Robert MacMillan

This week, while preparing to speak at the upcoming #FIRST & AfricaCERT Symposium 2025 — alongside cybersecurity leaders from across Africa and the Arab regions — I found myself reflecting on the conversations we keep having as a community. We still obsess over controls. We still debate tools. We still count certifications. Yet the world around us is asking a far deeper question: Are we building security… or are we building confidence? We’ve trained a generation of professionals to chase compliance checklists, vulnerability counts, dashboards and maturity scores. All important — but none sufficient. Because trust is not built by controls alone. Trust is built through leadership, governance, transparency, ethical decision-making, and the ability to stay resilient when everything is uncertain. Cybersecurity was never meant to be a purely technical discipline. It is, at its core, a leadership discipline. Ask yourself: 👉 Are we designing layered security architectures… or layered credibility? 👉 Are we reporting risks… or cultivating confidence in decisions? 👉 Are we securing systems… or sustaining belief in digital civilisation? The organisations truly succeeding today are not those with the thickest policy binders — They are the ones that demonstrate resilience, accountability, and trustworthiness in real time. Security has evolved: ✅ From perimeter defence ➝ trust architecture ✅ From IT expense ➝ business resilience engine ✅ From audit snapshots ➝ continuous assurance ✅ From technical function ➝ strategic leadership platform These reflections led me to write a deep long-form essay: “From Control to Confidence: How Information Security Became the Language of Trust and the Strategic Reinvention of Cybersecurity Leadership.” 👉 https://lnkd.in/efhYxMBX But more important than the article itself is the conversation it should spark: Has cybersecurity truly evolved into a leadership discipline within your organisation? Or are we still securing controls while trust quietly drains away? Because the future of our profession doesn’t depend on better tools alone — It depends on better leaders of trust. Controls reduce noise. Confidence sustains civilisation. #AfricaCERT #AfricaCERTSymposium #Cybersecurity #CyberLeadership #DigitalTrust #CISO #GRC #SecurityCulture #Resilience #CyberResilience #ISO27001 #RiskManagement #SecurityStrategy #Governance #DigitalTransformation #AI #AIGovernance #ZeroTrust #FutureOfSecurity

٦

For the latest threat intelligence, IOCs, and TTPs with respect to the regional conflict, please visit the link below! https://lnkd.in/dfk9_jt3

١٧

🌍 💣 The current Middle East geopolitical tensions are not regional events — they are global cyber catalysts. 🌍 🚀 In an interconnected digital ecosystem, conflict translates into: • Increased state-aligned cyber activity • Infrastructure targeting • Supply chain instability • Hybrid warfare tactics As CISOs, our role must evolve: We are no longer just security leaders. We are custodians of digital resilience in a geopolitically volatile world. The winning strategy is not paranoia — it is preparedness. #CISO #CyberSecurity #GeoPoliticalRisk #ThreatIntelligence #ZeroTrust #CloudSecurity #Resilience #Leadership

٤٦

‏٣‏ ‏تعليق‏

It was a privilege to represent RZOLUT (rey-zo-lute) and speak at the GRC Today 2025 event in Abu Dhabi last week. The energy at ADGM was incredible, with so many bright minds in one place, all focused on the future of governance, risk, and compliance. The local community of Risk and Compliance leaders is clearly very knowledgeable while also being curious about emerging trends and technologies. A few things really stood out for us: 1) AI in the Spotlight: There’s no denying the impact AI is having on compliance. The conversations around responsible use and the need for better oversight were both timely and thought-provoking. The “talent scarcity” challenge is also clearly a common theme across large and small organizations. 2) Bridging the Gaps: It was refreshing to hear so many leaders talk about breaking down silos and making compliance a shared responsibility across the entire organization. In an world beset with increasing complexity, this is a welcome attitudinal shift that will result in safer businesses lesser loaded with risk. 3) Leadership in a Changing World: Like all other functions, compliance leaders are challenged to grow their capabilities across the spectrum. The basics though remain the same as ever! The qualities that matter most—adaptability, empathy, and a willingness to embrace change—came up again and again in the panels. 4) Digital Finance Challenges: The rapid pace of change in fintech and digital assets means new challenges, but also plenty of opportunities for creative compliance solutions. It was also acknowledged by multiple experts that the world of crypto is beset with money laundering problems. Our biggest takeaway? Compliance isn’t just about ticking boxes or playing defense. Done right, it’s a real catalyst for growth and innovation. By creating a more safe and secure business environment, compliance functions can help drive higher profitability too! However, as technology keeps evolving we all need to keep learning and stay connected. A big thank you to everyone who made GRC Today 2025 such a memorable experience! We’re excited to put these insights into practice and help our clients navigate what’s next. #compliance #GRC #GRCConference #risk #riskmanagement #AI #innovation #fintech #leadership Sarabjeet Singh Ankush Thakur, CAMS Siddharth (Sid) Sabu kshitij singh Gaurav Jain Tapas Mahajan, CAMS

