Cybersecurity analysis, breach case studies, and IT General Controls insights from Marco Cavani.https://marcoweb.org/en-auhttps://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In 2022, the Lapsus$ group compromised Microsoft, Okta, Samsung, and Nvidia by spamming push MFA notifications until tired users approved. Cloudflare was also targeted. Their FIDO2 hardware keys made the attack irrelevant. Authentication is the control that decides which outcome you get.Fri, 31 Jul 2026 00:00:00 GMTAuthenticationITGCMFALapsus$FIDO2Identity SecurityIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/The EU's Digital Operational Resilience Act makes surviving an IT disruption a matter of law for financial firms, and fintechs are squarely in scope. Here are the five pillars, the third-party trap, and where the accountability actually sits.Thu, 30 Jul 2026 00:00:00 GMTDORAFintechOperational ResilienceICT RiskThird-Party RiskTLPTEU RegulationCompliancemarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In critical infrastructure a network breach is not a data problem, it is a physical one. Here is why segmentation is the control that keeps a compromised laptop away from a turbine, and why the VPN meant to protect the network is so often the way in.Thu, 30 Jul 2026 00:00:00 GMTCritical InfrastructureNetwork SegmentationVPNOT SecurityIEC 62443Zero TrustICSCybersecuritymarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In an online gaming platform the financial truth lives in a database, and that database increasingly lives in the cloud on infrastructure the operator does not run. Here is how a SOC 1 gives assurance over it, and what an auditor actually tests.Thu, 30 Jul 2026 00:00:00 GMTSOC 1iGamingCloudDatabaseISAE 3402SSAE 18ITGCAssurancemarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/For a SaaS company, a SOC 2 is the report a serious customer wants before they trust you with their data. Here is what the Trust Services Criteria actually mean, how SOC 2 differs from SOC 1, and how to read one properly.Thu, 30 Jul 2026 00:00:00 GMTSOC 2SaaSTrust Services CriteriaAssuranceCloudSecurityITGCVendor Riskmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/An e-gaming platform is a stack, not a single system. Audit only the application and you have checked the shop window. Here is how to scope the full three layers, application, operating system and database, in the cloud.Thu, 30 Jul 2026 00:00:00 GMTe-GamingIT AuditSaaSDatabaseCloudITGCFull ScopeShared Responsibilitymarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In April 2023, Samsung discovered that employees had pasted confidential source code, test sequences, and internal meeting notes into ChatGPT in three separate incidents. The data cannot be retrieved. AI Controls exist to prevent exactly this scenario.Wed, 29 Jul 2026 00:00:00 GMTAI ControlsITGCGenerative AIData SecuritySamsungChatGPTIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In November 2023, a cyberattack forced DP World Australia to take its port operations offline for four days, stranding 30,000 containers at four major Australian ports. The incident demonstrated that a single managed logistics provider's security posture could be leveraged to disrupt 40 percent of Australia's container port capacity.Wed, 29 Jul 2026 00:00:00 GMTCritical InfrastructureDP WorldMaritimeSupply ChainPort OperationsIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/On 12 May 2017, WannaCry ransomware encrypted devices across 80 NHS organisations in England, forcing the cancellation of at least 19,000 appointments and procedures. This report examines how a nation-state-developed exploit became a criminal weapon and what it exposed about patch management and network segmentation in public health infrastructure.Wed, 29 Jul 2026 00:00:00 GMTCritical InfrastructureNHSWannaCryHealthcareEternalBlueIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/On 5 February 2021, an attacker remotely accessed the control system of the Oldsmar, Florida water treatment plant and raised the sodium hydroxide concentration to 111 times the safe level. An alert operator noticed the cursor moving and reversed the change. This near-miss exposed the open remote access vulnerabilities common in small water utilities across the US.Wed, 29 Jul 2026 00:00:00 GMTCritical InfrastructureWater TreatmentOldsmarOT SecurityTeamViewerIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/On 15 August 2012, the Shamoon malware wiped the master boot records and overwrote data on approximately 30,000 Saudi Aramco workstations. The attack took the world's most valuable oil company offline for weeks and established the wiper attack as a nation-state weapon against