Christopher Stangl

In our comments – thanks to our amazing members & the moral, policy, and grammatical support of my teammates Cassie (Leonard) Ballard and Mari Savickis – we highlighted several crucial areas for CISA to consider as they work to craft a final rule. I'll break it down. ✏️ 1) Patient Safety First: Cybersecurity is essential for patient safety. Regulatory requirements must support, not hinder, this core mission. 2) Support, Don’t Punish: We need to shift away from punishing victims of cyberattacks and focus on support and prevention. 3) Coordination is Key: Collaboration with federal agencies like HHS, OCR, and FTC is vital to avoid redundant reporting and excessive burdens on healthcare providers. 4) Reporting Clarity: The definition of "substantial cyber incident" should be clear to prevent additional strains on hospitals and healthcare systems. 5) Avoid Compliance Confusion: Ensure HIPAA timelines aren't prematurely triggered by CIRCIA Reports, which could lead to compliance challenges. 6) Shared Responsibility: Third-party service providers must be accountable for reporting cyber incidents, not just healthcare providers. 7) Minimal Data Reporting: Only essential information should be required to support cybersecurity efforts without overburdening healthcare providers. 8) Reasonable Reporting Timelines: Allow hospitals to submit supplemental reports every 72 hours or five business days to avoid prioritizing reporting over patient care. 9) Inclusive Sector-Based Criteria: Health insurance companies, TPAs, and clearinghouses must be explicitly included in the criteria to prevent gaps in security. 10) Testing Before Implementation: Web-based reporting forms should be tested in a sandbox environment to ensure effectiveness and security. 11) Security Defense Reporting: Avoid requiring extensive security architecture details in reports, which could expose sensitive information. 12) Detailed Implementation Plans: CISA needs to provide clear plans for how they will distribute and utilize the reported information to benefit the healthcare sector. I truly look forward to continuing our partnership with our friends at the Cybersecurity and Infrastructure Security Agency to strengthen the cybersecurity posture for our nation and the HPH Sector. 🤝 By addressing these points, we can better protect our hospitals and healthcare systems and ensure patient safety remains at the forefront of improving cybersecurity. #Cybersecurity #PatientSafety #Healthcare #CISA #CHIME #AEHIS #PublicPolicy

8

1 Comment

It's of no surprise that NIST won an award for their efforts in developing CSF 2.0. NIST released it CSF 2.0 update in February 2024, a much need update to the CSF that included governance, regulatory compliance, risk management and an increased focus on supply chain risk management. NIST CSF is a well known framework and adopted by FISMA, U.S federal cyber regulation. As well as many industry sectors globally as a the controls framework for cybersecurity and cybersecurity risk management. That will be increasingly required by entities covered by the increasing amount of global cyber regulations. We were pleased to present CSF 2.0, U.S and EU cyber regulation, governance and the role internal audit plays in the oversight, assurance and attestation of cybersecuirty risk management, The Institute of Internal Auditors Inc. this week. Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner @ Veritas GRC National Institute of Standards and Technology (NIST) #csf2 #cybersecurity #cyberriskmanagement #cyberregulation

16

1 Comment

"The U.S. Supreme Court’s recent decision in the case of Loper Bright Enterprises v. Raimondo could significantly disrupt federal cybersecurity regulations. The ruling shifts ultimate regulatory approval from agencies to the courts, potentially weakening regulations like SEC incident reporting and FCC data breach reporting. This decision overturns the Chevron deference, a 1984 precedent that instructed courts to defer to regulatory agencies’ expertise in interpreting congressional intent. Now, courts will independently decide if agencies have acted within their statutory authority, leading to potential legal challenges against many existing cyber regulations. This shift could create uncertainty for CISOs as conflicting judicial decisions emerge, potentially diluting or eliminating current cybersecurity requirements." #SupremeCourt #Cybersecurity #ChevronDeference #CybersecurityLaw https://lnkd.in/d76BiTdq

12

Hyperbole, Misinformation, and CyberMonsters Under the Bed: By Ken Westin, Field CISO, Panther Labs This week at the World Economic Forum, there was a panel titled “Are Banks Ready for the Future?” with an esteemed panel of […] The post Hyperbole, Misinformation, and CyberMonsters Under the Bed appeared first on Cyber Defense Magazine. https://lnkd.in/gbi-hRP2

1

The terrorist threat vectors impacting U.S. Homeland Security and Foreign Affairs have changed dramatically over the past six months. Please join me and other leading experts across government and academia as we discuss 2024 trends and their impact across sectors.

61

In a new eBook from Federal News Network, #BoozAllen experts Imran Umar and Erica Banks share lessons learned from DOD’s Thunderdome project and how they can be applied to federal civilian agencies as they implement #zerotrust architectures of their own with the help of the Cybersecurity and Infrastructure Security Agency’s Continuous Diagnostics and Mitigation program. Other #cybersecurity insights focus on #cloud, #EDR, and OT systems.

