Anne-Marie Eklund Löwinder

Important development in the field of cyber security regulation ahead❗ The Finnish NIS2 implementation proposal is just out. Main features include: 🏭 Definition of critical sector actors 📢 New incident reporting and risk-management obligations ⚖ Emphasis of legal aspects in the cyber security work 🖋 Need for top management and board room attention 📒 Need to update processes and ensure sufficient documentation 🛃 New tasks for authorities, incl. Traficom 💰 Risk of significant sanctions (up to MEUR 10 or 2% of annual turnover) 🔗 Understanding of roles in supply chains 📜 Preparation for changes in contracts The aim is to have the new national Cybersecurity Act in force on 18 October 2024. Check out our insights prepared together with Johanna Tuohino and Roope Liuha in our Dittmar & Indrenius Alert. #NIS2 #Cybersecurity #ThinkingAhead https://lnkd.in/gtangqJm

34

Day 2 of the Police Strategy Forum kicks off with an opening keynote presentation from Antero Rytkölä, Deputy Chief of Police for Poliisi - Polisen - Police of Finland as he discusses ways to combat cyber assisted crime. Cyber-assisted crime can have devastating financial impacts for its victims, and organised crime is increasingly adopting this method as a means of perpetration. Antero discusses the establishment of a national agency in Finland dedicated to combatting cyber-assisted crime. He explores the crucial role of cyber security measures, digital forensics, and collaboration, to target perpetrators and reduce crime. #PoliceSF #Cybercrime #CyberSecurity

52

At Alliance Pro we assure you that the transition to the updated ISO 27001:2022 standard can be a smooth and manageable process. Here are 8 key points that our experts have for consideration: - Focus on Improvements, Not Overhaul: The core information security management system (ISMS) framework remains unchanged. You'll leverage your existing ISMS foundation. - Streamlined Controls: The new Annex A with updated controls offers a clearer and more focused approach to #risk management. - Enhanced Clarity: Minor wording and structural changes improve the readability and understanding of the standard's requirements. - Modernized Approach: New controls address evolving cyber threats and security challenges, ensuring your ISMS stays relevant. - Flexibility and Customization: The standard allows for tailoring controls to your specific needs and industry context. - Potential Cost Savings: Streamlined controls and a focus on existing #ISMS can lead to efficient implementation and reduced costs. - Competitive Advantage: Demonstrating compliance with the latest #ISO27001 standard enhances your organization's reputation for security. - Expert Guidance Available: Alliance Pro can partner with you throughout the #transition, providing expert guidance and support. Ready to take the next step? At Alliance Pro, we understand the complexities of information security management. Our team of experienced ISO 27001 auditors can help you navigate the transition to the 2022 standard with ease. Contact us today for a free consultation and discuss how we can streamline your journey to achieving robust information security. We are confident that together, we can ensure your organization's continued success and #compliance in the ever-evolving cybersecurity landscape. Subhash Kushal Cheruvu Bharath Hemanth Sairam Subha RAVI Shivaraj Bhagyalaxmi Rohini Nisha S Naresh

27

1 kommentar

Is your organisation ready for NIS 2? In our White paper "The NIS-directive - increased information security for services important to society" you can learn more about what the NIS Directive means in practical terms, what the difference between NIS and GDPR is, how to adapt to the new directive NIS 2 and much more. Download the White Paper here: https://lnkd.in/d7XGnw2s #advenica #cybersecurity #NIS2

8

In early June 2024, the CFCS raised the threat level for destructive cyber attacks from LOW to MEDIUM. The decision to raise the threat level was based on Russia’s increased willingness to use hybrid tactics, including destructive cyber attacks, against European NATO member states, emphasizing the fact that an unstable global security situation also expands into the cyber domain. The threat landscape is constantly evolving. New threat actors emerge while others disappear, and hackers continue to develop new approaches of attack. Join us at the Industrial Security Conference to learn more about the evolving cyber threat landscape and what it means for your organization! Read more about the assessment here: https://lnkd.in/eC__p8Jp #ISCCPH #industrialsecurity

