Hauke Vagts

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

Privacy Matters: 5 Key Takeaways from the proposed American Privacy Rights Act of 2024 (APRA) Who (would be impacted): Companies subject to the FTC Act and even nonprofit entities. Some small businesses would be exempt, however. What (is it): A comprehensive federal consumer privacy framework. It would preempt existing state privacy laws, with some exceptions, in order to simplify requirements for compliance. (Think one framework to rule them all...) When (would it apply): Not clear at this time. The bill's current "effective date" is 180 days after enactment, but it is still only in draft. Only time will tell whether this law will be passed by the US Government. Why (is this important): The APRA aims to balance consumer privacy rights with the interests of the tech industry and innovation, marking a significant step in shaping U.S. data privacy protections. Where (can I stay up to date and read more?): Read more using the Congressional Research Service (CRS) Report linked here https://lnkd.in/dum9UmgP #APRA #DataPrivacy #Security #ConsumerRights #CyberNews

7

+1. Best form of Defense is Offense....

25

1 Comment

Consumer Data Privacy is poised for a transformation with the introduction of the American Privacy Rights Act (#APRA). This bipartisan bill aims to create a uniform privacy framework, reduce data collection, improve consumer consent, provide for better opt-out options and boost privacy protection enforcement. More on the APRA's impact on #DataPrivacy: https://okt.to/5PohvG Makenzie Holland #DataProtection #Cybersecurity

1

🚨 Don't Miss Tomorrow's Lunch & Learn Event! 🚨 Join us during your lunch break on November 12 at 12 PM ET for an insightful Lunch & Learn session hosted by Flare in partnership with Snap Inc. We'll be exploring the trends shaping the future of threat intelligence and discussing how to build an effective security program for your organization. What We'll Cover: - The Evolution of Cybersecurity: Tips on making the right security investments tailored to your organization's needs. - New Threat Actor Tactics: Understanding Business Email Compromise (BEC), deepfakes, and social engineering techniques. - Proactive Security Strategies: Developing a security approach that adapts to workforce changes. Don't miss this chance to gain valuable insights. Secure your spot today! We're looking forward to having you with us! Register today: https://bit.ly/3UQld1B #Webinar #Cybersecurity #Infosec

3

Wiz Acquires Dazz! I frequently discuss UVM, RBVM, and the emerging acronym CTEM, which is gaining traction, as well as ASPM (Application Security Posture Management). Without regulatory mandates, it’s nearly impossible to prioritize effectively without a solid asset inventory and comprehensive context—both in terms of vulnerabilities and business impact. Dazz has gained significant recognition for its ASPM capabilities but also stands out for having one of the best contextualization and deduplication engines available. Its ability to integrate data from various vendors makes it function more like a traditional UVM solution. It will be fascinating to see how Wiz approaches this acquisition—whether they’ll maintain open integrations and bolster UVM capabilities or move toward a more closed, “one-platform” strategy, as many vendors tend to do. Overall, this feels like a major win for customers of both Wiz and Dazz, and I’m excited to see how their combined efforts shape the future!

17

1 Comment

Learn how the San Francisco Department of Public Health strengthens their security posture with Check Point Software Harmony Email & Collaboration. Join our webinar on May 15 to hear Lawrence Wolff and Don Byrne discuss the healthcare cyber crisis, the importance of #AI in #cybersecurity, and how to use AI to prevent phishing and ransomware attacks. What you'll learn: ✅ Strategies to defend against advanced Business Email Compromise (BEC) attacks ✅ How to implement a robust, #AI-powered defense-in-depth strategy ✅ Best practices for protecting sensitive data across a complex health ecosystem Save your spot ➡️

7

Check out the highlights from the latest NETSCOUT #DDoS Threat Intelligence Report

7

The cybersecurity regulations outlined in Part 500 of the New York State Financial Law (23 NYCRR 500) set a new standard for cybersecurity in the financial sector. Learn your key requirements under the regulation and how you can address them in our latest blog ➡️ https://lnkd.in/eRu_mGur. #CyberRegulations #NewYork

6

1 Comment

It's been more than 7 years since I was an AT&T customer and today I get this breach alert. This is the precise risk the California Privacy Protection Agency highlighted in their April 2nd 'Enforcement Advisory' where any company managing SSNs or sensitive PI should be deleting it as soon as its no longer necessary. I guess AT&T hadn't read that memo. Well-better late than never; https://lnkd.in/gxJNiKPt (Plus a shout-out to my client Aura for the helpful info and tools!)

