New Zealand MFAT: Mission and Cybersecurity

Mission and Purpose

• The Ministry of Foreign Affairs and Trade (MFAT) aims to advance New Zealand's international priorities
• MFAT's work ensures the security, stability, and prosperity of New Zealanders both in New Zealand and internationally
• A primary goal is promoting security, stability and prosperity for New Zealand
• Cybersecurity is critical to safeguarding sensitive data and systems that are critical to NZ’s international relations

Key Functions of MFAT

• MFAT represents New Zealand in formal communications with the United Nations, APEC, WTO and other countries
• MFAT emphasizes safeguarding diplomatic communications and data across international platforms
• MFAT aims to expand market access for New Zealand exporters
• MFAT negotiates trade agreements and supports international expansion for businesses
• Cybersecurity is vital for shielding trade agreements and sensitive economic data
• The New Zealand Aid Programme is managed by MFAT
• The New Zealand Aid Programme focuses on poverty reduction and sustainable development, especially in the Pacific region
• Secure digital platforms in development programs are important, particularly in high-risk Pacific regions

Organizational Structure of MFAT

• Hierarchical structure
• Bede Corry is currently the Chief Executive and Secretary of Foreign Affairs and Trade
• The Senior Management Team includes the Chief of Staff, Deputy Chief Executive for People and Operations, the Chief Financial Officer, the Chief Info Officer, and the Chief People Officer
• Organised into regional and functional divisions
• Teams focus on trade, consular services, development, and specific geographic areas

Key Ministers

• Minister of Foreign Affairs oversees the ministry's foreign policy initiatives
• Minister for Trade focuses on trade negotiations and economic partnerships
• Minister of State for Trade lends assistance in trade-related areas
• Minister of Climate Change is responsible for international climate change negotiations
• CIOs are key in securing information systems

Key Responsibilities of Cyber Security Specialist - SOC Analyst

• Helps keep the ministry's information and cyber security operations running smoothly
• Securing data and systems is a critical part of their role
• Ongoing security oversight is provided for MFAT’s digital infrastructure
• Ongoing security ensures the security of critical data
• Expertise in incident detection and security monitoring
• Identify, analyze, and respond to security incidents while working with stakeholders to mitigate risks
• Experience in incident management to improve abilities
• Quickly and effectively identify, analyze, and mitigate security incidents
• Conduct regular risk assessments
• Recommend mitigation strategies
• Experience with tools like CrowdStrike, Sentinel, and Darktrace will help you find vulnerabilities at MFAT
• Stay up to date on emerging cyber threats
• Enhance security protocols continuously
• Stay updated on emerging cyber threats by making contributions

MFAT's Strategic Intentions (2024-2028)

• Strengthening relationships with India, Southeast Asia, and ASEAN aligns with MFAT's goals
• Cybersecurity is needed to secure diplomatic ties, trade agreements, and private discussions
• Secure data exchange strengthens relationships
• Collaboration with Australia is a Pacific Partnership strategy used to improve regional security and economic growth
• Security resilience bolsters security
• Expanding New Zealand’s export value with trade growth
• Security is key to protecting international business as MFAT expands exports
• Securing platforms tied to New Zealand's global trade

Global Awareness

• An understanding of world events, especially in New Zealand, is vital
• New Zealand sanctions on Russia in response to its invasion of Ukraine
• International infrastructure increasingly faces state-sponsored threats, increasing cybersecurity risks on a global scale
• Climate change finance involving mitigation, adaptation, and capability building is the focus of MFAT climate change initiatives
• The ministry may work with global partners on environmentally related programs, while cybersecurity helps ensure secure Collaboration and Data-sharing
• Focuses on integrating human rights into New Zealand's foreign aid strategy
• Experience with integrating human rights within cybersecurity frameworks is needed, since sensitive human rights data and information need protection

Review of Public Statements

• MFAT’s long-term goals are outlined in Strategic Intentions 2024–2028
• Understand how cybersecurity can assist MFAT meet goals
• The need for strong cybersecurity frameworks
• Insights into New Zealand’s engagement with the UN are in the United Nations Handbook 2024–25
• Understand cybersecurity protocol needs in a global context
• Align MFAT’s works with global diplomacy
• Gender, Māori, Pacific, and Ethnic Pay Gap Action Plan 2024–2025 are in the Diversity and Inclusion Reports
• The focus aligns with broader government goals, despite not directly related to technical roles
• Diversity can enhance problem-solving and innovation in security teams

