Phil Venables

Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act. Not far after the introduction of Financial Process Integrity and Disclosure Act by the then Senators Mike Oxley (a republican), and Paul Sabarnes (a Democrat), SOX became the go-to for audit control, and financial integrity validations. The two most important of this Act were sections 302 and 404. SOX did not only help traded or listed organizations, but also provided jobs to many in form of consulting, and Subject Matter expertise. Canada would later introduced C-SOX (Bill 198) as a "younger brother" of SOX. Now a new dawn has arrived in Ontario. Welcome Bill 194! Ontario weighs into the responsible use of AI and protection of information within the custody of public entities and municipalities. Ontario is taking steps to ensure a responsible use of AI in public entities, and the disclosure of attacks, breaches and data leaks by the Heads of Agencies and organizations. Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 is, perhaps the most recent update to the federal PIPEDA. This is definitely not a bad bill from the accounts of ensuring reaponsibilities by the relevant stakeholders. More to come...

1

Regulators more active in enforcing cybersecurity than ever before! A recent case highlights the critical need for financial firms to tighten cybersecurity measures. US company Equiniti Trust Company has agreed to pay an $850,000 penalty for violating SEC cyber rules after mishandling two incidents that led to the theft of over $6.6 million. Hackers hijacked email communications and created fake accounts, exploiting vulnerabilities to transfer millions and steal Social Security numbers. In today's digital landscape, financially driven cyber threats like Business Email Compromise (BEC) are increasingly sophisticated and costly. The FBI reported $2.9 billion in losses from BEC fraud in the U.S. in 2023 alone. This incident underscores the importance of robust cybersecurity measures: - Implement multi-factor authentication and regular security audits. - Invest in AI and machine learning for enhanced threat detection. - Conduct regular employee training on cybersecurity best practices. Are your firm's cybersecurity measures up to par in protecting client assets? What steps are you taking to prevent similar incidents?

6

2 Comments

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

Possibly the most useful thing Action Fraud has ever produced, 4 years old but still very relevant and should be considered by everyone. https://lnkd.in/eA4hneyD Keep your data safe, you are the principle, own it!! #dataprivacy #awareness #secops

12

NIST Proposes Barring Some of the Most Nonsensical Password Rules: Ars Technica's Dan Goodin reports: Last week, NIST released its second public draft of SP 800-63-4, the latest version of its Digital Identity Guidelines. At roughly 35,000 words and filled with jargon and bureaucratic terms, the document is nearly impossible to read all the way through and just as hard to understand fully. It sets both the technical requirements and recommended best practices for determining the validity of methods used to authenticate digital identities online. Organizations that interact with the federal government online are required to be in compliance. A section devoted to passwords injects a large helping of badly needed common sense practices that challenge common policies. An example: The new rules bar the requirement that end users periodically change their passwords. This requirement came into being decades ago when password security was poorly understood, and it was common for people to choose common names, dictionary words, and other secrets that were easily guessed. Since then, most services require the use of stronger passwords made up of randomly generated characters or phrases. When passwords are chosen properly, the requirement to periodically change them, typically every one to three months, can actually diminish security because the added burden incentivizes weaker passwords that are easier for people to set and remember. Another requirement that often does more harm than good is the required use of certain characters, such as at least one number, one special character, and one upper- and lowercase letter. When passwords are sufficiently long and random, there's no benefit from requiring or restricting the use of certain characters. And again, rules governing composition can actually lead to people choosing weaker passcodes. The latest NIST guidelines now state that: - Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and - Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. ("Verifiers" is bureaucrat speak for the entity that verifies an account holder's identity by corroborating the holder's authentication credentials. Short for credential service provider, "CSPs" are a trusted entity that assigns or registers authenticators to the account holder.) In previous versions of the guidelines, some of the rules used the words "should not," which means the practice is not recommended as a best practice. "Shall not," by contrast, means the practice must be barred for an organization to be in compliance. Several other common sense practices mentioned in the document include: 1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length. 2. Verifie

1

Listening to a great talk on single point of failure supply chain by Tarah Wheeler at the IANS Boston security forum. Great talk and a great introduction to the discussion led later today on this issue. If you are here and want to continue this massively important issue join my session on supply chain at 1:05 PM. I believe this is one of the biggest problems in cybersecurity today. What can you do about it? What are you doing about it? Tarah is bringing up some great points. Have you implemented her suggestions? What have been your challenges? Have you considered the wide variety of sources of supply chain attacks? Software updates are not the only thing you need to worry about. What tools exist to help you defend against these attacks? This was a great introduction to today’s discussion and I hope it helps people consider the severity of this issue. Come to learn and share how you are dealing with supply chain attacks with your peers.

