Montae Brockett

It's official! The Maryland Online Data Privacy Act has passed and become law. Here are some questions that Maryland businesses should be able to answer to be compliant with MODPA. If you're not quite sure where to start, or if you already have data privacy policies and procedures in place and need a third-party assessment, let me know, and we can schedule a quick call to discuss your needs. ·        Data Inventory and Processing Activities o  What personal data does your business collect, and for what purposes? o  How do you document and manage data processing activities? o  Can you provide a map or inventory of where consumer data is stored and how it flows through your organization? ·        Consumer Rights and Requests o  What mechanisms allow consumers to access, correct, delete, or transfer personal data? o  How does your business handle consumer requests to opt out of data processing, such as for targeted advertising or the sale of their personal data? o  What is the average response time to consumer data requests, and how do you ensure compliance with legal timeframes? ·        Privacy Notices and Policies o  How do you inform consumers about collecting, using, and sharing data? o  Is your privacy policy aligned with current data protection laws and accessible to consumers? o  How often do you review and update your privacy notices or policies? ·        Data Security Measures o  What administrative, technical, and physical security measures are in place to protect personal data? o  How do you assess the effectiveness of these security measures? o  Have there been any data breaches in the past two years, and how were they managed? ·        Third-party Management and Contracts o  Do you share consumer data with third parties, and if so, for what purposes? o  What criteria do you use to evaluate third-party service providers regarding data protection? o  How do you ensure data processors and third parties comply with privacy obligations? ·        Training and Awareness o  What type of data protection training do employees receive? o  How frequently is data privacy and security training provided to staff? o  Are designated personnel such as a Data Protection Officer responsible for data protection compliance? ·        Legal Compliance and Data Protection Impact Assessments o  Have you conducted data protection impact assessments for processing activities that pose a high risk to consumer privacy? o  How do you ensure ongoing compliance with data privacy laws and regulations, including sector-specific requirements? o  Are there processes to handle changes in data protection laws or the legal landscape? ·        Data Integrity and Minimization o  How do you ensure the accuracy of the personal data you collect and maintain? o  Do you have policies in place for data minimization and retention? How do you determine the lifespan of the data you collect? #MODPA #GDPR #DataPrivacy #HumanRights

10

⚠️ A cybersecurity advisory was issued recently regarding a vulnerability in Apache OFBiz®. The vulnerability could allow an attacker to execute remote code, potentially leading to a breach. Dox offers more details about the vulnerability and updates to prevent a breach at https://lnkd.in/eK4gWJvr. #Apache #OFBiz #Vulnerability #DoxElectronics #CybersecurityProfessionals

1

🤔Suggestions on Security🤔 ICYMI: CISA conducted its second quarter 2024 Cybersecurity Advisory Committee (CSAC) meeting at West Point, NY, where members discussed and voted on strategies to enhance CISA’s Joint Cyber Defense Collaborative. 🤝 The meeting centered on improving CISA's cyber operational collaboration platform, with the JCDC focusing on refining cyber defense collaborations between the government and the private sector. CISA Director Jen Easterly expressed optimism about the new recommendations, which aim to extend CISA's cyber defense capabilities and align with the agency's ongoing mission and priorities. During the session, several subcommittees presented updates on various cybersecurity initiatives, including: 1️⃣ Strategies to advance public communications, 2️⃣ Bolstering critical infrastructure resilience 3️⃣ Promoting open-source software security 4️⃣ Ensuring the affordability and accessibility of secure-by-design best practices The meeting also referenced past committee recommendations, noting that CISA has accepted nearly all suggestions from previous meetings in 2023. Looking ahead, the CSAC plans to continue its advisory role with another meeting scheduled virtually in September, sustaining its commitment to enhance national cybersecurity measures. 👇 Click the link below to read more about the meeting as well as a full list of the recommendations and implementations from previous sessions. 🗣️ Share your thoughts in the comments about the 4 objectives discussed this month and what actionable steps can be taken to achieve them! #CISA #CSAC #CybersecurityAdvisoryCommittee #JCDC #JointCyberDefenseCollaborative #nationalsecurity #cybersecurity #collaboration https://buff.ly/4bU9J3L

2

Chairmen, Chairwomen, Directors on Boards and CEO's should all watch this United Health CEO's testimony from 5/1/24 on their Cybersecurity Incident. Ask: Do you have any certified CISSP or CISO qualified Board Members at the table, asking the hard questions and understanding the gaps? I would bet CEO Andrew Witty's board will change drastically with $22M ransom paid out of pocket and $872M in other costs and fees (plus inbound HIPAA fines). https://lnkd.in/gXsPtPxm

3

1 Comment

Join our first episode one week today 📆 Are you looking for guidance to roll out a threat modeling program? Hear from two seasoned experts, John Taylor, CSSLP, CISSP, SAFe®SPC and 😷 Adam Shostack, about how to positively set the scene for your initiative… https://hubs.li/Q02Fc_6n0 #threatmodelingseries #threatmodeling #securebydesign