٥٤

‏١‏ ‏تعليق واحد‏

🚨 Security Alert — OpenSSL Vulnerabilities Threaten Middle East Businesses: Remote Code Execution & Private-Key Recovery Risks 🚨 Researchers and the OpenSSL project have released urgent patches for critical flaws that may enable remote code execution or private-key recovery, including an SM2 timing issue on 64-bit ARM. For Middle East organizations in fintech, smart cities, oil & gas, and government, this is a high-priority security threat. 🔍 What You Need to Know: OpenSSL patches fix memory-corruption/RCE and a timing side-channel that can expose private keys on ARM64 systems widely used in IoT and mobile infrastructure. Similar RCE flaws have been exploited in the wild, and the region remains a high-value target. The timing attack requires specific conditions but could still result in full key compromise, posing severe risk to critical sectors. 1. Patch immediately Upgrade OpenSSL to vendor-recommended patched versions in servers, appliances, containers, and device firmware. Prioritize externally facing TLS endpoints, payment gateways, smart city IoT devices, and systems on affected ARM64 architectures. (Daily CyberSecurity) 2. Inventory & risk-map Identify systems using vulnerable OpenSSL versions (including embedded/network appliances and third-party software). Mark critical assets financial systems, industrial controls, government services for expedited remediation. (app.opencve.io) 3. Rotate keys & certificates where appropriate If an affected system handled private keys on impacted architectures, replace keys/certificates after patching and monitor for suspicious use. Consider regulatory notification requirements (NESA, NDMO, NCSC). (NVD) 4. Harden TLS configs & monitoring, Enforce modern ciphersuites, disable legacy RSA key-exchange where possible, add WAF/IPS rules, and enable telemetry/alerting for unusual TLS behaviors or crashes. (wiz.io) 5. Test & validate - Run vulnerability scans, penetration tests, and post-patch verification across environments (including CI/CD images and containers) to ensure no vulnerable builds remain. Document for compliance (PCI-DSS, GDPR, local regulations). (openssl.org) Want help? DC Infotech & Communication Ltd can: run a rapid OpenSSL exposure scan across your Middle East estate, prioritize remediation for critical assets (fintech, oil & gas, government), help rotate affected keys/certificates safely, and update your incident playbook to handle cryptographic key compromise. DM us or email info@dcinfotech.in to schedule a risk review and action plan. Sources / further reading: OpenSSL advisory & vulnerabilities list; NVD entry for CVE-2025-9231 (SM2 timing side-channel); recent writeups summarising RCE and key-recovery impacts. (openssl.org) Stay proactive, cryptography flaws can be subtle but costly. #DCInfotech #CyberDefense #ITSecurity #EnterpriseSecurity #SecurityOps #RiskManagement #VulnerabilityManagement #Compliance #CyberResilience #MiddleEastCyber #OpenSSL

٩

Identity & Access Management (IAM) is the cornerstone of modern security. Our latest episode breaks down the I A A A framework—Identification, Authentication, Authorization, and Audit—and shows how unifying these pillars creates a resilient IAM architecture. We cover MFA best practices, granular RBAC/ABAC models, privileged access governance, and continuous auditing that meets compliance demands. Watch the full video and equip your team to deploy IAM confidently. #IAM #Cybersecurity #AccessControl #SECLOLaaS #SecurityArchitecture #cybersecurityworld

