Carmen Waugh, CISSP, CISA

🚨 Hot Off the Press! 🚨 The DOJ and CISA have just released a Notice of Proposed Rulemaking (NPRM) and Proposed Security Requirements for Restricted Transactions, each implementing Executive Order 14117. These new rules aim to regulate the processing of certain personal data and will impact various sectors. 🔒 Key Highlights: 🗺 Data Restrictions: The proposed rules will limit the transfer of personal data—such as protected health information, financial data, government employee data, biometrics, and bulk data (over 100,000 individuals)—to specific countries. 🗺 Ownership Matters: Restrictions apply to entities more than 50% owned by citizens (both real and corporate) of these countries. It won't be enough to just avoid doing business in a given country. 💡 Why It Matters💡 If you’re building apps or solutions that process personal data for over 10,000 individuals or any government employees, brace yourself for mandatory technical controls and restrictions on outsourcing development and operations. Original Sources: https://lnkd.in/drJ3wgKq https://lnkd.in/dR-iVzzc Stay informed and prepared to adapt your strategies! #DataPrivacy #Cybersecurity #ExecutiveOrder #DOJ #CISA #Compliance #TechDevelopment

1

As the FFIEC Cybersecurity Assessment Tool (CAT) approaches its sunset, financial institutions must navigate the transition to alternative cybersecurity frameworks. This webinar will provide you with updates and guidance needed to ensure a smooth transition and maintain robust cybersecurity practices. Register ➡️ https://loom.ly/AR9KVOk

6

Ditch the audit mentality for PCI DSS assessments. If your assessor acts like an auditor, it's time to say goodbye 👋 Payment security evangelist Andrew Henwood reveals why a collaborative approach is better 👇 #pcidss #paymentsecurity #infosec

8

Episode 176 of CISO Stories featuring Michael C. Redmond, PhD, MBA, ISO Cyber Certifications, Deputy CISO of Louisville Metro Government Available now! Hosted by Todd Fitzgerald, Best-Selling Author of CISO Compass and VP, Cybersecurity Strategy, CyberRisk Alliance Data Governance is a key component in protecting the data from different points of view including information security confidentiality, integrity, and availability. There are several standards that have control requirements for Data Governance relating to PCI, HIPAA, and PII, data security and more. Two of the Internal Standards having Data Governance requirements are: GDPR, ISO/IEC 27001:2022 The internal policies pertaining to gathering data, processing data, storing date, and disposal of data storing data, and disposal of data are a concern of information security. These polices also affect but also asset management, It governs who can access what kinds of data and what kinds of data are under governance. https://lnkd.in/gBS9UVdJ #ciso #collaboration #grc #datagovernance

7

Please join #SilverSky in a webinar sponsored by CUNA Strategic Services as Tom Neclerio, SilverSky’s CISO, reviews the benefits of using Continuous Validation Testing to improve your Credit Union’s cybersecurity posture. Tom will cover how this improved testing works and how it better protects against new and known vulnerabilities and they key fact that we want to find them as early as possible. https://lnkd.in/evrgXCwQ #CyberSecurity #CreditUnions

4

If you're struggling with compliance and security challenges, CCM might me the game-changer you need. Here's why: 🏆 Rapid Certification: Achieve compliance certifications like SOC 2, CMMC, or NIST CSF in record time – like a FedRAMP High In Process package in just 3 months. 📊 Automated Evidence Collection: Cut audit prep time by up to 60%, saving costs and improving accuracy. Always be audit-ready! 🗺️ Streamlined Compliance: Map a single control across multiple frameworks, eliminating redundant tasks and ensuring a harmonized compliance posture. 🔄 DevSecOps Integration: Embed compliance checks directly into your development pipeline, maintaining security without disrupting workflows. #ContinuousControlsMonitoring #Compliance #Cybersecurity #RiskManagement #RegScale

4

ACSC, CISA, FBI, and NSA have teamed up to release the “Best Practices for Event Logging and Threat Detection” guide. This essential resource provides a robust framework for event logging to combat rising cyber threats. Read now: https://lnkd.in/g5vhxBdV #CyberSecurity #ThreatDetection #EventLogging #ThreatIntelligence #DarkWebMonitoring #AttackSurfaceManagement #VulnerabilityManagement #BrandIntelligence #Takedown #Disruption #ThirdPartyRiskManagement

6

Framing cyber risk in a business context is critical for building understanding and inroads with leadership and stakeholders. For Patrick W., CISO of the State of Nebraska, this meant building relationships with other critical infrastructure departments. Part of aligning cyber risk with business objectives is quantifying cyber risk in financial terms. Leverage CyberStrong’s model-agnostic approach to cyber risk quantification (CRQ) to streamline cyber and business alignment. Learn more here: https://lnkd.in/d7XZiY-p #cyberriskquantification #crq #cybersecurity #cyberriskmanagement #leadership #cyberstrong

11

Introducing Josh Kadrmas, a member of our Approvals Committee, and Cyber Risk Analyst Team Lead for North Dakota Information Technology (NDIT). The Approvals Committee ensures that providers can verify their products and achieve StateRAMP Authorized status. Josh shares his experience about being a committee member, stating, "It's rewarding to know the service providers we approve are making technological advances for so many people and doing so in a secure way with privacy principles embedded within their products." Learn more about Josh and his experience at StateRAMP: https://okt.to/bVk6lX #StateRAMP #Cybersecurity #StateandLocalGovernment

16

Learn how a long-lived key & stolen credentials led to the summer of '23 compromise of sensitive Microsoft Exchange mailboxes. New White Paper reviewing CISA's assessment & underscoring need for robust credential mgt & authentication: https://lnkd.in/ehac_M4Q #passwordless

6

iOS 18.1.1 Update: Why You Need to Act Now Update November 21, 2024: This story has been updated to include a new CISA warning and additional expert analysis on the security fixes included in Apple’s iOS 18.1.1 update and iOS 17.7.2 updates. https://lnkd.in/d5qSBZ4n #update #ios18.1.1 #apple #Technology #technews #news #newsfeed #iosupdate

1

iOS 18.1.1 Update: Why You Need to Act Now Update November 21, 2024: This story has been updated to include a new CISA warning and additional expert analysis on the security fixes included in Apple’s iOS 18.1.1 update and iOS 17.7.2 updates. https://lnkd.in/d5qSBZ4n #update #ios18.1.1 #apple #Technology #technews #news #newsfeed #iosupdate

1

#CSCServiceWorks has revealed they were a victim of a #databreach The attack was detected on Feb 4, 2024. Personal info exposed include name, date of birth, bank account info, government ID, health insurance, and in some cases, their children's info. CSC ServiceWorks has engaged external cybersecurity experts to investigate and remediate. Identity theft services are being offered to those affected #cybersecurity https://lnkd.in/gcUv8U9k

2

💡 CU Intersect Conference Speaker Spotlight: Steve Koinm! Did you miss Steve's presentation last year on Physical Security and Hacking Tools? Join us at #CUIntersect24 as we revisit the topic one year later (and with possibly a few giveaways... 😉) Register for the #creditunion industry's premier cybersecurity conference here: https://lnkd.in/gzkA-MSk We can't wait to see you in Newport Beach! 🏖️ #cybersecurity #hackingtools #physicalsecurity

10