Richard Purcell

New Blog Post! Ensuring Security: The Crucial Role of NDAA Compliance 🔒 💻 Protects Sensitive Data 🤝 Enhances Trust 🛡️ Mitigates Security Risks ✅ Required for Federally Funded Organizations Explore why NDAA compliance is essential at https://ow.ly/C8JP50U5qr0 #NDAA #Security #Compliance #DataProtection #NationalSecurity #RiskManagement #ComplianceMatters #FederalRegulations #DataSecurity

5

GovCon -- New DFARS 252.245-7005 clause has some important changes regarding the Management and Reporting of Government Property Take a look at this blogpost to learn more https://zurl.co/jlTW

1

"The U.S. Supreme Court’s recent decision in the case of Loper Bright Enterprises v. Raimondo could significantly disrupt federal cybersecurity regulations. The ruling shifts ultimate regulatory approval from agencies to the courts, potentially weakening regulations like SEC incident reporting and FCC data breach reporting. This decision overturns the Chevron deference, a 1984 precedent that instructed courts to defer to regulatory agencies’ expertise in interpreting congressional intent. Now, courts will independently decide if agencies have acted within their statutory authority, leading to potential legal challenges against many existing cyber regulations. This shift could create uncertainty for CISOs as conflicting judicial decisions emerge, potentially diluting or eliminating current cybersecurity requirements." #SupremeCourt #Cybersecurity #ChevronDeference #CybersecurityLaw https://lnkd.in/d76BiTdq

12

The new guide released by CISA and the EAC, "Enhancing Election Security Through Public Communications," marks a significant stride in fortifying the integrity and transparency of the electoral process. Aimed at state, local, tribal, and territorial election officials, this guide underscores the critical role of effective communication in maintaining public trust. As trusted sources of election information, these officials are equipped with tailored tools and resources to develop robust communication plans that address the unique needs of their jurisdictions. Open communication is essential not only for informing the public but also for mitigating misinformation and ensuring that voters have access to accurate election details. By emphasizing year-round communication strategies, the guide aims to instill a deeper sense of confidence in the electoral process. The collaboration between CISA and the EAC in developing these guidelines demonstrates a proactive approach to election security, ensuring that every phase of the election process is transparent and secure. This initiative is a pivotal resource for election officials seeking to enhance public trust and safeguard the democratic process. #electionsecurity #democraticprocess #publictrust #misinformation #electionprocess #effectivecommunication #opencommunication

2

A new bipartisan report from the McCrary Institute for Cyber & Critical Infrastructure Security offers specific and comprehensive cybersecurity recommendations to The White House' s next administration. This report goes much further and deeper than existing white papers from our national security agencies, and the writing is compelling. “The recommendations outlined in this report are not mere suggestions; they are imperatives for securing America’s future in the digital age. The threats we face are real, urgent, and growing more complex by the day. Ransomware attacks, for instance, have moved beyond mere criminal enterprises to become tools of national power, threatening our critical infrastructure and the very fabric of our society. The recent attacks on our healthcare systems, energy grids, and financial institutions are stark reminders of our vulnerabilities and the devastating consequences of inaction. Yet, the challenge before us is not insurmountable. With decisive leadership, strategic investment, and a whole-of-nation approach, we can not only defend against these threats but position the United States as the global leader in cybersecurity and digital innovation. This is not just about security; it’s about maintaining our technological edge, economic competitiveness, and national values in the digital age.” Some of my favorite recommendations: ·       Recommendation 2.2: Establish a national cybersecurity R&D coordination body ·       Recommendation 2.5: Operationalize public-private partnerships ·       Recommendation 4.2: Develop comprehensive cloud security and resilience standards and certification processes ·       Recommendation 5.2: Promote an open, interoperable internet globally ·       Recommendation 5.3: Enhance international cooperation on cybersecurity standards ·       Recommendation 6.4: Develop a national K-12 cybersecurity curriculum to build a pipeline of future cyber professionals and cyber literate citizens ·       Recommendation 7.2: Enhance supply chain security for critical technologies ·       Recommendation 8.4: Conduct a robust Continuity of the Economy Planning Read more background on the report from POLITICO: https://lnkd.in/gVUDf7yr #cybersecurity #election #nationalsecurity #economicsecurity #technology #publicpolicy

1

In this article for the IACP's Police Chief Magazine, PenLink's Johnmichael O'Hare and our own Trey Amick talk about how digital forensics and open-source intelligence (#OSINT) are playing crucial roles in modernizing police investigations: https://ow.ly/UH9O50SUg9q #DFIR

29

New joint guidance from Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation (FBI), the National Security Agency's AI Intelligence Security Center, and international partner agencies issued best practices for deploying and operating externally developed artificial intelligence (AI) systems. Goals of the new international interagency guidance include: 1. Improve the confidentiality, integrity, and availability of AI systems.  2. Ensure there are appropriate mitigations for known vulnerabilities in AI systems. 3. Provide methodologies and controls to protect, detect, and respond to malicious activity against AI systems and related data and services. #cisa #ai #aisecurity Maureen Holohan Chauncey Goss Becky Leggieri Cameron Leuthy

5

1 Comment

When it comes to digital forensic investigations, not all geolocation data is created equal. Learn some best practices for pinpointing locations, establishing timelines, and corroborating testimonies to convict or exonerate suspects -- and learn the limitations of these powerful forensic artifacts.