٨

BEYOND THE HYPE: A STRONG CASE FOR HUMAN-CENTRIC AI IN SECURITY AI in security continues to advance — but without structured human oversight, its promise often falls short. I am pleased to share that a&s Middle East — one of the region’s most respected voices in the security industry — has published my guest article on this important theme: https://lnkd.in/dqwUB8VF The article outlines why daily human review, contextual judgment, and structured data workflows are non-negotiable — and how COM-SUR™, the world’s only CCTV Video Footage Auditing, Smart Backup, and Intelligent Incident Reporting software, is helping shape ‘Better AI’ through responsible, site-specific data and explainable outcomes. If you’d like to revisit the powerful original piece by Mirza Bahić from the Mar/Apr issue, which set the stage for this discussion: https://lnkd.in/dwfy_dqa #BetterAI #COMSUR #HumanInTheLoop #SecurityStrategy #AIoversight #Surveillance #CCTV #ASMAG #SecurityLeadership #VisualOS #DailyAuditing #MadeInIndia #SmartSurveillance Mirza Bahic Iu AyalaVishal Kapoor a&s Middle East ASIS International Security Industry Association (SIA) British Security Industry Association (BSIA) Alexandr Wang Alexandr Wang Hans Kahler Sajjad Arshad

٨

Bio-Cyber ​​in the Middle East I'm going to present you with an allegation made during the Iran conflict, and I'm sure it will interest you in the field of cyber threats. I'm sharing this with you because it offers a perspective on where our era might evolve into. In the context of the current Iran tensions, a striking claim has been circulating: that intelligence operatives posed as dentists in Iran, treating senior military officials and potentially embedding tracking devices through dental implants during medical procedures. Yes, this isn't science fiction, but such a claim has been made, friends. Whether true or not... Psychological Operations (PsyOps), cognitive warfare, and information manipulation have become integral components of strategic competition. While it is theoretically possible to place an active tracking device inside a dental implant with our current technological knowledge, it is operationally complex. Severe constraints exist around power supply, signal transmission through bone and tissue, heat dissipation, miniaturization, detectability during radiological imaging, and long-term reliability. The adversary would need identity infiltration capability, credential validation bypass, supply chain manipulation or covert device integration, secure energy sourcing within extreme spatial constraints, low-detectability signal transmission through biological tissue, and resilience against counter-surveillance sweeps. From a multi-domain security architecture perspective, this claim describes a deep-cover human intelligence operation combined with cyber-physical surveillance, executed within a trusted medical supply chain. This is actually a full-blown cognitive impact. What these kinds of claims are actually telling you, within the framework of PsyOps, is this: "We are everywhere". Now we have this triangle: Cognitive Warfare - Disinformation Campaign - PsyOps In hybrid warfare doctrine, perception operations are force multipliers. A narrative suggesting that even medical procedures are compromised effectively expands the perceived threat surface to the human body itself. In cognitive warfare terms, this reframes trust networks as vulnerable infrastructure. If we model the scenario as a risk architecture, two parallel threat vectors emerge: 1) A hypothetical bio-cyber convergence threat in which biomedical devices become covert telemetry platforms 2) A disinformation-driven destabilization vector Both are now elements of modern warfare and cyber threats. Isn't that terrifying? It introduces the idea that even the most controlled and intimate environments, medical settings, may be compromised. The future battlespace is not limited to networks. In an era like this, just think what they can do with the Instagram photos you show them... Note that. ^-^/ #freedomofinternet #cyberthreat #threatintelligence #dataprivacy #cybersecurity #opsec #psysec #psyops

١٣

‏٢‏ ‏تعليق‏

The UAE Cybersecurity Council has confirmed that the national cyber system successfully thwarted organised cyberattacks of a terrorist nature targeting the country’s digital infrastructure and vital sectors, aimed at destabilising the nation and disrupting essential services.

٣٢

Thrilled to hit the stage at #CrowdTour Dubai 2025 — a day of raw threat intel, real attack tactics, and AI-native defense alongside the region’s top minds. ✅ Deep dives into the 2025 Global Threat Report—now in Arabic for the first time ✅ Hands-on Scattered Spider workshop ✅ Straight-shooting panels on AI-native defense Huge thanks to H.E. Mohamed Alkuwaiti, Elias Matta, Roland Daccache, Rima Ben Salah and every speaker and organizer. Let’s keep turning intel into action. 🔐⚡️