energy infrastructure.Wed, 29 Jul 2026 00:00:00 GMTCritical InfrastructureSaudi AramcoShamoonWiper AttackEnergy SectorIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/On 23 December 2015, a coordinated cyberattack by the Sandworm group cut power to approximately 225,000 customers in western Ukraine. It was the first confirmed cyberattack to cause an electricity outage. This report examines the attack chain, the operational technology vulnerabilities it exploited, and what it established for the security of power grid infrastructure globally.Wed, 29 Jul 2026 00:00:00 GMTCritical InfrastructureUkrainePower GridSandwormICS SecurityIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/More than 60 percent of UK universities experienced a ransomware or significant cyberattack between 2019 and 2023. This report examines the structural characteristics that make universities persistent ransomware targets, the ITGC control gaps common across the sector, and the specific cases that illustrate the pattern.Wed, 29 Jul 2026 00:00:00 GMTEducationUniversityRansomwareOpen NetworksResearch DataIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In October 2022, REvil-linked actors exfiltrated the health insurance records of 9.7 million Australians from Medibank Private. When the company refused to pay the ransom, the attackers published customers' most sensitive medical data online. This report examines the breach, the control failures, and what happens when health data becomes a coercion instrument.Wed, 29 Jul 2026 00:00:00 GMTHealthcareMedibankHealth DataREvilRansomwareIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In March 2023, attackers used stolen employee credentials from a service provider to access Latitude Financial's systems, ultimately stealing 14 million customer records including 7.9 million identity document numbers. This report examines the largest confirmed data theft in Australian history, the systemic third-party access failure, and the insurance and consumer finance sector's data retention exposure.Wed, 29 Jul 2026 00:00:00 GMTFinancial ServicesLatitude FinancialThird-Party BreachIdentity DocumentsIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In April 2023, ALPHV/BlackCat ransomware exfiltrated 4 terabytes of data from HWL Ebsworth, one of Australia's largest law firms, including data belonging to 65 federal government agency clients. This report examines how law firms function as unintended data aggregators for their clients, and why the legal sector's cybersecurity posture creates systemic risk for governments and corporations alike.Wed, 29 Jul 2026 00:00:00 GMTLegalHWL EbsworthALPHV BlackCatLaw Firm SecurityGovernment DataIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In September 2022, an unauthenticated API endpoint allowed an attacker to systematically enumerate and download the personal records of 9.8 million current and former Optus customers. This report examines the architectural failure, the identity document exposure it created, and what the telecommunications sector's data obligations mean for ITGC controls.Wed, 29 Jul 2026 00:00:00 GMTTelecommunicationsOptusAPI SecurityIdentity TheftData BreachIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In October 2022, 2.2 million customer records were stolen from Woolworths' MyDeal e-commerce subsidiary using a compromised employee credential. This report examines how post-acquisition security integration failures create breach conditions, and what the retail sector's credential-based breach pattern means for ITGC controls.Tue, 28 Jul 2026 00:00:00 GMTRetailWoolworthsMyDealCredential BreachM&A SecurityIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/LastPass was breached twice in 2022. The second breach exploited a DevOps engineer's home computer to reach cloud backups that held encrypted vaults for 33 million users. Periodic security assessments of the cloud environment should have identified the path. They did not.Mon, 27 Jul 2026 00:00:00 GMTPeriodic Security AssessmentITGCPenetration TestingLastPassCloud SecurityIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In 2016, attackers accessed Uber's GitHub, found AWS credentials in plain text, and downloaded 57 million user records. The entire attack was detectable. The signals existed. No system was watching and correlating them. That is what a SIEM is for.Fri, 24 Jul 2026 00:00:00 GMTSIEMITGCSecurity MonitoringUber BreachThreat DetectionIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In February 2019, three weeks before the Australian federal election, the Australian Signals Directorate disclosed that the Parliament House network had been breached by a sophisticated state actor. This report