligned.]

[This is an updated version of a talk that I did at CyberCon CBR in March 2025.]