١٠٣

‏٦‏ ‏تعليق‏

At Secureify; We develop scalable, sustainable privacy focused Cybersecurity products, We don't re use open source or vendor-lock commercial tools, We develop custom security products that exactly meet the UAE IA and KSA (NCA, SAMA, CITC) Regulations and International Standards. We started with a Zero Trust Platform that is 100% Self-Hosted which securely helps in accessing : - Containarized platforms ( Kubernetes / OpenShift ) - Databases ( SQL / NoSQL ) - Private or Internal Web Applications - SSH Hosts - Windows RDP and more. All without the need for static credentials anymore ;) We have a unified very modern designed Desktop App, Command-Line Interface and a Web Application ( The main Command-Center Orchestra ) We provide an end to end live auditing API that integrates with any SIEM tool + detailed reporting accordingly. Welcome to Secureify Trust. Production Release in just days ;) Stay tuned for other platform that really maintain Privacy and Security. #ZTNA #SASE #Cybersecurity #DataPrivacy #CredentialLess #AccessManagement #Auditing

٢١

‏٦‏ ‏تعليق‏

With regional conflict escalating in the Middle East, cyber risk does not stay regional. Modern warfare includes: • Cyber disruption • Infrastructure targeting • Supply chain interference • Opportunistic ransomware campaigns • Ideologically motivated attacks You do not need to be a defense contractor to be exposed. In periods of geopolitical instability, cyber activity often increases — not only from nation-state actors, but from affiliates, copycats, criminal groups, and automated exploit campaigns. This is not a panic message. It’s a stewardship reminder. Responsible leadership means: 1. Verify your backups. • Are they recent? • Are they immutable? • Are they tested? • Are they offline or segmented? 2. Confirm recovery time objectives. • If you were hit tomorrow, how long until you’re operational? • Who owns the recovery decision? 3. Review privileged access. • Who has admin rights? • Are they logged and monitored? • Is MFA enforced everywhere? 4. Revisit vendor exposure. • If a third party is breached, what happens to you? Geopolitical events remind us of something simple: Digital infrastructure is now critical infrastructure. Backups are not an IT checkbox. They are business continuity insurance. They are reputational protection. They are payroll protection. They are customer trust protection. If your executive team hasn’t recently reviewed backup integrity, ransomware response readiness, and incident recovery ownership, now is a prudent time to do so. Stay steady. Stay prepared.

٣

‏٢‏ ‏تعليق‏

🤝 We're excited to announce our new MSP partnership with CPX, a G42 company and a leading force in end-to-end cyber and physical security in the UAE. This collaboration will enable CPX to offer Acronis Cyber Protect as a managed service to enterprises across the region — with a strategic focus on high-impact sectors such as government, finance, energy, and healthcare. “We’re proud to join hands with CPX to strengthen the digital resilience of the UAE’s most vital sectors. This partnership directly supports the country’s vision for a secure, future-ready digital economy by delivering proactive, scalable cyber protection where it’s needed most,” said Ziad Nasr, General Manager of Acronis Middle East. 🔗 Learn more and start your free 30-day trial: https://lnkd.in/g2bVPTqr

٢

Sovereign data in the GCC has shifted from compliance topic to national security architecture. If the recent regional escalation takes one cloud region offline, does your “sovereign” data survive or disappear with it. The gap between “compliant on paper” and “recoverable in practice” is often measured in days, not hours. 𝗖𝗼𝗻𝗳𝗹𝗶𝗰𝘁, 𝗱𝗮𝘁𝗮 𝗰𝗲𝗻𝘁𝗿𝗲𝘀, 𝗮𝗻𝗱 𝗰𝗼𝗿𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗿𝗶𝘀𝗸 The conflict shows how fast cyber, sanctions, and physical risk can converge on data centres, cables, and power. In a region where cloud regions, energy, and connectivity are tightly clustered, in country only can become a single point of failure. That forces a systems thinking view. It is not just about where the data sits. It is about how cloud regions, subsea routes, power, sovereign controls, and geopolitics interact as one architecture. 𝗥𝗲𝗶𝗺𝗮𝗴𝗶𝗻𝗲𝗱 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 𝗳𝗼𝗿 𝗚𝗖𝗖 𝗯𝗼𝗮𝗿𝗱𝘀 Three design shifts are starting to emerge. 𝗦𝗼𝘃𝗲𝗿𝗲𝗶𝗴𝗻 𝗯𝘆 𝗱𝗲𝘀𝗶𝗴𝗻, 𝗻𝗼𝘁 𝗯𝘆 𝘀𝗹𝗼𝗴𝗮𝗻 Tier 1 data (citizen, core banking, health, national security) on in-country primary and DR, with real AZ diversity, tested failover, and clear RTO and RPO. 𝗙𝗿𝗶𝗲𝗻𝗱 𝘀𝗵𝗼𝗿𝗲𝗱 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 For Tier 2 workloads, encrypted replicas in friendly jurisdictions, under treaty-grade safeguards or data embassy style frameworks, to avoid regionally correlated risk. 𝗔𝗜-𝗮𝘄𝗮𝗿𝗲 𝗱𝗮𝘁𝗮 𝗲𝘀𝘁𝗮𝘁𝗲𝘀 AI lakes and training pipelines are designed so that sensitive training data remains under GCC jurisdiction, even if some models and inferencing move across regions. Over the next 12 to 24 months, the leaders in UAE and KSA will treat sovereign data as an architectural discipline, not an IT constraint. If you sit on a GCC board or ExCo, where is your biggest gap today: data classification, DR design, or AI data estate architecture. #SovereignData #DataArchitecture #CyberResilience #RiskManagement #DigitalGovernance

