Ken Leeser

💲 Prepare NOW for the $200M K12 Cybersecurity Pilot Program 💲 In case you missed it, the FCC released the specifications and eligible services for the $200M K12 cybersecurity pilot program. We will have much more to share with you in the coming months as we approach the expected application window opening later this year. In advance of this opening, there are things you can do NOW to prepare for what the application will require. First, you can download the *DRAFT* version of the FCC Form 484 (https://lnkd.in/gbU_XDcX). This ONLINE ONLY form will be released later this year so that schools can apply to be part of the pilot program. This is the first part of the application, where applicants must provide general information about the school seeking support, including applicants’ experience with cybersecurity matters, whether they expect to implement cybersecurity recommended best practices and their current or expected use of free or low-cost federal resources.  Applicants will also be required to provide information about their proposed Pilot project, including a description of the goals and objectives to be achieved, the services and equipment to be purchased (and associated costs), and the cybersecurity risks the proposed Pilot project will prevent or address. But how can you gather this information? Vinson Protect CAN HELP! We have built a free audit tool (https://vinsonprotect.com) for you to use to audit your school’s preparation against various industry standards (including the K12 SIX Essential Cybersecurity Protections, Center for Internet Security's CISv8 Controls, and the ClassLink Cybersecurity Rubric) specifically called out in the pilot program announcement). This audit will help identify weaknesses and opportunities for improvement in your school preparedness program. It will give you a status report and security plan to help draft your proposal goals and objectives. Please let us know if you have any questions or want assistance getting started. #vinsonprotect #k12 #cybersecurity

28

1 Comment

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

Cyber risk has a human side. What !! Looking forward to this session with my fellow panelists: Violet Sullivan, CIPP/US CIPM (Crum and Forster), Tim Zeilman (HSB - Hartford Steam Boiler), Ryan Caruso (CyEx) and John Yanchunis (Morgan & Morgan, P.A.) at the Zywave #cyberrisk event The Human Side of Cyber: November 6, 2024 [2:40 PM-3:25 PM ET] Many cyber events fly under the radar, while others make a major splash in the headlines. Every event carries consequences for the affected entities and individuals. The human impact of cyber often goes unreported, but threat actors increasingly lean into the leverage they have with extortion, social engineering, or denial of key services. This panel will offer a look behind the scenes, allowing organizations to better understand the emotional and operational impact of cyber events.

62

1 Comment

Curious about the implications of NIST CSF 2.0 for MSPs and MSSPs?  Cynomi CEO, David Primor, and William Birchett the founder of the vCISO Network break down the NIST update with 4 questions. Read the blog ↘️ https://hubs.la/Q02CnK_80 #Cybersecurity #NIST #RiskManagement #MSSP #Cynomi

17

Lehigh University (LU), a private research university in Pennsylvania, turned to Armis to strengthen its cybersecurity posture: https://lnkd.in/evDuz2_C By implementing Armis Centrix™ for VIPR Pro – Prioritization and Remediation, LU achieved an 80% reduction in assessment time and a 40% decrease in tool costs. The implementation also streamlined workflows, reducing fix times by up to 80%, and enabled more effective prioritization of security findings, thereby minimizing risk exposure. Discover how Armis helped Lehigh University achieve a proactive security posture: https://lnkd.in/evDuz2_C #VulnerabilityPrioritization #ArmisCentrix #Cybersecurity #RiskManagement #SecurityFindings #Remediation

30

I encourage my network to watch this great conversation between Mike Battistella and Richard Pharro on Cybersecurity Beyond Compliance Mike dispels the misconception that passing a compliance audit guarantees long-term security. Richard and Mike explore how continuous improvement is vital for cybersecurity and why organizations must go beyond compliance to protect their digital assets. Mike also highlights the crucial role of leadership in embedding cybersecurity into business strategy, ensuring it’s seen as essential for survival, not just a technical necessity. #cybersecurity #cybersecurityrisk #nistcybersecurityframework

