Chris Pierson

#SEC finalized amendments for S-P, designed to protect PII. RIAs, BDs and more must, (1) have a written incident response plan (IRP) and (2) develop procedures to notify people whose PII was improperly accessed. To quote the SEC, "The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”" 18-24 months to implement. #ria #rias #cybersecurity

4

Drawing upon a comprehensive survey of almost 400 corporate DFIR professionals, the fourth annual State of Enterprise #DFIR report examines the evolving contributions and experiences of DFIR professionals within corporate environments. Get it today: https://ow.ly/ENaK50RkeWH

16

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

This is a great tool to help audit committees perform their oversight role to ensure that cybersecurity risks are well managed. https://lnkd.in/gF8fc6aQ Cybersecurity is a process, not just a project—and audit committees have a role to play throughout. That means ensuring management is continually identifying critical data and the threats to that data, protecting it, and planning for breaches. Thanks to KPMG Canada #cybersecurity #auditcommittee #risk #risks #riskmanagement

1

DFS's amended Cybersecurity Regulation was tailored to better fit different sizes and types of entities based on their risks and resources. The Department's “Am I Exempt?” flowchart is a resource to help covered entities better understand their exemption qualifications. Download the PDF at www.dfs.ny.gov/cyber.

39

This Cybersecurity and Infrastructure Security Agency guide offers actionable steps to combat the evolving tactics of foreign malign influence operations. More resources available here: https://lnkd.in/ebM9fqFn #security #nationalsecurity #homelandsecurity #infrastructure #criticalinfrastructure #CI #resource #research #resources #highthreat #threat #threats #cybersecurity #cyber #electionsecurity

7

https://lnkd.in/ePufpVtQ "The guidelines emphasize a range of steps, including understanding the dependencies of AI vendors that operators might be working with and inventorying AI use cases. They also encourage critical infrastructure owners to create procedures for reporting AI security risks and continually testing AI systems for vulnerabilities." Cybersecurity and Infrastructure Security Agency #AI #ArtificialIntelligence #Cybersecurity

1

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

8

While I am reposting this is that many of my connections have to adhere to 23 NYCRR 500 and it will be useful to them, publishing a template like this is also horrible to get it followed. I was talking with Deborah Nitka at dinner today, and she mentioned how she would examine compliance related documents, and it is clear that they basically just did a universal Cut and Paste on company name. Sharing a template like this can result not in people actually implementing a compliant program, but in creating a document that looks like they are. That is a major difference.

40

3 Comments

Brief article on #CISA's proposed rule to require certain entities in the 16 critical infrastructure sectors to timely report specific cybersecurity incidents and ransomware payments. #govcon #cyber #criticalinfrastructure

4

1 Comment

Hopefully you a process to frequently assess your organization's cyber risks. ⚠️ If you don't currently have process in place, and you should, here's 6 Types of Risk Assessment methodologies and their use case. 📝 Feel free to reach out if we can point you in the right direction🤝 #cybersecurity #nonprofit #riskassessment

1

It's of no surprise that NIST won an award for their efforts in developing CSF 2.0. NIST released it CSF 2.0 update in February 2024, a much need update to the CSF that included governance, regulatory compliance, risk management and an increased focus on supply chain risk management. NIST CSF is a well known framework and adopted by FISMA, U.S federal cyber regulation. As well as many industry sectors globally as a the controls framework for cybersecurity and cybersecurity risk management. That will be increasingly required by entities covered by the increasing amount of global cyber regulations. We were pleased to present CSF 2.0, U.S and EU cyber regulation, governance and the role internal audit plays in the oversight, assurance and attestation of cybersecuirty risk management, The Institute of Internal Auditors Inc. this week. Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner @ Veritas GRC National Institute of Standards and Technology (NIST) #csf2 #cybersecurity #cyberriskmanagement #cyberregulation