examines the threat context, the ITGC implications for government networks, and the broader challenge of defending democratic institutions from nation-state espionage.Thu, 23 Jul 2026 00:00:00 GMTGovernmentAustralia ParliamentState-SponsoredNation-StateEspionageIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Capital One's 2019 breach exposed 100 million customer records. AWS CloudTrail logs captured every step of the attack in real time. Nobody was watching. Event Logging is the control that turns data into detection.Wed, 22 Jul 2026 00:00:00 GMTEvent LoggingITGCLog ManagementCapital One BreachAudit TrailIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In September 2022, a social engineering attack targeting a third-party database provider exposed the personal data of 50,150 Revolut customers. This report examines the incident, the ITGC control failures that enabled it, and the systemic risk facing fintech firms that aggregate sensitive customer data at scale.Tue, 21 Jul 2026 00:00:00 GMTFintechRevolutData BreachThird-Party RiskSocial EngineeringIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In March 2019, LockerGoga ransomware encrypted Norsk Hydro's global IT systems, forcing aluminium smelters to switch to manual operations and costing the company approximately USD $71 million. This report examines how a credential compromise became a production shutdown, and what IT/OT convergence means for mining sector cybersecurity controls.Tue, 21 Jul 2026 00:00:00 GMTMiningNorsk HydroLockerGogaOT SecurityRansomwareIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In June 2017, the NotPetya wiper destroyed 30,000 of Merck's computer systems, halted pharmaceutical manufacturing, and resulted in estimated losses of USD $1.3 billion. This report examines the incident, its specific implications for regulated pharmaceutical environments, and the ITGC control failures that amplified the damage.Tue, 21 Jul 2026 00:00:00 GMTPharmaceuticalMerckNotPetyaManufacturingDisaster RecoveryIncident Reportmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Attackers do not always break through your front door. Sometimes they walk in through a vendor's access. The Target breach is the textbook case, and the lessons still apply a decade later.Sun, 19 Jul 2026 00:00:00 GMTThird Party ManagementITGCVendor RiskSupply Chain SecurityTarget BreachIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Equifax knew about the Apache Struts vulnerability. A patch existed. The risk was real and documented. The breach happened anyway. That is the definitive case for why IT Risk Management is an audit control, not a planning exercise.Sun, 19 Jul 2026 00:00:00 GMTIT Risk ManagementITGCRisk RegisterEquifaxVulnerability ManagementIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/When Marriott acquired Starwood in 2016, they inherited a compromised network. Because the two environments were poorly segmented, attackers moved freely for four years. Network Architecture is the control that determines how far a breach can travel.Sun, 19 Jul 2026 00:00:00 GMTNetwork ArchitectureITGCNetwork SegmentationMarriott BreachDefence in DepthIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/The SolarWinds SUNBURST attack compromised 18,000 organisations. The malware called home for months. Egress filtering and network security controls should have caught it. Here is what was missing and what auditors check.Sun, 19 Jul 2026 00:00:00 GMTNetwork Security ControlsITGCFirewallSolarWindsEgress FilteringIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In May 2017, WannaCry ransomware spread across 150 countries in hours. The NHS lost 19,000 appointments. The vulnerability it exploited had been patched two months earlier. Endpoint protection is the control that closes that gap.Sun, 19 Jul 2026 00:00:00 GMTEndpoint ProtectionITGCWannaCryEDRPatch ManagementNHSIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/A Morgan Stanley financial adviser downloaded the details of 730,000 clients to a personal device over 18 months. Data Loss Prevention controls should have caught it. When they did not, the cost was a $1 million regulatory fine and a breach affecting nearly a million people.Sun, 19 Jul 2026 00:00:00 GMTData Loss PreventionITGCDLPInsider ThreatMorgan StanleyIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/In December 2021, a critical vulnerability in the Log4j logging library put hundreds of millions of devices at risk. The flaw had existed for years. Exploitation appeared within hours of disclosure. Vulnerability Management is the only control that closes that window.Sun, 19 Jul 2026 00:00:00 GMTVulnerability ManagementITGCLog4ShellCVEPatch ManagementIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/IT Governance sets the tone from the top. When boards and executives treat cybersecurity as someone else's problem, attackers treat your organisation as their next target. The Colonial Pipeline breach proved it.Sun, 12 Jul 2026 00:00:00 GMTIT GovernanceITGCCOBITBoard AccountabilityColonial PipelineIT Auditmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/A strategic deep-dive into NIST's Computer Security Incident Handling Guide, covering the full IR lifecycle, team structure, detection methods, prioritisation frameworks, and the power of post-incident learning.Mon, 15 Jun 2026 00:00:00 GMTIncident ResponseNISTSOCBlue TeamDetectionContainmentCybersecurity Frameworkmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Australia's revised Privacy Act hands consumers new powers and puts businesses on the hook for data breaches. With AI lowering the bar for cybercriminals, here's what organisations must do now.Sat, 18 Jan 2025 00:00:00 GMTPrivacy ActAustraliaData SecurityOAICComplianceAICrowdStrikeRegulationmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Key insights from IBM's Cost of a Data Breach report: healthcare leads at $10.1M per breach, while AI platforms, DevSecOps, and incident response teams can significantly cut costs.Wed, 15 Jan 2025 00:00:00 GMTData BreachIBMCost AnalysisHealthcareAI SecurityDevSecOpsIncident Responsemarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/Nearly 1.9 million phishing attacks in a single year, $4.5M average breach recovery cost, and seniors losing $3.4B. The data on phishing in 2024 is staggering. Here's what organisations must do.Sat, 28 Dec 2024 00:00:00 GMTPhishingCybercrimeBECSocial EngineeringCyber AwarenessData Breach2024marco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/MGM Resorts International suffered a $100M cyberattack in 2023; slot machines went dark, room keys failed, booking systems crashed. Here's exactly how Scattered Spider did it.Tue, 03 Sep 2024 00:00:00 GMTScattered SpiderMGM ResortsRansomwareSocial EngineeringBlackCatOktaVishingmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/In 2023, a hacking group known as Scattered Spider or UNC3944 made headlines for its sophisticated cyberattacks on two of the largest casino companies in the United States: Caesars Entertainment and MGM Resorts International.Tue, 03 Sep 2024 00:00:00 GMTCybersecurityRansomwareSocial EngineeringThreat IntelligenceCasino Securitymarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/How Generative Adversarial Networks are being weaponised by cybercriminals, why regulators are scrambling to catch up, and what individuals and organisations can do to protect themselves.Fri, 14 Jun 2024 00:00:00 GMTDeepfakeAISocial EngineeringFraudMachine LearningGANCybercrimemarco@marcoweb.org (Marco Cavani)https://marcoweb.org/reports/undefined/https://marcoweb.org/reports/undefined/A comprehensive assessment and strategic roadmap for Western Power, addressing key challenges in cybersecurity, insider threats, and climate change resilience for one of Australia's largest electricity distributors.Tue, 20 Feb 2024 00:00:00 GMTCybersecurityCritical InfrastructureInformation SecurityAustraliaEnergy Sectormarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/An in-depth analysis of why information security is vital for critical infrastructure operators, covering CIA triad principles, classification frameworks, and the real-world consequences of cyber disruptions.Thu, 05 Oct 2023 00:00:00 GMTInformation SecurityCritical InfrastructureCIA TriadNISTPSPFWestern PowerRisk Managementmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/A chronological account of the BOTSv3 security incident on 20 August 2018, categorised by MITRE ATT&CK tactics, from initial access and phishing through to exfiltration and a Memcached DDoS attack.Sun, 28 May 2023 00:00:00 GMTMITRE ATT&CKBOTSv3Incident ResponseBlue TeamSIEMSplunkCTFmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/A vendor-based analysis of zero-day vulnerabilities from 2006 to 2023, revealing which companies are most associated with exploitable weaknesses, and what organisations can learn from the patterns.Wed, 17 May 2023 00:00:00 GMTZero-DayVulnerabilitiesMicrosoftThreat IntelligenceNISTPatch Managementmarco@marcoweb.org (Marco Cavani)https://marcoweb.org/blog/undefined/https://marcoweb.org/blog/undefined/How cybersecurity governance frameworks help small and medium enterprises identify, assess, and manage risks, and why the most impacted businesses in Australia are often the ones with the least protection.Thu, 02 Mar 2023 00:00:00 GMTGovernanceSMECybersecurityNISTRisk ManagementACSCmarco@marcoweb.org (Marco Cavani)