.Kevin Pike, LLM, CISSP, FIP

New Cyber Daily Report Blog Post!   Title: Securing Modern Digitized Supply Chains Author: Windhya Rankothge, Research Associate at the Canadian Institute for Cybersecurity Link: https://lnkd.in/gNB5SU5P   @cyber_reports #SupplyChainSecurity #CyberSecurity #DigitalSupplyChain #CyberThreats #DataProtection #SupplyChainManagement #ENISA #CyberResilience #SecureSupplyChains

23

1 Comment

This is a helpful guide from the Government of Canada for helping to protect yourself and business from Ransomware and malware attacks. I think they forgot something. They forgot to tell you that if you have a Windows machine you can recover with the click of the revert button on a proactive button that says "revert" when you get attacked. The program is NeuShield. We can help everyone with a Windows machine. https://lnkd.in/gs9v2cPP

3

I recently received a copy of Packt Publishing’s Unveiling the NIST Risk Management Framework: A practical guide to implementing RMF and managing risks in your organization by Thomas M. This guide breaks down using and implementing a risk management framework within your organization. Understanding the risks at the organizational and technical level are the first steps in managing and monitoring the vulnerabilities and threats of your organization. This book breaks down the NIST RMF in a manner that allows you to go step by step through the process. These steps allow you to build a risk aware organization from top to bottom.  NIST makes documents available at no charge, including the NIST SP 800-37 v2, which this book is based. The book breaks down this document and is an excellent accompanying guide to the document. Chapter 9 and 10 are particularly helpful with guidance for the RMF for cloud implementation and use case scenarios, respectively. For anyone that wants to understand how to implement a risk management framework within your organization, I highly recommend this book. Pick up your copy here: https://packt.link/689vW Kamalpreet Sahni

17

1 Comment

How to prepare for Cipp/c without expensive official trainings? There is a lot of information online about CIPP/E and AIGP certifications. As I've mentioned before, AIGP seems to be more of a trend for many people. I genuinely believe that gaining a deeper understanding of different jurisdictions is much more beneficial for your work. So, how can you prepare for Canada without investing in costly IAAP official courses? :) 1. Yes, obviously we start with getting the body of knowledge for exam. This document helps you to see what exactly you need to know and which documents to analysis. 2.several topics such as “Canadian government structure”, legal framework can be found in law books or articles at official websites. 3.For block privacy basics you can use any book on privacy or privacy management. Focus on various privacy principles : OECD, GAPP,CSA. 4.For privacy commissioner it is great to open the official website of OPC or provincial commissioners. There you can read and understand their basics, functions and role, their obligations under Privacy Act and PIPEDA or substantially similar to them provincial acts. Also there you can read and find the actual texts of the OPC findings which are in the text (Eastmond, Bell Rap, Blood tribe and etc. ) 5.For privacy in government collection you have to read the actual acts. I mean the Privacy Act, here foucus in the scope, exceptions to it and “opinions about individuals”. Don’t forget to read the similar provincial laws.  6.PIPEDA. Read the actual act. Don’t rely on the bad articles in net. You have to know the scope, obligations, out of scope and etc. don’t forget to compare and analyze the substantially similar provincial legislation. It’s very important to pay attention to differences in Alberta, British Columbia and Quebec. Quebec is the most interesting:)  7.Medical sector. I would recommend focusing on Ontario legislation.  8. Casl and AI. Anyway, I have prepared comprehensive course to cover all of it! A lot of students have already passed #cippc easily after it. Grab with september discount: https://lnkd.in/gBpmX9bk #cippc

