Michael Driscoll

Drawing upon a comprehensive survey of almost 400 corporate DFIR professionals, the fourth annual State of Enterprise #DFIR report examines the evolving contributions and experiences of DFIR professionals within corporate environments. Get it today: https://ow.ly/ENaK50RkeWH

16

This week's podcast, CIRCIA Rulemaking: Double Incident Reporting for the DIB. Defense contractors have had cyber incident reporting obligations under DFARS clause 252.204-7012 for many years. Recently, however, CISA issued a 457-page proposed rule implementing the 2022 Cyber Incident Reporting for Critical Infrastructure Act. Unless CISA and DoD can reach an agreement, DIB contractors will have duplicative incident reporting obligations for two different agencies. Links to watch/listen are in the comments ⬇ #DIB #DOD #cyber

14

2 Comments

We released joint guidance with the Federal Bureau of Investigation (FBI) on “Product Security Bad Practices,” part of the #SecurebyDesign initiative. The guidance outlines risky product security practices for software manufacturers, particularly those supporting critical infrastructure and national critical functions. The bad practices are organized into three categories: product properties, security features, and organizational processes and policies. The guidance also includes recommended actions and additional resources to help software manufacturers prioritize security throughout the product development process. The public comment period is now open through November 30. https://go.dhs.gov/UxS

119

4 Comments

Cybersecurity vulnerabilities are a critical consideration for federally regulated financial institutions, requiring careful risk assessment and robust oversight frameworks. We survey the cyber risk guidelines set out in Guideline B-13, highlighting its intersections with other OSFI risk-management guidelines: https://bit.ly/4eTxEBc Molly Reynolds | Rosalie Jetté | Angela Jiao | Adam Armstrong #cybersecurity #datagovernance #privacy #technology #artificialintelligence #CyberMonth2024

9

New Blog Post! Ensuring Security: The Crucial Role of NDAA Compliance 🔒 💻 Protects Sensitive Data 🤝 Enhances Trust 🛡️ Mitigates Security Risks ✅ Required for Federally Funded Organizations Explore why NDAA compliance is essential at https://ow.ly/lRPM50U5qt1 #NDAA #Security #Compliance #DataProtection #NationalSecurity #RiskManagement #ComplianceMatters #FederalRegulations #DataSecurity

15

Roger Abbott, Adam Bartolanzo and Kathryn Carlson analyzed for Law360 the Department of Defense's final rule formally implementing the Cybersecurity Maturity Model Certification program. The new requirements “will greatly increase the costs of complying with existing cybersecurity controls by requiring contractors to invest significant time and resources to demonstrate that they meet these controls, and by increasing the legal risk of noncompliance,” they wrote. Click below to read the full article. (Log-in may be required.) #GovCon #CMMC #cybersecurity #governmentcontracting https://lnkd.in/eszzAgj9

14

The Cyber-Enterprise Risk Management Community of Interest (Cyber-ERM COI) is leading the charge on integrating ERM and cybersecurity practices. Comprised of 175 members from 53 federal agencies, the Cyber-ERM COI brings together federal ERM and IT practitioners to bridge communication between agency-level ERM and cybersecurity risk management functions. The Cyber-ERM COI enhances strategic decision-making across federal agencies by embedding cybersecurity risk management into the core of governmental operations, thereby improving the U.S. Government’s ability to respond to a dynamic and evolving cyber threat landscape with resilience and confidence. Click here to learn more about the Cyber-ERM COI: https://lnkd.in/eb-wfmvy

8

In observance of National Critical Infrastructure Security and Resilience Month, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the Director of National Intelligence, released guidance to assist #criticalinfrastructure owners and operators to detect and mitigate efforts by foreign intelligence entities to disrupt U.S. critical infrastructure. As a nation, continued #cyber and physical threats to critical infrastructure Americans rely on daily are being observed. U.S. adversaries and their foreign intelligence entities understand the importance of the critical infrastructure sectors and how degrading them could hinder the national response to events. “U.S. adversaries and their foreign intelligence entities (FIEs) a understand the importance of these sectors and how degrading them could hinder our national response in the event of crisis or war, given that harm to these sectors could cause panic, erode confidence in the government, and complicate leadership decision-making,” the agencies identified in a document titled ‘Safeguarding Our Critical Infrastructure: Vigilance Makes a Difference.’ #Threatlandscape #Cyberattacks #Cyberthreats #Adversarialattacks https://lnkd.in/gpZKTxAe

26

1 Comment

#SEC finalized amendments for S-P, designed to protect PII. RIAs, BDs and more must, (1) have a written incident response plan (IRP) and (2) develop procedures to notify people whose PII was improperly accessed. To quote the SEC, "The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”" 18-24 months to implement. #ria #rias #cybersecurity

4

Wet ink alert! The Office of the National Cyber Director, The White House's Harry Coker and Office of Management and Budget's Shalanda Young inked a memo today outlining the FY26 President's Budget Request #cybersecurity priorities. 🔏 https://lnkd.in/eQjSkEvr tldr; ⚓ #ZeroTrust ⚓ #CriticalInfrastructure cybersecurity ⚓ Raise baseline cybersecurity ⚓ #OpenSource Software Security #OSS ⚓ Strengthen the #CyberWorkforce (ATTN: Mark E Green MD) ⚓ Post-#Quantum Cryptography 🤓 ⚓ Memory Safe Program Language (#Rust) ⚓ Industrial & #OperationalTechnology cybersecurity (#OT)

8

"To strengthen domestic accountability, CCB strategies should play a critical role in empowering actors beyond states to engage critically with #cybersecurity-related issues," writes Andrea Calderaro in a new issue brief on #cyber capacity building (CCB). Read the latest collaborative paper with EU Cyber Direct – EU Cyber Diplomacy Initiative ⤵️ https://lnkd.in/eDjQCni8

3

Manufacturers Urge Feds to Revise Draft Cyber Attack Reporting Rule Manufacturers are urging the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) to revise its draft rule on cyber-attack reporting, arguing that the proposed requirements are overly broad and burdensome. The National Association of Manufacturers (NAM) suggests narrowing the scope to truly critical infrastructure and reducing the reporting load to ensure meaningful data is collected without overwhelming smaller entities. https://lnkd.in/eXDiT5mk #cybersecurity #cyberattack #cybercrime #cyberrisk #cyberthreats #informationsecurity #infosec #breach #databreach #malware #google #bing #networksecurity #technicalsupport #itservices #itsupport #dataprotection #datasecurity #itnews #hackingprevention #cloudsecurity #riskmanagement #fbi #vciso #securityexpert #cisa #financialrisk #manufacturing #iot #ransomware

1

The National Institute of Standards and Technology is seeking public feedback on a draft roadmap for implementing the U.S. government's National Standards Strategy for Critical and Emerging Technology. Read more: https://lnkd.in/efYrmPBY _____ #GovTech #GovernmentContracting

2