7

Pennsylvania’s Consumer Data Privacy Act is Now Law! As of March 18, 2024, Pennsylvania has officially passed the Consumer Data Privacy Act (House Bill No. 1201, Session of 2023). This landmark legislation enhances consumers' data privacy rights and sets forth clear obligations for data controllers and processors. Key Highlights Consumer Rights: Consumers now have enhanced rights, including the ability to access, correct, and delete their personal data. They can also opt out of data processing for targeted advertising or sales. Business Responsibilities: Data controllers must limit data collection, obtain consent for processing sensitive data, and implement robust data protection measures. Enforcement and Penalties: Strict penalties are in place for non-compliance, emphasizing the importance of businesses aligning with these new standards Is your business fully compliant with these regulations? Privacy24 is here to help! Our seasoned compliance experts specialize in helping businesses navigate complex data privacy laws. Our expert team can ensure that your company not only complies with this new law but also leverages compliance as a competitive advantage. Our Services Include: Comprehensive compliance audits. Tailored policy development and strategic implementation. Training and ongoing support to maintain high compliance standards. Don’t risk penalties or damage to your reputation. Contact us today for a consultation and let Privacy24 help you achieve and maintain compliance with confidence. 🌐 For more information, visit privacy24.io or send us a direct message here on LinkedIn! #DataPrivacy #ConsumerProtection #PennsylvaniaLaw #ComplianceExperts #Privacy24

6

OpenID Connect specifications published as ISO standards I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. I submitted the OpenID Connect specifications for publication by ISO as Publicly Available Specifications (PAS) for the OpenID Foundation in December 2023. Following the ISO approval vote, they are now published. This should foster even broader adoption of OpenID Connect by enabling deployments in jurisdictions around the world that have legal requirements to use specifications from standards bodies recognized by international treaties, of which ISO is one. See https://lnkd.in/g5aZF8CJ for links to the ISO specifications and more details. OpenID Foundation #OpenID #OpenIDConnect #ISO

220

8 Comments

NIST Report on the 2024 Accordion Cipher Mode Workshop

3

Grateful to have Moody's Corporation's CEO Rob Fauber and CSO David Platt visit our Qrypt HQS for an insightful discussion on corporate resilience, opportunities to enhance clients' cybersecurity posture, and preparing for the convergence of AI and Quantum. Rob and Dave are both passionate about identifying options for industry as we all prepare for the inevitable transition to post quantum cryptography. #Moodys #PQC #OneWTC #Quantum #Encryption #Cryptography #Cybersecurity #QuantumSecurity #Qrypt

82

Jeff Edwards, Co-Founder and Host of the SafeHouse Podcast, adds special co-host Alex W., Director of Cybersecurity, DFIR and SOC for a summer series of 12 podcasts about “10 Common Flaws in Incident Response Plans”.  Alex will have Cybersecurity and Incident Response Subject Matter Experts as Special Guests each week to discuss each of these flaws in depth. Don’t make these mistakes in your Incident Response Plans! Make this your summer podcast starting on June 13th! #cyber #cybersecurity #cyberprotection #cyberattack #businesscontinuity #operationalresilience

12

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

Today, SIA's Jake Parker will join others in testifying at the U.S. Senate Committee on Commerce, Science, and Transportation Majority Subcommittee on Consumer Protection, Product Safety and Data Security hearing on "Strengthening Data Security to Protect Consumers." The hearing will focus on the importance of #datasecurity and how to protect the confidentiality, integrity and accessibility of consumer data and safeguard data against unauthorized access, including through data minimization and robust data security practices. SIA appreciates the opportunity to provide input from our industry on this important issue. Watch the hearing:⬇ https://lnkd.in/eqhs4snN #securityindustry

18

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Payments System Disruption - Free All-Sector TTX - Dec 11, 12-4PM ET Join us and hundreds of your peers for a complementary, all-sector virtual tabletop exercise. Are you prepared to respond to the unexpected? In today’s interconnected landscape, resilience isn’t just about preparation—it’s about collaboration and adaptability across all sectors. Our All-Sector Virtual TTX is designed to help leaders and teams strengthen their response strategies, share insights, and navigate complex challenges together. 🔹 Who should attend? cyber, resilience, risk, payments system, and response professionals 🔹 What to expect? Realistic injects, expert-led discussions, and an interactive, collaborative environment that fosters learning and actionable takeaways. Tackle disruptions across business, technology, and third-party ecosystems in a challenging scenario that tests your organization’s resilience and strategy. Don’t miss this opportunity to connect with others, test your strategies, and build resilience across the board. Secure your spot now and take a proactive step toward safeguarding your organization’s future! Register here: https://lnkd.in/dhSbUPyh #Resilience #RiskManagement #TabletopExercise #AllSectorTTX #OperationalResilience #CISO

23