8

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

A while back (a few years ago) I mentioned that we need government requirements and enforcement to obtain better data security across all sectors. I mentioned the idea of a CyberOSHA. I also mentioned that the first couple of years would be very painful for any entity that ran afoul of CyberOSHA. The SEC isn't CyberOSHA (yet) but this is a good example of the kind of pain you can expect to see until all sectors come under some sort of regulatory security requirements. Fines will be large. Fines may seen unfair. Fines will make headlines. That is the whole point.

9

1 Comment

🛡️ The SEC Just Released Their 2025 Exam Priorities. Here is a quick breakdown focused on #cybersecurity. ⬇️ 🎯 As the SEC continues to bolster its oversight of financial institutions, cybersecurity remains a top priority in its 2025 examination agenda. Here’s what we can expect: 🔒 Enhanced Focus on Operational Resilience: - The SEC’s Division of Examinations is doubling down on firms’ ability to prevent, detect, and respond to cybersecurity threats. - This is not just about technical controls—it’s about whether your policies and governance frameworks can safeguard critical investor information and assets in an ever-evolving threat landscape. ⚠️ Key Areas of Scrutiny: - Data Loss Prevention: Firms need to prove their ability to prevent leakage of sensitive investor information. - Access Controls & Account Management: Strong, well-managed access controls are essential. - Incident Response: Ransomware and other cyber incidents will be evaluated closely—how quickly can your firm recover and protect client information during a breach? - Third-Party Risk: Don’t overlook vendors! The SEC is assessing how firms manage third-party IT products and services, especially when they’re used without the IT department’s knowledge. 📋 Regulations S-ID & S-P Compliance: - Focus on identity theft prevention and safeguarding client records is intensifying. - The SEC will prioritize firms offering electronic investment services and those managing decentralized operations (e.g., multiple branch offices). 🔍 Expectations for Advisers Not Yet Examined: - Advisers who are newly registered or have not been recently examined can expect the spotlight. - Whether your firm is preparing for its first exam or ramping up cybersecurity measures, now is the time to ensure compliance with evolving regulations. ℹ️ What This Means for Firms: - With increased regulatory scrutiny on governance, policies, training, and third-party oversight, firms must have a proactive, comprehensive approach to cybersecurity. - The SEC’s focus is clear—robust cybersecurity is a non-negotiable aspect of operational resilience in 2025. #InfoSec #InformationSecurity #SEC #Compliance #InvestmentManagement #CyberResilience #DataProtection #CyberJudo #Finance #FinancialServices #Governance #RiskManagement

19

Vincent Scott, earlier today, made an post that prompted a very interesting and (IMO) important exchange about what may SEEM to be arcane details about #CMMC implementation. The particular focus of the post is on how to assess Security Protection Assets (SPA) which draws in a related question of how the expected CMMC Final Rule will require organizations to safeguard Security Protection Data (SPD). Here, I break the dialogue out as a separate post. Don’t think, please, that these are subjects relevant only to assessors and other experts in security practices. Not so. This discussion exemplifies high-level issues about CMMC implementation that merit consideration by the Office of the DoD Chief Information Officer and the CMMC Program Office, the DIBCAC unit of Defense Contract Management Agency (DCMA), as well as The Cyber AB and many in the CMMC ecosystem. From my earlier Comment on Capt. Scott’s post: “Everywhere you look, in -171, -171A, and in the L2 (or other) Assessment Guides, there are terms with significant implications for cost and performance but which are susceptible to different while reasonable interpretations. Great caution is important. While it may always be true that the more demanding interpretation will produce higher security, the cost/benefit relationship may not be worthwhile and, for many organizations, “more” equates to “too much” and that means “not achievable.” CMMC is a foundational framework with a baseline set of requirements (SP 800-171 R2). The program succeeds if it motivates many DIB companies to improve their security to meet the baseline from which enhancements can follow over time. The program fails if it is applied in a way that is unaffordable or unachieveable by all but a few DIB suppliers. My concerns apply, frankly, to the DoD rule drafters and to assessment and advisory communities. DoD may have great reasons to add “SPA” or “SPD” to the CMMC rule, but neither have any relationship any form of Controlled Unclassified Information and it is that, CUI, which the DFARS -7012 clause is supposed to protect. Grafting wished-for elements on to the necessities risks FAIL.” There is a risk that overwrought interpretation of SPA and SPD assessment requirements will force companies to abandon use of commercial security protection tools and services. On this, I said that it “would be nothing less than folly to force companies to abandon or disable use of commercial security protection tools as many of these (most?) represent the ‘best’ of available technology and are affordable.“ We should not assume that DoD will set this right by giving us better definitions or setting standards. Which/who or what of DoD will do this, and when? The CMMC assessor community, now working on the revised CAP, needs to contribute. You should present to DIBCAC what you think is sufficient (for security), acceptable (for DoD), and achievable (by DIB suppliers). Don’t wait for others to decide. Personal opinion.