١٢

‏٢‏ ‏تعليق‏

Happy to share that our Chief Officer Deep Chanda has been featured in a prominent two-page article (Pages 26 & 27) in Security Middle East Magazine  : a leading regional publication focused on #cybersecurity, #technology, and #digitaltransformation. The feature highlights Deep’s perspectives on: * Evolving cyber risks in the region * The shift toward resilience-driven security programs * Secure adoption of emerging technologies * Building trust in a rapidly digitizing ecosystem This recognition reflects the growing relevance of strong, outcome-driven cybersecurity leadership in today’s landscape. At Ampcus Cyber, we remain committed to enabling organizations with practical, resilience-focused security strategies that go beyond compliance and deliver real impact. You can read the full feature here: https://lnkd.in/ddwXMivT #CyberSecurity #ThoughtLeadership #MiddleEast #DigitalResilience #Leadership #AmpcusCyber

٦١

‏١‏ ‏تعليق واحد‏

The Data Residency Regulations in the UAE and Middle East: Security Implications and Operational Challenges Amid Crises- For years, I have emphasized that data residency requirements—mandating local storage of sensitive data—are not inherently security controls. In fact, they can create concentrated attack surfaces, making systems more vulnerable to targeted cyberattacks by limiting dispersal and creating predictable points of failure. The UAE and broader Middle East have rapidly adopted stringent regulations in recent years. The UAE's Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law, or PDPL) provides a comprehensive framework for personal data privacy, while sector-specific rules apply to finance (e.g., UAE Central Bank mandates for local storage of customer/transaction data) and healthcare (Federal Law No. 2 of 2019 on ICT in Health Fields, restricting health data storage/transfer outside the UAE without approval). Similar privacy-driven laws have emerged in Saudi Arabia (PDPL) and other GCC countries, emphasizing data localization for sensitive financial, healthcare, and personal information. Data localisation push is being seen globally. Recent geopolitical crises and wars in the region have highlighted a critical limitation: compliance with data residency ensures data is "present," but it does not guarantee business continuity or operational resilience. Conflicts can disrupt infrastructure, power, connectivity, or access within a country or region, rendering localized data inaccessible despite being compliant. Relying solely on on-premises data centers[or not using resilient architectures in cloud] exacerbates risks, as physical or cyber disruptions halt operations entirely. Even multi-region setups within the same affected area may fail to mitigate issues. Cloud providers often offer advantages, enabling swift data relocation to unaffected countries or maintaining operational control planes outside impacted zones—provided contractual and regulatory flexibility exists. Probably it is time when Industrywide regulators should introduce greater fluidity, allowing temporary or emergency data movement outside impacted jurisdictions during crises, balanced with safeguards. This would enhance true resilience without undermining privacy goals, ensuring organizations can maintain operations amid uncertainty. [views are entirely personal] #cloud #dataresidency , #Crisis