9

1 Comment

An effective #cybersecurity strategy requires many moving parts, skills and stakeholders to come together to deliver it. Grant Hughes, CISSP, CCSP shares his guidance for defining a strategy based on his first-had experience: https://ow.ly/OEFc50SwooT

6

💼 Average CISSP Salary in 2024 (All locations) CISSP is renowned for its rigor and the substantial impact it can have on your career trajectory and salary. As one of the most prestigious certifications in cyber security, it opens doors to technical and managerial roles across the industry. Our latest article provides a detailed breakdown of average salaries for various job titles commonly held by CISSP-certified professionals in 2024. Whether you're aspiring to be a Security Analyst, CISO, or any role in between, we've compiled the data you need to see the potential returns on your certification investment. Explore what salaries await CISSP holders and how this certification can elevate your career: https://lnkd.in/eMY54fvT

5

State, County, and Local Governments in Florida, are you aware of the mandatory cybersecurity awareness training and cybersecurity for executives and managers? The Arruda Group is here to help you check this off your to-do list with a compliance logo for your website. Contact us today at (813) 382-0859 or training@arrudagroup.com to schedule your training and get your compliance logo. Let us help you focus on your job as a network fire fighter. #Florida #CybersecurityAwareness #ComplianceLogo #cybersecuritytraining

4

Just in - CISA publishes Encrypted DNS Implementation Guidance for Federal Agencies to enhance cybersecurity and protect sensitive data. Stay ahead of the curve with this important resource: https://lnkd.in/eMeN-uxt #cybersecurity #CISA #encryptedDNS

2

The rate of these sorts of events is going to accelerate drastically over the next 12-24 months as AI powered tools take hold. A lot of people don’t understand that OpenAI isn’t the AI game. Anyone with basic skills can run over to Hugging Face and get a model up and running on their own hardware in an hour without limits and go cranking on antiquated government systems. Lets be honest, even the more modern options don’t take security seriously. Government really needs to focus and big companies don’t actually do it better. Most breaches, like Ticketmaster, involve massive enterprises. https://huggingface.co

1

I was surprised to receive this in the mail! A token of celebration for my nearly year-long journey to becoming an iPEC Coaching Certified Professional Coach. Thank you 🏳️‍🌈 Maril Vernon, CEH, MSCSIA for the thoughtful gift 💜 If you’re a woman in cybersecurity interested in experiencing the power of quality coaching, join me inside the Hacker in Heels community. Group coaching is included in the monthly membership. 1:1 coaching is available at an additional cost only to Hacker in Heels Insiders—and you have to apply. Why? Because I strongly believe we have plenty of resources as part of Insiders that can help women in cybersecurity with many of the common challenges they seek career coaching for. To send people straight towards my highest-ticket offer when I know they can benefit from what I’ve already created at a lower price-point would be out of integrity for me. Trust me, I’d love to sign some 1:1 coaching clients and get quickly on my way to earning back my investment. But I will not prioritize my wallet when I know you don’t need or aren’t ready for 1:1 coaching. So come dip your toes in Insiders! I’d love to help you with your big, bold cybersecurity career goals. #womenincybersecurity #cybersecurity #careercoaching

73

14 Comments

NIST NCCoE events are great forums bringing together industry, government, and academia to help protect critical infrastructure. It's great to see Faction taking the lead in decentralized private networking technology to conceal critical sensors, cameras, and other connected devices from adversaries!

1

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and HHS warned in a joint cybersecurity advisory (CSA) that healthcare organizations should harden their systems to protect against Black Basta ransomware. Black Basta threat actors use tried-and-true techniques such as spear phishing and exploiting known vulnerabilities to gain initial access. These actors have been observed exploiting a ConnectWise ScreenConnect vulnerability involving authentication bypass (CVE-2024-1709)

24

1 Comment

Come see Shoshana Sugerman and Brian Robert Callahan, Ph.D., CISSP, CISM #today at 3:30 PM at the #nyscyber NYSCSC! They're the talk all the way in the bottom right corner! Rensselaer Polytechnic Institute #cybersecurity #cybersec #infosec #informationsecurity #security #conference #generativeai #ai #genai #artificialintelligence #RPI #RPI200

14

Analyzing Phishing Email Headers: Protect Yourself from Online Scams Discover how to analyze phishing email headers in this informative video. Learn how to identify urgent or alarming language, generic greetings, suspicious links, and more. Stay safe from online scams and protect your personal information. #OnlineSafety #PhishingScams #EmailSecurity #CyberSecurity #ProtectYourself #StaySafeOnline #PhishingAwareness #OnlineScamPrevention #EmailFraud #InternetSafety

8