Dr. Shri Kulkarni (Ph.D. - Cybersecurity)

looking forward next week and this panel discussion on mental health. see you all there!

28

1 Comment

🚨 Security Lessons from the Canada Revenue Agency Tax Fraud Incident 🚨 The Canada Revenue Agency (CRA) recently faced a massive fraud scheme, with hackers exploiting H&R Block credentials to siphon over $6 million via fraudulent tax returns. This incident highlights the importance of robust security measures for taxpayer data. 🔑 Key Takeaways: 1. Multi-layered Identity Verification: CRA’s “pay now, verify later” approach exposes vulnerabilities. Implementing stronger, preemptive verification steps can help reduce fraudulent claims. 2. Enhanced Coordination with Banks: Sharing real-time information about flagged accounts with financial institutions can help prevent unauthorized transfers. 3. Public Transparency: Disclosing breaches promptly builds trust and enables individuals to take protective actions, such as monitoring for fraud. Strengthening data protection for taxpayer accounts is essential to prevent financial fraud. #Cybersecurity #DataProtection #TaxFraud #CanadaRevenueAgency #FinancialSecurity https://lnkd.in/e4jeNrWR

1

Cipp/с : new OPC investigation Privacy Commissioner Investigates CRA Data Breach Impacting 30,000 Individuals Privacy Commissioner Philippe Dufresne has launched an investigation into the Canada Revenue Agency (CRA) following a cyberattack that compromised personal data of over 30,000 individuals since 2020. This inquiry will assess whether the CRA upheld its obligations under Canada’s Privacy Act for federal institutions. 🔍 Previous breaches in sectors handling sensitive financial and personal data—like the Desjardins and Capital One cases—highlighted critical weaknesses in cybersecurity and vendor management. Both companies faced extensive scrutiny for failing to implement sufficient security measures. Unlike private companies, however, federal bodies like the CRA operate under additional Treasury Board directives for breach reporting and public accountability, adding layers of oversight. In this case, the CRA’s response will be pivotal, setting a standard for other government agencies managing vast amounts of sensitive information. This investigation signals that even federal institutions must maintain robust data protections comparable to private-sector standards. Those potentially impacted should check their CRA accounts for unusual activity, update passwords, and contact the CRA if they have concerns. With cyber threats targeting both public and private sectors, strong data protection and transparent incident response are more essential than ever. This month, I’m thrilled to offer something my courses have never had before: exclusive live online sessions! 🎉 For each course, you’ll receive **one free live masterclass** designed to help you excel. How can you join? Simply enroll today, and you’ll get access to the live session happening on the last weekend of the month. This gives you the perfect opportunity to absorb the lectures, prepare your questions, and engage directly with me during the session. Don’t miss out on this chance to enhance your learning experience! Sign up now and get ready to elevate your skills! 🚀✨ 1. CIPP/e Author prep with discount : https://lnkd.in/evueyaiQ or CODE: C2AE544B225EBF67E838 2. For Cipp/A (Asia) Author Prep with % : https://lnkd.in/e8QrXEzJ CODE: D9EB64EDB73648410004 3. For CIPP/US Author Prep with %: https://lnkd.in/eKckPbDG CODE: 6CCABC5D3F99C4C7C031 4. For CIPP/C (canada)Author Prep with %: https://lnkd.in/eV9Cv2Sw or CODE: B7956F5D686390F6CFE2 5. AIGP Prep Course": https://lnkd.in/eVVsRxW6 or CODE: E6D173C0B4512059B5D5 #DataPrivacy #Canada #CRABreach #OPC #cybersecurity #cippe #cippc #cippa #cippus #aigp

3

Important Update: Introduction of the Health Infrastructure Security and Accountability Act (HISAA) In the wake of recent cyber incidents like the Change Healthcare attack, a new bill has been introduced—the Health Infrastructure Security and Accountability Act (HISAA). Key Highlights of HISAA: - Mandatory Minimum Cybersecurity Standards: Modernizes HIPAA security requirements by enforcing mandatory cybersecurity standards for healthcare providers, health plans, clearinghouses, and business associates. - Enhanced Standards for Critical Entities: Applies stricter cybersecurity measures to systemically important entities and those vital to national security. These would be created by the Department of Health and Human Services (HHS) instead of Congress. - Annual Independent Cybersecurity Audits: Requires covered entities and business associates to undergo yearly independent cybersecurity audits and stress tests to ensure prompt service restoration after incidents. The HHS may waive this for small providers. - Proactive HHS Audits: Mandates HHS to proactively audit the data security practices of at least 20 regulated entities annually, focusing on providers of systemic importance. - Increased Corporate Accountability: Requires top executives to certify compliance with cybersecurity requirements annually. Similar to Sarbanes-Oxley, submitting false information becomes a felony. - Elimination of Fining Caps: Removes statutory caps on HHS's fining authority, ensuring that large corporations face substantial fines that deter inadequate cybersecurity practices. - Support Through User Fees: Funds HHS's security oversight and enforcement via a user fee imposed on all regulated entities. - Financial Support for Hospitals: Allocates $800 million for rural and urban safety net hospitals and $500 million for all hospitals to adopt enhanced cybersecurity standards. - Medicare Payment Authority: Codifies the Secretary's authority to provide advanced and accelerated Medicare payments during cybersecurity disruptions, as was necessary during the Change Healthcare incident. It's interesting to see where the regulations are leaning, and it will be interesting to see how far this makes it through a divided Congress. Let me know your thoughts about this. Do you think some of these points are good for the healthcare industry? #HealthcareCybersecurity #HISAA #CybersecurityLegislation #DataProtection #HealthcareSecurity #CyberCompliance #CyberRiskManagement #HealthIT #SecurityStandards