٦٩

‏٨‏ ‏تعليق‏

The conflict unfolding in the Middle East is not a distant event; its cyber dimensions are already affecting businesses, supply chains and critical infrastructure with a reach that extends well beyond the region. We in the intelligence community have communicated an increase in attacks, seriousness of threat and elevation of risk, but the NCSC's advisory this week is a clear signal; organisations need to act now, not when an incident occurs. Bolstering our advisory board, we have appointed Major General Jonathan Shaw CB CBE as its Chair. Major General Jonathan Shaw CB CBE is a former senior British Army officer with extensive experience in international security and defence policy. He served as Assistant Chief of the Defence Staff (Global Issues), where he oversaw the Ministry of Defence’s Defence Cyber Security Programme and contributed to the development of the UK’s early cyber security strategy. His role focused on strategic leadership, policy, and organisational development across cyber, intelligence and global security issues. He was appointed Companion of the Order of the Bath (CB) and Commander of the Order of the British Empire (CBE) in recognition of his service. Jonathan's appointment reflects our commitment to operating at the highest level of strategic credibility. His understanding of state-level cyber operations is unmatched in the commercial sphere, and his counsel is directly relevant to the clients we protect. ‘The threat environment facing UK businesses and critical infrastructure today is as serious as I have seen it in my career. Nation-state actors have demonstrated both the capability and the intent to conduct disruptive cyber operations against commercial targets, and the events of the past week represent a significant escalation. Cognition Intelligence operates where this threat is most acute: the convergence of physical surveillance, counter-espionage, and managed cyber protection through its platform, Cyber Overwatch. I am proud to support the work Anthony and his team are doing.’ Major General Jonathan Shaw CB CBE, Chair, Advisory Board, Cognition Intelligence

١٧

Why Middle East CNI Is Moving From Compliance to Sovereignty For years, critical national infrastructure across the Middle East was evaluated using a familiar question: Are we compliant? That question is no longer sufficient. Across the region, cyber threats to energy, water, ports, aviation, and telecom are persistent, politically motivated, and increasingly aligned with geopolitical pressure. Some campaigns aim to disrupt. Many are content to observe, map dependencies, and wait. Compliance does not stop that. Frameworks are designed to create consistency. Sovereignty is designed to preserve control under stress. What I’m observing across the Middle East is a deliberate shift. Governments and CNI operators are moving away from treating cybersecurity purely as a regulatory requirement and toward treating it as a national capability. That distinction matters. Compliance tells you whether controls exist. Sovereignty tells you whether a nation can detect early, decide clearly, and respond decisively when assumptions fail. The drivers behind this shift are visible: • Cyber risk is now inseparable from geopolitical risk • Infrastructure disruption carries regional and global consequences • Espionage campaigns prioritise long-term access over short-term impact • Supply chains and third parties have become strategic attack paths In this environment, passing audits does not guarantee resilience. I’ve seen highly compliant environments that still lacked: • real-time visibility into operational technology • confidence in cross-sector incident coordination • clarity on decision authority during a cyber crisis • the ability to operate safely while partially compromised That gap is what sovereignty is intended to address. Cyber sovereignty does not mean isolation. It means ownership. Ownership of detection capability. Ownership of response authority. Ownership of national priorities when systems are under pressure. This explains the growing focus across the region on: • sovereign SOC and CERT capabilities • stronger OT governance aligned to national risk • tighter control over critical vendors and access paths • collaboration framed as strategic partnership, not dependency In the Middle East, this evolution is both logical and necessary. Energy grids, desalination plants, ports, and telecom networks are not just commercial assets. They underpin economic stability, public safety, and regional influence. A nation that cannot maintain control over them independently remains exposed regardless of how many frameworks it complies with. The board-level question has changed. It is no longer: “Are we compliant with standards?” It is now: Can we maintain control when systems are stressed and assumptions fail? Compliance is a baseline. Sovereignty is the objective. CNI leaders in the Middle East: Are you optimising for audits or for control when it matters most?

٨

𝗨𝗔𝗘 𝗣𝗔𝗦𝗦 𝗶𝘀 𝗻𝗼𝘄 𝗮 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝘁𝗮𝗿𝗴𝗲𝘁. 𝗧𝗵𝗮𝘁'𝘀 𝘄𝗼𝗿𝘁𝗵 𝗽𝗮𝘆𝗶𝗻𝗴 𝗮𝘁𝘁𝗲𝗻𝘁𝗶𝗼𝗻 𝘁𝗼. Last week, Digital Dubai and Telecommunications and Digital Government Regulatory Authority warned about phishing campaigns going after UAE PASS users. Fake messages, spoofed login requests, people getting tricked into handing over credentials. The easy read is that this is a security problem. I think it's also a signal. When a national digital identity system gets targeted like this, it means real services, real money, and real decisions run through it. Attackers go where the value is. And that's the tension with scaling identity infrastructure - the more useful it becomes, the more it attracts bad actors. Which means authentication can't be an afterthought. It has to be built for adversarial conditions from the start. The UAE phasing out SMS OTPs for banking by end of this month is a good move in that direction. Upgrade the verification layer before the attack surface grows!! https://lnkd.in/djnbB_UD

١١