16

1 Comment

🔥 S3E11: 'Decision-Making Governance & Design: Combating Dark Patterns with Fair Patterns' with Marie Potel-Saville In this episode, Marie Potel-Saville joins Host, Debra Farber JD, CISSP, FIP, to shed light on the widespread issue of #darkpatterns in design. With her background in law, Marie founded the Fairpatterns project with her award-winning privacy and innovation studio, Amurabi, to detect and fix large-scale dark patterns. Throughout our conversation, we discuss the different types of dark patterns, why it is crucial for businesses to prevent them from being coded into their websites and apps, and how designers can ensure that they are designing fair patterns in their projects. Dark patterns are interfaces that deceive or manipulate users into unintended actions by exploiting cognitive biases inherent in decision-making processes. Marie explains how dark patterns are harmful to our economic and democratic models, their negative impact on individual agency, and the ways that FairPatterns provides countermeasures and safeguards against the exploitation of people's cognitive biases. She also shares tips for designers and developers for designing and architecting #fairpatterns. 🔊 Listen here (with transcript & chapter markers) or wherever you get your podcasts: https://lnkd.in/gFFAerJm TOPICS COVERED: - Why Marie shifted her career path from practicing law to deploying and lecturing on Legal UX design & combatting Dark Patterns at Amurabi - The definition of ‘Dark Patterns’ and the difference between them and ‘deceptive patterns’ - What motivated Marie to found FairPatterns.com and her science-based methodology to combat dark patterns - The importance of decision making governance - Why execs should care about preventing dark patterns from being coded into their websites, apps, & interfaces - How dark patterns exploit our cognitive biases to our detriment - What global laws say about dark patterns - How dark patterns create structural risks for our economies & democratic models - How "Fair Patterns" serve as countermeasures to Dark Patterns - The 7 categories of Dark Patterns in UX design & associated countermeasures - Advice for designers & developers to ensure that they design & architect Fair Patterns when build9ing products & features - How companies can boost sales & gain trust with Fair Patterns - Resources to learn more about Dark Patterns & countermeasures ------------------------------------------------------------------------- 🙏🏼 Thank you to our sponsor, Privado.ai, the developer-friendly privacy platform 👉🏼 Follow The Shifting Privacy Left Podcast page here on LinkedIn cc: Mert, Kimberly, Dan, Nandita, Jake, Jason, Ray, Michelle, Lourdes, Aaron, Jared, Sam, Engin, Cara, Steve, Jeff, Debbie, Jessica, Aleatha, Matthew, Lea, Jay, Saima, Nishant #privacy

21

3 Comments

OMB's Cyber Budget Priorities Memo out: "Agency budget submissions should demonstrate how agencies are reducing risk by increasing maturity of information systems across the pillars outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA) Zero Trust Maturity Model." https://lnkd.in/e2dvJU3k

22

4 Comments

🔒 Navigating Cybersecurity Compliance Challenges for Federal Agencies 🔒 🔗 https://buff.ly/461TwYh At MAD Security, we understand the formidable hurdles that federal entities face in implementing the rigorous logging practices mandated by M-21-31. From technological limitations of legacy systems to resource constraints, these challenges require strategic solutions. Key Points: 🔄 Legacy Systems: Many agencies operate with outdated technology that hampers effective data logging and security measures 💼 Resource Constraints: Budgets and expertise are often limited, making it difficult to allocate funds for necessary cybersecurity upgrades 🛠️ Strategic Modernization: Successful compliance involves more than just upgrades; it requires a complete redesign of IT processes to close gaps and ensure robust logging 🚀 Upgrading IT infrastructures and redesigning processes are essential to not only meet compliance requirements but to future-proof cybersecurity defenses. With MAD Security, agencies gain a partner adept at overcoming these obstacles through innovative solutions and expert guidance. 🤝 Learn how we can help your agency meet M-21-31 standards and fortify its cybersecurity posture. Reach out to explore our tailored services designed for excellence in federal cybersecurity compliance. Let's safeguard our national security together! #CyberDefense #Cybersecurity #FederalAgencies #M2131 #MADSecurity

3

Healthcare industry groups are urging the federal government to streamline and loosen a recent proposed rule outlining #cybersecurity incident reporting requirements for entities considered to be critical infrastructure. Published in early April, the Cybersecurity and Infrastructure Security Agency’s proposed rule aims to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). The proposal’s enhanced and speedier reporting requirements aim to help the government “better understand the threats we face, spot adversary campaigns earlier, and take more coordinated action with our public and private sector partners in response to cyber threats,” CISA Director Jen Easterly said in a statement upon the proposed rule’s unveiling. CISA also noted that the changes would be timely for the #healthcare sector, which “routinely” faces cyber incidents. The agency specifies that its proposed rule would cover hospitals with 100 or more beds, critical access hospitals, the manufacturers of certain “essential” medicines, moderate-to-high-risk medical device makers and a broad swath of IT entities. International Association for Healthcare Security and Safety (IAHSS) ASIS International Stefanie Drysdale Adam Lee, MBA, M.S., CEM®

3

The SEC has released a new draft Cybersecurity Disclosure (CYD) XBRL Taxonomy for public comment. This taxonomy contains the elements necessary to tag cybersecurity disclosures as required by the Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure final rule. Read more: #sec #xbrl #cybersecurity https://lnkd.in/epktZRsg

2