53

6 Comments

Incredibly proud of the recognition Mimecast received in the first official evaluation by Forrester in their 2024 Wave report on the Human Risk Management space. When I started in #cybersecurity, my vision has always been to drive innovation so that organizations can trust they’re safe from human risk; this evaluation as a “Strong Performer” is further validation for me that the hard work we’re doing at Mimecast is creating change by mitigating risk.    Looking forward to continuing to innovate and drive this conversation forward – doing the happy dance, great work, Mimecast! https://lnkd.in/e3pjTRPc      #Forrester #HumanRisk #HRM #HumanRiskQuantification #CybersecurityRiskManagement

43

1 Comment

Join my guys in this terrific session on how to use Q and Inspector to help your dev teams shift left by finding and fixing security issues in your first- and third-party code. 👏

19

Today is the day. The #genai rollout has officially begun, and it's time to Secure AI by Design. Learn more about our latest advancements in AI Runtime Security and AI Access Security This isn’t Sci-Fi This is Precision AI™

64

3 Comments

On July 18, CrowdStrike, an independent cybersecurity company, released a software update that began causing outages. Given the impact to our customers, we wanted to provide an update on the steps we’ve taken with CrowdStrike and others to remediate and support our customers. Our first and foremost focus is providing customers with technical guidance and support to safely bring their systems back online. Please read guidance in our blog below. This incident demonstrates the interconnected nature of our broad ecosystem and is a reminder of how important it is for all of us across the tech ecosystem to prioritize operating with safe deployment and disaster recovery using the mechanisms that exist. As we’ve seen over the last two days, we move forward most effectively when we collaborate and work together. 💜

709

34 Comments

The ECH (Encrypted Client Hello) protocol feature explicitly and deliberately and unapologetically disintermediates edge network operators. This includes enterprise policy checking and enforcement, family filtering, even my laptop's apps and virtual machines. The driving market force is device makers, browser makers, CDNs, and content farms who do not want their traffic to be inspectable. Their concern as described in RFC 7258 is inappropriate agency-in-the-middle attacks. My concern is that the Internet was once a network of networks, where each network was autonomous and sovereign. In the post-Snowden world, the Internet as described in RFC 8890 is a viral entity to which edge networks either connect unquestionably and fully, or not at all.

68

34 Comments

#GenAISecurity: Recently, our team- Aaron L., Dana B., Eden Sharabi, Gabi Bar-Joseph, Moran Elbaz, Robert Drannikov, and Yonadav Vinograd collaborated with a large global organization that uses an internal chatbot to provide employees with both personal and general data. During security testing, a vulnerability was discovered that allowed us to manipulate the chatbot’s prompt through a prompt injection attack, enabling access to other employees’ personal and private information. Unlike traditional access control systems that have been tested and strengthened over decades, AI systems with access to sensitive data may be vulnerable to attacks like these, potentially leaking private information. Prompt injection is an attack where the input text is crafted to trick an AI into bypassing its security controls. Similar to how SQL injection exploits vulnerabilities in data systems to access unauthorized information. To mitigate these risks, secure your prompts, perform security assessment, and enforce strict access controls to keep data safe. #AccentureSecurity #GenAI

26

1 Comment

Don't miss this special episode of Defenders Digest! I talked with Onapsis CTO and Co-Founder, Juan Perez-Etchegoyen, about Onapsis celebrating its 15th anniversary in September. In the video we discuss how Onapsis's research labs significantly contributed to September's Patch Day with their findings helping SAP identify and patch over a third of the vulnerabilities. We also discuss key takeaways from our most recent blogs including an introduction to hashing, a one-way encryption method used to ensure data integrity, authenticate information, secure passwords, and other sensitive information. Tune in to learn more!

17

Six months after the US Executive Order on AI safety, NIST has delivered 5 new publications to bolster secure #AI development. These resources build on the NIST AI Risk Management Framework (AI RMF) and provide actionable insights for organizations. Dive into Mandy Pote's analysis of these guidelines and learn how to elevate your AI risk management strategy: https://ow.ly/ckTG50SWnhR #CyberSecurity #NIST

2