71

44 Comments

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

This posting is about the EU Identity Wallet for PAYMENTS. Since the Large Scale Pilots (LSPs) keep their stuff under wrappers, I have only managed to find a single public specification 😥 This specification (https://lnkd.in/duDRtxfX) builds on standards that haven't yet been subjected to utility and implementability testing, like OpenID4VP and Berlin Group's "Signed Payment Request". In addition, the current specification deviates pretty dramatically from the beaten path by talking about Users "presenting" payment credentials to Merchants which in turn are supposed to "verify" such credentials. Unsurprisingly, what exactly Merchants could possibly "verify" isn't specified. This idea also seems to violate privacy-by-design principles and GDPR. In existing payment authorization systems, Issuers (Banks) are the only parties who can "verify" the User part of payment authorizations. If the EU is serious about payment support in the wallet (?), they may need to step in now.

24

7 Comments

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

More details emerge about that $25M deepfake heist in Hong Kong - the FT identified the company involved (Arup). I would bet that Arup has a strong technical cybersecurity program - this type of attack shows that smart threat actors are focusing their efforts on people/social engineering and using audio and video deepfakes before we have reliable technological detection solutions. Now is the time to educate employees about these types of attacks and put business processes in place to detect and block fraud of this type.

3

⚠ More on the Importance of ISO/IEC TS 12791:2024⚠ Many of you saw Adam Leon Smith DEng FBCS's post yesterday commenting on the release of ISO’s new technical specification (TS) document for the treatment of unwanted bias in certain AI systems. I don’t think everyone realizes what a big deal this really is, so today I thought we might explicate it a bit more. The primary goal of ISO/IEC TS 12791:2024 is to offer a structured approach for managing unwanted #bias in machine learning (ML) systems, with a specific focus on classification and regression tasks. It outlines practical methods to identify, assess, and address bias at each stage of the AI lifecycle, ultimately supporting ethical AI practices that yield fair and accurate outcomes. ➡Applicability This specification applies to organizations of all sizes and types that develop, implement, or operate AI systems, particularly those deploying ML models for classification and regression tasks. It’s useful across various verticals where AI-driven decisions impact individuals and groups, such as finance, healthcare, and public services. ➡Technical Aspects 🔶 ISO/IEC TS 12791 outlines methods to address unwanted bias in several AI lifecycle stages: 1. Inception and Stakeholder Identification - Emphasizes understanding diverse stakeholder perspectives, which helps identify and address potential biases early. 2. Design and Development - Provides guidance on selecting features and handling metadata to prevent and mitigate biases. 3. Verification and Validation - Recommends both static and dynamic testing to ensure the AI system performs consistently across diverse groups, supporting fairness and accuracy. 4. Continuous Monitoring and Re-evaluation - Mandates ongoing oversight to detect bias over time, especially when external conditions change. 5. Bias Treatment Techniques - Suggests data and algorithmic adjustments to reduce bias impact, including training adjustments, feature balancing, and use of diverse datasets. ➡ Supporting AI Governance via #ISO42001 For organizations implementing ISO42001 (AIMS), ISO/IEC TS 12791 serves as a key resource to meet your governance requirements related to fairness and non-discrimination in AI. Specifically: ✅Alignment with Risk Management (Clause 6): The standard’s focus on proactive bias identification and mitigation supports ISO42001's risk-based approach by managing bias as a potential risk factor. ✅Transparency and Accountability (Clause 7.5): Documenting bias mitigation steps fulfills ISO42001’s transparency requirements, ensuring that bias-related decisions are recorded and traceable. ✅Stakeholder Engagement (Clause 4.2): By identifying and considering stakeholders impacted by bias, organizations can enhance alignment with ethical AI governance, fostering trust and inclusivity. Special thanks to Deniz Celikkaya for coaching on today's article. A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou 🌐 https://lnkd.in/gFpvrndX

103

6 Comments

#CrowdStrike #outage I can't vouch for the information shared in the post that I am reposting, but I have seen this (similar) information floating around and it seems a plausible. It is a (yet another) NULL pointer (ish) error, that any C++ coder would admit to having done more than s/he wanted to. I started my career as a C++ coder and I have my fair share of stories where my QA colleague caught a P1 that my code would have caused. And that is the reason, any responsible tenured IT leadership will ensure that there are code review practices, QA practices, automated smoke tests, IT process audits etc. Did all of them miss in this case? What are the probabilities of that? Alternatively, what are the probabilities that it is a #leadership_mistake? As a part of IT leadership myself I find it a stark reminder of where my focus ought to be and what a slip up could cost. #softwareengineering #programing #personalDevelopment #stayTeachable

5