23

1 Comment

Cybersecurity risk management continues to be a top challenge facing federal agencies. We worked with the Council of the Inspectors General on Integrity and Efficiency and other OIGs to report on trends across the government. Read about progress made and what can be improved. https://lnkd.in/etKZ4WSy

This is a great tool to help audit committees perform their oversight role to ensure that cybersecurity risks are well managed. https://lnkd.in/gF8fc6aQ Cybersecurity is a process, not just a project—and audit committees have a role to play throughout. That means ensuring management is continually identifying critical data and the threats to that data, protecting it, and planning for breaches. Thanks to KPMG Canada #cybersecurity #auditcommittee #risk #risks #riskmanagement

1

A Senate Bill requiring Vulnerability Disclosure Reporting has been approved by committee to move forward. https://lnkd.in/ei5NcFuC Vulnerability Disclosure is an important function within an effective Secure by Design product implementation following NIST Guidelines, which is described in detail in CISA's Secure by Design Software Acquisition Guide practices located at https://cisa.gov/sag Warner said that vulnerability disclosure policies, or VDPs, “are a crucial tool used to proactively identify and address software vulnerabilities,” and that this bill would “better protect our critical infrastructure and sensitive data from potential attacks.” Energy Central also contains several articles to help understand Vulnerability Disclosure Reports using a CARFAX analogy; https://lnkd.in/eJDfA7de NOTE: NIST now refers to Vulnerability Disclosure Reports using a new name, "Vulnerability Advisory Report" for better alignment with the coordinated vulnerability standard IEC 29147:2018 https://lnkd.in/eGBrJnuK , which is also discussed in the CISA Software Acquisition Guide.

7

5 Comments

🚨NEW REPORT🚨 In "User in the Middle: An Interoperability and Security Guide for Policymakers," CSI’s Maia Hamin & Alphaeus Hanson examine how interoperability and security intersect in digital tech, scrutinizing common arguments and mapping key concepts. https://lnkd.in/e-7FFydr First off — what is interoperability anyway? The IEEE defines it as "the ability of two or more systems or components to exchange information and to use the information that has been exchanged." Interoperability can be both vertical (up and down the stack – think software running on hardware), and horizontal (across it – think data sharing between applications). Technologies take different paths to interoperability, from intentional design, to coalescing on common standards, to adversarial interoperability or policy intervention, and the paper discusses examples from the internet and telecommunications to document file formats and banking data.  But what does this all mean for security? For one, different companies have used security arguments to push back against opening their systems to interoperation in the past. Interoperability does have real interactions with security: it often means developing a trust relationship with another party, whether by granting them access to user data, or allowing them to manage security-relevant functions. Managing trust is a core requirement in information security, so this doesn’t mean that interoperability cannot be done securely — but it does mean that interoperability requirements should be paired with technical and organizational protections. Then, there are core security primitives like encryption and identity that are key building blocks of secure and interoperable systems, which are important (and not always trivial) to get right when it comes to building secure interoperable technology.  Throughout these security interactions, the paper emphasizes, the key north star for policy should be user choice. Companies should be empowering users to make informed choices about their security decisions, rather than foreclosing users’ choices in the name of security. The paper concludes with recommendations for policy including empowering agencies to take up interoperability issues, using procurement to advance adoption of secure interoperable tech, enshrining data rights, and investing in technical infrastructure and standards development. Read all about it here and then let us know what you think – interoperability is a complex and important issue, and we really want to feed the fires of the policy conversation here.

18

2 Comments

📢 ICYMI: Justin Hendrix spoke to Erin Kissane about new research on governance in the #fediverse, including diplomacy between server operators, the types of political and policy decisions moderators must make, and the need for more resources and tooling to enable alternatives to major social media platforms. #DigitalGovernance #SocialMedia https://lnkd.in/drKgfmjc

1

This just in! 📣 ✅ Sen. John Hickenlooper has introduced the VET AI Act – mandating third-party audits to ensure responsible AI deployment. 📋 This groundbreaking legislation empowers National Institute of Standards and Technology (NIST) to establish guidelines for these audits, focusing on thorough risk assessment and management. ⚖️ The act aims to tackle the socio-technical challenges of AI systems, drawing lessons from past regulatory failures in other industries. 🤝 Clear standards and robust oversight will be key to preventing AI-related harms and fostering trust in AI technologies. Read more @ Tech Policy Press: https://lnkd.in/eGgY8pvC

3