8

Expert analysis by Drew Schmitt, Practice Lead, GRIT at GuidePoint Security, on the evolution of #RaaS. With #ransomware groups adapting recruitment tactics, the cyber threat dynamic changes. Schmitt's investigation uncovers new affiliate strategies after #OperationCronos. Learn more in his interview with Help Net Security. https://okt.to/K0ecpO #CyberCrime

4

I was honored to Chair the International Security Advisory Board's New Security Challenges study group with a great team including James Goldgeier Heather Hurlburt Dr. Nola Haynes she/her Julie Fischer Lyric Thompson Paul Walker supported by outstanding State staff including Michelle Dover Scott Bohn and Kate Guy. Some of our key takeaways: 1. U.S. Department of State is not yet properly prepared for full range of climate security, resource scarcity, disease, and identity risks: "While the Department of State has elevated climate change in many respects, it is not yet prepared or organized for ways in which climate disruptions are exacerbating resource scarcity, driving competition, and fundamentally reshaping 21st century diplomacy." 2. Diplomats and State staff need to conduct regional scenarios to examine how the new security challenges of climate, resource scarcity, disease and identity affect our foreign policy strategies and plans - our case study on Taiwan shows how climate risks interacts with deterrence and defense strategy in the region. 3. U.S. Department of State has tools available for understanding and monitoring arms control agreements and nuclear proliferation could be used to monitor geoengineering, including Solar Radiation Management (SRM), an area of growing attention and interest. 4. US leadership on civilian nuclear energy is important at a time when Russia and China have become leading global suppliers of civilian nuclear energy without the same safeguards as the US. U.S. Department of State's programs such as the Foundational Infrastructure for the Responsible Use of Small Modular Reactors (FIRST) and Winning an Edge through Cooperation in Advanced Nuclear (WECAN) can make an even greater contribution towards achieving #Netzero emissions goals. 5. Ambassador Bonnie Jenkins's focus on improving the connection between the T Bureau's work on nonproliferation, arms control and regional security effort contribute the #SDGs (Sustainable Development Goals) is laudable and deserves more attention. Thanks to Ambassador Bonnie Jenkins for commissioning this report. https://lnkd.in/ea-PB7Fb

40

#SEC finalized amendments for S-P, designed to protect PII. RIAs, BDs and more must, (1) have a written incident response plan (IRP) and (2) develop procedures to notify people whose PII was improperly accessed. To quote the SEC, "The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”" 18-24 months to implement. #ria #rias #cybersecurity

4

Read this Guidehouse Defense and Security case study outlining how our team aided FEMA in creating a modernized DevSecOps-driven system by commanding agile software development, systems integration, and data analytics: https://lnkd.in/eZfG8HCA

8

ICYMI: NIST released the latest version of SP 800-171. This is the standard used for DFARS 252.204-7012, CMMC Level 2 (in draft form now), and DHS' Cybersecurity Readiness Factor (CRF) used in DHS best value procurements. Because of a recent DOD class deviation, compliance will not be required immediately, but contractors should track the differences to prepare for eventual implementation of this standard. The previous revision is also baked into CMMC Level 2 and DHS' CRF.

22

1 Comment

One of my favorite interviews is with Jerri Williams of FBI Case File Review. In Episode 173, I discuss the 2002 DC Sniper Case, my time on the FBI’s Hostage Rescue Team (HRT), and my book “Stay Safe - Security Secrets for Today’s Dangerous World”. Listen in to a very interesting & informative interview! #StaySafe https://lnkd.in/giNujdwP

6

Cuneo Consulting LLC.'s latest article emphasizes the critical integration of advanced cybersecurity measures in executive protection. Key points include addressing AI-based attacks, such as deepfakes, which pose significant risks through realistic impersonations, and implementing robust human risk management practices. The protection of intangible assets like data privacy and brand reputation is highlighted, with strategies for effective monitoring and mitigation.

5

1 Comment

Some good guidance here on Deploying AI systems securely. Although AI systems/LLMs do introduce some novel threats, this guidance should be foundational to any mature cyber program. CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF (defense.gov) https://lnkd.in/efatSxvn

100

3 Comments

Digital bricks and reputational windows... Some excellent analysis by Recorded Future (https://lnkd.in/gXaiiAae) that describes trends and methods by which hacktivists increasingly doxxing corporate executives and public officials. As Israel's military campaign continues to generate hacktivist activities (including corporate doxxing, DDoS attacks, and social media campaigns - https://lnkd.in/gY8K_aH5 ; https://lnkd.in/g7PJsxV9) ... now is a good time to monitor and observe these tactics because the upcoming US presidential and EU parliamentary elections, as well as prominent social issues such LGBTQ rights, climate change, and immigration, will likely draw activist scrutiny of corporate positions in the coming months.

4

Speeding to Scale: Institutionalizing Defense Innovation Center for a New American Security (CNAS) 10 Jun 2024 The Department of Defense is faced with an increasingly complicated threat landscape where U.S. adversaries are challenging U.S. military superiority. In order to meet the needs of U.S. warfighters, the DoD needs to harness the power of American ingenuity to deliver capabilities on rapid timelines and at the necessary scale. This panel will consider the success the DoD has had to date in harnessing the innovation ecosystem using existing authorities and the challenges that remain.

1