16

2 Comments

So much work has gone into defining how we securely recognize and memorialize people in the network. Originally to the network pioneers something like the finger protocol was sufficient to send a profile of office hours and network availability. Then student coders who consumed Coca Cola that had a very long sloping hallway got tired of hiking to the machine and getting a warm Coke and IOT was born when they (and anyone on the Internet) could figure out the temperature status of the next available bottle. The Coke machine was located far away from where they programmed and consumed liquid fuel to access networked devices due to physical constraints. The urban legend is Carnegie planned to use the natural gravitational force to move machinery down the slope of the hill in the hallway if the whole educational endeavor failed to work out. How much was engineering a slope a universal factor? It’s not like this liquid was not universally and ubiquitously available anywhere in the world but this specific space was unique in design and engineered. We see this extended in a full fictional version in Thomas Pynchon’s Gravity’s Rainbow 🌈. There’s a link as to where Slothrop is having sex and the arc of the v2 rockets aimed at London that is far more colorful but the slope is same idea of incorporating feedback into a system that is delivering a service or payload. Addressing the needs of machines and the needs of people when machines began to exhibit intelligent cybernetic characteristics all happened in programming time and historical real time that were entirely anticipated from the Sci Fi “radio future” of 1919 onwards. Looking back at how that insight developed has been undertaken by Sean Manion because it is so fundamental to understand to how these concepts arose, and what anchored them to practical concepts. While the programming substrate was limited in 1898 to Tesla when he invented the “And” logic gate to remotely control an electric boat in Central Park, the concepts just kept being added to the available stack. Feedback and probability was engineered by Norbert Wiener to automate how to aim antiaircraft artillery at moving targets and the Norden bombsight was developed to do the other side of dropping ordinances on fixed targets. By the 1950’s time had been so compressed that simulations were being run in the response time of a nuclear missle launch flight time, roughly 15 minutes. Like Carnegie following the force of gravity to move machinery, or knowledge, we consider what it means to be dependent or independent of machinery and the precision and services they deliver remotely by inserting attributes in digital networks. Inserting the human and AUTH-N and AUTH-Z into remote systems and services is complex and subject to error. However standards exist to create assurance that what we expect something or someone to be is exactly that. These sometimes fail in spectacular ways and information plays an important role.

1

A lot of folks have been posting about the latest update/supplement to NIST SP800-63b, Digital Identity Guidelines, which came out in August. Much of the document is really providing more clarity around prior recommendations, particularly in the area of passwords (see section 3.1.1 in the link below) and their requirements, but there is also an interesting expansion on the use of "syncable authenticators," aka passkey, which apparently were not authorized for use under AAL2 (see Appendix B). https://lnkd.in/gmV8nxFy From the NIST blog post here: https://lnkd.in/g8s8FNyr "What is a syncable authenticator?  A syncable authenticator is any cryptographic authenticator that allows for the private key to be cloned and stored separate of the authenticator to support use of that key across different devices (for example, syncing). In practice, these are typically what are called ‘passkeys’ by the FIDO Alliance and make use of multiple standards and protocols such as the Client-to-Authenticator Protocol and World Wide Web Consortium’s (W3C) Web Authentication (WebAuthn). When implemented correctly, they provide a phishing-resistant authenticator with many benefits, such as simplified recovery, cross device support, and consumer friendly platform authentication support (for example, native biometrics). Such authenticators would have been considered non-compliant in the context of Digital Identity Guidelines, and the supplement provides additional requirements and considerations to allow for their use at Authentication Assurance Level 2 (AAL2). "

6

4 Comments

To my contract and compliance folks in ISO and SOC2, is this a valid contract requirement given that the RFP says you need certifications in programs that have no certifications, and no language exists to validate a compliant and audited program for any of these? 🙋 Solicitor question: "For the compliance certifications, are all 3 certifications SOC 2, ISO 27001 and ISO 9001) required?" 👉 Contract officer: "Only one of the certifications is needed." I already brought it up during one conference call, and I was immediately talked down to... 🫢 #iso #soc2 #qualitymanagement #compliance

1

2 Comments

Canadian Centre for Cyber Security releases National Cyber Threat Assessment 2025-2026 https://lnkd.in/e2gtvQjq 🔸Cybercrime has increased in scope, complexity and frequency 🔸Number of ransomware incidents rose 74% in 2023 🔸Ransom payments reached a record of $1 billion USD 🔸Average ransom paid in Canada in 2023 was $1.130 million CAD The ransomware economy is on track to grow in 2025 and 2026 #CyberSecurity #CyberResilience