10

Vintage OSINT tool : How it started - How its going https://lnkd.in/eFEdSdtU

19

12 kommentarer

What a twist! The EU Commission initiated infringement procedures against Denmark and other member states, for missing the deadline to implement the NIS2 and CER directives by October 17, 2024. A formal notice has been sent, and the states have two months to respond and comply. If they fail to do so, the Commission may issue a reasoned opinion, potentially leading to further action. How far along are you with the implementation? It's time to speed things up... Thanks Kasia Torian GDPR NIS2 DORA AI CIPP/E for a heads up on this development #dreamteam #cyberrisk #nis2 #cer #cybersecurity #compliance #eucommission #ifcrdk Let's talk Institut for Cyber Risk

7

"CISA, the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) said Volt Typhoon has had access throughout US infrastructure for the past five years. The FBI Director described Volt Typhoon as 'the defining threat of our generation.' And it will inspire others to take what's worked and the original threat to continue to evolve their tradecraft, highlighting again why it's so important to drive your organization with realistic threat emulation (like our release) that will catch these future threats." -Bryson Bort, Founder & CEO, SCYTHE Understanding and predicting an adversary's moves is critical to defense strategies in the cybersecurity landscape. As Lead Adversary Emulation Engineer Trey Bilbrey explains in our latest blog, amid this backdrop, two entities stand out for their forward-thinking and innovative approaches: Volt Typhoon and SCYTHE. #volttyphoon #cyberattack #cyber #threatintel Cybersecurity and Infrastructure Security Agency

7

Norwegian DFØ Report 2024:9 - Governance Structure for AI Regulation The Norwegian Agency for Public and Financial Management (DFØ) was tasked in 2024 with investigating and recommending a new national governance structure for enforcing AI regulations, in collaboration with the Norwegian Digitalisation Agency (Digdir). This report outlines their findings and recommendations for establishing an effective oversight framework for artificial intelligence in Norway. Signatu is developing software to automatise EU AI Act compliance documentation.

1

📢 The NIS2 Directive is Now in Effect. Is Your Board Prepared? 🚨   Last week, the NIS2 directive officially took effect, marking a major shift in cybersecurity and risk management for EU-based organizations. This new directive places more responsibility on boards to manage cyber risks proactively and to demonstrate compliance with enhanced care and reporting standards.    In Dr Yuri Bobbert's latest article, he covers the top three actions boards must consider to ensure compliance and protect their organizations, including: 1. Establishing clear ownership for cybersecurity oversight, 2. Focusing compliance efforts on critical systems, and  3. Leveraging existing resources to avoid unnecessary consulting costs.   Find out how #NIS2 can serve as a competitive advantage and what your organization needs to do to stay ahead.   Click down below to read the full article! https://lnkd.in/ewPc3EH5 #regulation #ITregulations #cybersecurity #digitalassurance #compliance

9

Pondering next winter's research plan. It would appear the EU whistleblowing directive implementations will have a significant play in conjuction with the NIS2 directive implementations. Another question is, can you bet your butt you can blow the whistle without repercussions: the whistleblower directive implementation may legally protect the whistleblower from harm, but the requirements there--even if read in parallel with the GDPR--leave out the question of adequate technical controls. Per the requirements, that's not really a simple one. Anyone remember anon.penet.fi remailer from the 1990s?

2

2 kommentarer

Heard about #HUDERIA? First comes AI legislation then comes the risk impact assessment guidance. 1️⃣ Key take away for me - when we think traditionally about risks of making changes 🤔 we think about how risks can be mitigated, or changes can be ‘rolled back’ if they go wrong. With Generative AI we have to 💭 think more about ‘the reversibility of potential adverse impacts’: 🚫 Not how can you roll back the change, but ❓ How can you repair or restore the adverse impacts of changes to affected persons, to a pre-change state or equivant… …That should be nice and easy, right?