13

7 Comments

Canadian Centre for Cyber Security releases National Cyber Threat Assessment 2025-2026 https://lnkd.in/e2gtvQjq 🔸Cybercrime has increased in scope, complexity and frequency 🔸Number of ransomware incidents rose 74% in 2023 🔸Ransom payments reached a record of $1 billion USD 🔸Average ransom paid in Canada in 2023 was $1.130 million CAD The ransomware economy is on track to grow in 2025 and 2026 #CyberSecurity #CyberResilience

7

2 Comments

Are you getting heartburn and sleepless nights just thinking of the recent technology vendors' incidents and breaches? You're not alone. But there is a light at the end of that particular tunnel. A third-party risk management program could go a long way toward managing those risks to a more comfortable level and give you the peace of mind you need. Join us in this discussion - register at the link below. See you there!

9

Enhanced Visibility & Hardening Guidance for Communications Infrastructure CISA has released actionable guidance to help organizations bolster the security and resilience of critical communications infrastructure. * Enhanced Network Visibility: Tools and strategies to monitor and detect potential vulnerabilities. * Hardening Measures: Practical steps to fortify systems against evolving threats. * Proactive Defense: Best practices for mitigating risks to critical infrastructure. Secure your communications systems today and stay ahead of potential threats. Explore the full guidance here: https://lnkd.in/gADKtUPf #Cybersecurity #InfrastructureSecurity #CISA #Resilience

24

Security awareness and training is still being under-supported and even misunderstood in so many organizations across multiple sectors for reasons ranging from inconvenience, not a priority, lack of funding, or it's just an annual check box. The fact is each and every member of an organization is a target for threat actors when they come looking for an opportunity to breach their next network victim. The cybersecurity posture and strength of your organization is only as good as your weakest link. And the weakest link in the cybersecurity chain is typically the human with an email address on your domain. All the best of breed technology in the world will NOT prevent this type of attack. At ISA Cybersecurity, we offer our Security Awareness service to help your staff recognize how malicious actors target them and provide tools and knowledge to take appropriate action when attacked. Our cloud-based, multilingual, turnkey program employs training tools to measurably increase your team’s recognition of phishing, spear-phishing, malware, and social engineering-based attacks. Contact us today for more information and help reduce your cyber risk. https://lnkd.in/gKPn5sGq

19

Fellow #CISSP holders, I need you to weigh in. I was recently having a discussion with a colleague where the conversation led to an important consideration. Having a CISSP comes with a hefty burden of upholding a code of ethics that can, in nearly every case, risk a cert holders livelihood. Given that ISC² has no jurisdiction or ability to offer protections for CISSP holders who uphold these ethical standards, how do you navigate scenarios where you witness unethical, illegal, or risky behaviors that could put an enterprise and the public at risk? There are some serious considerations I think every #CyberSecurity #Practioner needs to consider before they align to ANY certification body. 1. Ethical Dilemma: CISSP's are expected to uphold high ethical standards, including reporting security issues, but may face personal consequences for doing so. 2. Enforcement Limitations: ISC²'s ability to enforce ethics is largely limited to the certification itself, not extending to workplace protections. 3. Credibility Issue: This situation could potentially undermine the integrity of the certification if holders feel they can't act on their ethical obligations without risking their livelihoods. 4. Practical Challenges: Providing actionable protections across various global jurisdictions and employment situations is extremely complex. So, with that being said, how do you navigate the conflicts of interest that exist with these certifications? Let me know in the comments. I want to hear your thoughts! #CleverGirl ♛ Gina King ♛ Derrick Knox, Jr. WellSecured IT The Ovation Point LLC Diverse IT ISC2

21

33 Comments

The Canadian Centre for Cyber Security (Cyber Centre) has released its National Cyber Threat Assessment 2025-2026 (NCTA 2025-2026). As with previous assessments, it provides a snapshot of cyber threats affecting Canada and Canadians and forecasts how they may evolve in the coming years. The Cyber Centre’s flagship report helps build Canada’s resilience to cyber threats. The People’s Republic of China’s (PRC) expansive and aggressive cyber program presents the most sophisticated and active state cyber threat to Canada today. The PRC cyber program’s scale, trade craft, and ambitions in cyberspace are second to none. Russia’s cyber program furthers Moscow’s ambitions to confront and destabilise Canada and its allies. Iran uses its cyber program to coerce, harass, and repress its opponents, while managing escalation risks. Ransomware is the top cyber crime threat facing Canada’s critical infrastructure.

2

Some great points raised here by Rosalyn Page & Mary Carmichael CPA CMA, CISM, CISA, CRISC, ICD.D. With a wide variance in the definition of "risk", security leaders need to adopt an approach that is fluent in the language of business. Security metrics provided by capabilities such as asset, vulnerability, and threat management are foundational, but they’re incomplete when not evaluated against the potential likelihood and business impact a threat actor could achieve.

11

1 Comment

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3