7

2 Comments

Get to know the entire #digitaltrust ecosystem and how ISACA's new framework #DTEF incorporates detailed practices, activities, outputs, controls, KPIs and KRIs, providing a comprehensive toolkit for implementation and assessment. https://bit.ly/4afug0U

5

Toronto school board reports ransomware attack on test environment. Why it matters: 1. This ransomware attack on the Toronto District School Board's test environment signals another increasing risk in cybersecurity, with hackers now targeting school systems, besides traditional targets like companies and municipal institutions. 2. While no immediate impact has been seen on the TDSB's official systems, the attack highlights the critical importance of robust cybersecurity protocols, especially in separate testing environments, as they can also become targets of cyber attacks. 3. This incident underscores the need for continuous vigilance and cooperation with cybercrime agencies. Notifying authorities and experts, as seen with the TDSB, aids in managing the situation, identifying threats, and informing affected individuals in due time if their information was compromised. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/eNB7qfUg

1

Don't miss out on the 2024 PCI DSS 4.0 Training by ISACA Middle TN! Enhance your knowledge of data security standards on July 31st at 12:00 PM. Link in bio for more details and to get tickets. #ISACA #PCIDSS #Training #DataSecurity #MiddleTN

11

1 Comment

The Digital Trust Ecosystem Framework #DTEF is designed to support any organizational stakeholder who has an interest in establishing and maintaining #digitaltrust. Learn more about ISACA's new framework: https://bit.ly/3JI7xQa

6

An ad-hoc approach to cyber risk management is a bad look to investors and clients. A hastily conducted risk assessment here, and a boilerplate policy there will not pass muster with serious players. They’ll quickly move on and use your company as an example of the type of organization to avoid. Of course regulators won’t move on. They’ll dig in, and the pain can be significant and far reaching. It doesn’t have to be this way. There are frameworks to align practices with and proven strategies for progressively strengthening your security posture which can demonstrate to interested parties your commitment to information security. This can make all the difference in winning business or getting that infusion of funds from investors. It can also help get the regulators off your back. Sometimes the biggest struggle is just knowing how to get started. I can help you here. Reach out and let’s have a chat.

18

Interesting article that discusses a unique property of certain digital signature schemes that allows the public key to be reconstructed from just the signature and the original message. It is well-known that the widely-used ECDSA can recover the public key used to generate a signature with just one valid signature. Reason being, there is a mathematical relationship between the two integers that make up the ECDSA signature and the positions of the public key on the elliptic curve. It is not possible to deduce the public key from a single signature in lattice-based signature schemes such as Dilithium. But if there are more than two message-signature pairs, the public key can be solved using the signature components as a system of linear equations. This is due to the algebraic structure of lattice-based cryptography. Public key recovery attacks utilizing a small number of message-signature pairs are very effective against signature schemes that do not use randomness, such as the UOV scheme. Since there is no randomness in the signature, linear relationships between the public key and its components can be efficiently reconstructed. For systems that only use digital signatures for authentication, being able to get public keys from signatures raises privacy and anonymity concerns. It also shows how important it is to carefully look at cryptographic schemes for non-standard properties beyond common security ideas like not being able to be faked. While public keys are meant to be public, their recoverability from signatures can be an unintended capability with consequences for system design. https://lnkd.in/gMubVWCt #crytography #pqc

18

1 Comment

Many practice leaders, including us, have been taken aback by recent developments. I vividly recall my early introduction to PKI/CA through "Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption" by Wardwick Ford, an esteemed figure in the PKI/CA realm from reputable CA/PKI technology provider. Trust should never be underestimated; when best practices are disregarded, skepticism is warranted. Certification Authorities (CAs) play a pivotal role in the digital sphere, shaping digital trust. Their significance has magnified as digital trust and regulatory demands expand, and digital risks grow more pronounced. SSL/TLS encryption remains fundamental for web security. Equally crucial is emphasizing digital trust audited by a reliable framework like WebTrust for CAs. #PKI #CA #DigitalTrust #WebTrust #Cybersecurity

10