Behavioral Questions

• Justin Dulangon is a passionate cybersecurity professional dedicated to protecting data and critical systems
• He stays sharp by participating in Capture The Flag (CTF) competitions, ensuring he's up-to-date with emerging threats
• At Kordia, Justin specializes in threat detection, prevention, and analysis as a Security Analyst
• The cybersecurity mission at MFAT is exciting, and aligns with his interest
• He is proactive, detail-oriented, and eager to learn
• He strengthens security and preventing risks
• Helping to ensure the safety of sensitive government data
• Passion for cybersecurity and working with diplomatic missions
• Values clear goals, open communication, learning, problem-solving, and teamwork
• Wants to expand cloud security knowledge
• Improve detection and response to advanced security threats
• Creating stronger security teams

Short and Long Term Goals

• Seeks expertise in threat intelligence and pentesting
• Short term, gain hands-on experience with advanced security tools in cloud security
• Seek to become an expert in security operations and incident response
• Long term, become a subject matter expert in threat intelligence and penetration testing
• Transition into a leadership role and shape the cybersecurity strategy

International Experience

• Worked with international teams at Kordia adapting work styles to Australia and the U.S.
• Participate in global cybersecurity competitions

Complex Problem-Solving

• Handled high-pressure incidents involving global clients as a Cybersecurity Analyst
• Remediated after swiftly investigating a persistent APT threat targeting cloud assets
• Used Microsoft Defender, Sentinel, DarkTrace, and CrowdStrike to stop state-sponsored phishing campaign

Demonstrated Values in Action

• Committed to human rights, global security, and climate action while supporting mission
• Advocate for sustainable practices and cloud security solutions that support eco-friendly computing principles
• Contributed to cybersecurity awareness

Incident Management

• Detected malware by a Cassini CTI indicator in Sentinel and Defender and worked under pressure
• Expiro malware and control server were linked to endpoint device with suspicious processes and compromised credentials
• Other devices connected to suspicious domains, suggesting potential lateral movement
• Client confirmed unauthorized domains so they blocked them
• Anomaly detected by CrowdStrike, and has a 100% confidence abuse score on IPDB
• Contacted client to advise isolating server and blocking malicious ips

Conflicting Priorities

• At Kordia, simultaneously managed P1 and P2 incidents for multiple clients needing immediate attention
• Assessed each incident to see which posed the highest risk/urgent resolution
• Delegated tasks by teamwork and urgency

Security Vulnerabilities

• During the night shift, identified a high-priority (P1) security incident involving compromised user access
• The account had suspicious login attempts at multiple locations
• Senior advised to immediately contact client

Performance Management

• Discuss in a one-on-one conversation
• Communicate with team to figure out what is necessary to continue
• Communicate issue with the team leader

Complex Technical Issues

• Ability to explain impact of phishing attack and nation-state campaign
• Avoid jargon and utilize simple language

Working with International Teams

• Ensure to check time zones
• Supply clear concise details
• Be mindful of communication styes and cultural differences

Adapting to the Current Work Environment

• Transitioned from Altissan Confluence to ServiceNow
• Learn from training materials
• Simplify the work stream
• Stay efficient with workflows, be proactive and flexible

Risk, Vulnerability, and Threat

• Risk is an exploited vulnerability created by a threat
• Threat intelligence and vulnerability scanning to prioritize risks based on potential impact
• Threat = cybercriminal, insider threat or state-sponsored
• Use tools like NIST Cybersecurity Framework to account for vulnerabilities - minimized both preventatively and deductively
• Keep up-to-date on emerging risks by leveraging the NIST Cybersecurity Framework

Encryption

• Symmetric encryption via AES is efficient for large data volumes
• Private communication via RSA with asymmetric encryption
• Implement AES and RSA for MFAT

Incident Response

• Detection via Microsoft Sentinel
• Identify attack to confirm malware or ransomware and understand impact
• Isolate systems to prevent attack from spreading
• Remove malicious file and patch exploit vulnerability and ensure clean restart
• Use back ups to ensure all data is intact
• Lessons learned - conduct a review to implement additional safety

TCP Handshake and Network Security

• TCP is vulnerable to attacks such as SYN floods
• Use WireShark to detect attacks, implementing proper rate-limiting
• Need to ensure proper rate-limiting in firewalls

Emerging Threats and Remaining Informed

• Use AliensVault and MISP along with blogs like Dark Reading
• Patch systems and ensure back-up protocols are in place
• Assess potential

Global Environment

• Maintain secure policies and training for consistent communication and cybersecurity
• Adjust actions due to regional threat landscapes
• MFA, standardize VPN's and encrypt teams and training

Microsoft Sentinel and Defender

• Review alerts and patterns to improve analytics and playbooks

SIEM and IDS/IPS Tools:

• Analyze pattern trends and anomaly alerts to improve tool performance
• Prioritization of those that breach business impact quickly

Azure Cloud Security

• Skilled in Azure security principles
• Ensure identity and access management and multi-factor authentication
• Continously assess and monitor compliance

Mentorship

• Help create the training plan
• Helped junior analysts and reviewed alerts
• Structured the theoretical
• Helped with practical scenarios