11

I'm very proud to have supported the audits into Grindr that have dragged through the EU court system for years, and which have now concluded with Grindr being forced to pay €5.65 million for their privacy violations. The 2020 report is @ https://lnkd.in/eHPv5SP What most folks don't know is that I also briefly supported an internal audit at Grindr, after a Catholic group was found to have purchased bulk data (https://lnkd.in/gZS8CErE) about users of the Grindr app and used it to dox and out the top administrator of the US Conference of Catholic Bishops. The Catholic group purchased data *after* Grindr had been sold by a Chinese-owned consortium in 2019 due to a ruling by the Committee on Foreign Investment in the United States (CFIUS). So has Grindr fixed all these privacy problems? No. Absolutely not. In-fact, things are worse now than they were when we conducted the GDPR audit. If you view the current Grindr app-ads.txt file (grindr.com/app-ads.txt) you will see a massive pool of partners who ingest data from every user of the app. The data *still* is going to China via Yeahmobi and a few other vendors like Opera, and there are more unknown vendors getting user data from Grindr than ever before. The new post-SPAC Grindr has unknown privacy standards, but they are ignoring the 'lessons learned' from this now-successful GDPR complaint. It's almost guaranteed that some vendors are openly still selling Grindr user data, or trading it for murky purposes. If you want to know whether an app cares about your privacy, view their app-ads.txt, and count the number of unique ad tech vendors who are getting details about the users of that app. Each of these vendors will get enough information to track most users, and some openly share the data to be sold through data brokers. If you feel the need to use Grindr, please use a VPN at all times when using the app. And if the app requests permission to track you, please reject that prompt. Those two things will get you closer to being private, but the only true solution is Grindr starting to care about user privacy more than it cares about revenue from low quality ad partners.

10

The NIS 2 knowledge gap is real. Research reveals ‘knowledge gap’ in NIS2 Directive compliance https://bit.ly/3CBwVGY

1

The European Commission has initiated infringement procedures against over 20 EU member states for failing to transpose the NIS2 Directive into national law by the October 17, 2024, deadline. The Commission's actions underscore the importance of timely implementation of cybersecurity measures to protect critical infrastructure across the EU. Member states that have not transposed the directive may face legal action, which could lead to fines or other penalties. Delayed implementation leaves critical infrastructure sectors more vulnerable to cyber threats, potentially compromising the EU's collective security. Advice for Affected Member States: 1. Accelerate Legislative Processes: Prioritize the adoption of national laws aligning with NIS2 requirements to mitigate legal and security risks. 2. Enhance Coordination: Engage with the European Commission and other member states to share best practices and ensure cohesive cybersecurity strategies. 3. Invest in Cybersecurity Infrastructure: Allocate resources to strengthen national cybersecurity frameworks, ensuring compliance with NIS2 and bolstering defenses against cyber threats. #Cybersecurity #NIS2Directive #EuropeanCommission #CriticalInfrastructure #EUCompliance #InfringementProcedures

1

The Swedish case underscores a critical shift in cyber warfare tactics. State-sponsored actors like Iran are increasingly using cyber tools to inflame domestic political and social tensions in other countries. By targeting Sweden's SMS infrastructure and leveraging a politically sensitive issue --Islamophobia --these hackers aimed to deepen divisions and damage the country's international reputation. This approach represents a broader strategy seen in numerous instances globally, where cyberattacks are designed to polarize societies and destabilize political systems rather than cause immediate, tangible damage to infrastructure. For governments and large corporations, the message is clear: the line between cybercrime and geopolitics is becoming increasingly blurred. There is a growing use of digital platforms for political manipulation and social engineering. This requires adopting more comprehensive strategies that involve close monitoring of sociopolitical dynamics and how external actors may seek to exploit them through cyberspace. Collaboration across borders, sharing of intelligence, and proactive cyber defense mechanisms are essential to counteract these emerging threats. For Deep Dive and Scenarios Generation contact us at: https://lnkd.in/d8qwMdEZ Web Link Sweden: National Security Strategy: https://lnkd.in/dCgWyraQ #CyberWarfare #Geopolitics #NationalSecurity #CyberThreats #StrategicIntelligence #CyberDefense #InformationWarfare #CybersecurityStrategy #DigitalInfluence #PublicPerception #PoliticalRisk #ThreatIntelligence #GlobalSecurity #CorporateRisk #DigitalTransformation #Disinformation #ResilientSocieties #CyberResilience #GovernmentAffairs #IranCyberThreat #StrategicCommunications #EmergingThreats

2