Suggestions
Nikita Remezov
Cyber, Tech, BCP/DR Risks at Uber Payments
Nikita Remezov is an IT Security leader with extensive experience and knowledge in Information Security and IT.1 He currently holds the position of Head of Cyber Security & Technology Risks at Uber.1
Remezov's LinkedIn profile indicates that he has a background in the field of Information Technology and Security. He received his education from the National Research Nuclear University, which suggests a strong technical foundation.1
In addition to his professional presence on LinkedIn, Nikita Remezov is also active on Twitter under the username @nremezov.2 On this platform, he occasionally shares insights related to his field of expertise. For instance, in August 2022, he published an article about company and departmental vision in the context of security leadership.2
Given his role at Uber and his background, it's likely that Remezov is responsible for overseeing and managing cybersecurity strategies and technology risk assessments for the company. His position suggests that he plays a crucial role in protecting Uber's digital assets and ensuring the security of its technological infrastructure.
Highlights
SS7 ramblings
Some time ago I was asked how user can protect himself from SS7 attacks. Obvious generic on-the-surface answer is - enable app-level 2FA, password for messengers - basically get rid of SMS authentication.
However, this may still not be fully acceptable level, due to potential call interception, and the fact that some services may have hard-wired SMS/Call authentication or password reset.
Throughout the conversation I was asked whether disabling 'roaming mode' will help? Was not sure in the moment - however, after quick research I tend to believe that disabling 'roaming mode' on the phone itself won't have any positive effect, but disabling 'roaming' in the telecom operator itself will provide significant boost in defense.
Security community, what are your thoughts on that? What user can do?
Maybe some Telco's have implemented SS7 defenses and it's a matter of switching to the 'right' cellular provider?
Very close to the voucher expiry date, I've remembered that I can try to take the exam which was part of the package from the previous year training. Decided to take a shot - and barely made it with 73%. Passing threshold is 70%.
Exam test consists of 80 questions. It means that if I've answered 1 or 2 more question wrong, I would be writing a slightly different post here :)))
FAIR is a beautiful & comprehensive risk analysis methodology. It has taught me how one can significantly increase quality of assessments and raise the objectivity levels (which is critical when you are planning multi-year programs and desperately need consistency and repeatability).
I've been working with FAIR for few years now, and was slowly integrating elements of it in my enterprise risk assessments. It's very exciting to see how even few elements from FAIR help to boost up the risks assessment quality.
Exam perspective - OpenFAIR is a bit different from original FAIR (Described in the original book - Measuring & Managing Information Risk (2014)). Few exam questions (and concepts raised in there) were unknown to me.
For everyone who is thinking about the exam, I strongly advise to learn the OpenGroup materials (if I had more time, i would definitely do that). https://lnkd.in/eT2JU5xu https://lnkd.in/e5V_qu5M
For everyone, who is interested in cyber risk assessments - watch for the new edition of foundational book: https://lnkd.in/eWx3B6XR
