Lokesh Ramani

Thomas Marsland offered me an opportunity to provide an early review of his new book, link below! My Amazon feedback; I'm including it here, as I was more than pleased with how he took such a joyless topic and breathed life into it. "I am not one to blow smoke and told him I'd give genuine feedback... Tom takes a topic as dry as the desert & and gives it life as lush as an oasis. Ok, that might be over the top, but you really can't understand how well Tom has woven in enough personality, so you can truly enjoy reading about this incredibly rigid material. He dissects the Risk Management Framework in a way that facilitates easy digestion and retainment of the material. As an Adjunct Professor of Cybersecurity curriculum, I would absolutely adopt this as required text for several of my courses. Seriously, Tom "break[s] down the framework into easy-to-understand topics..." He doesn't, "go into every detail, or provide every possible way you could implement the framework..." So it gets to the weeds, just not deep in them. I don't know if this will go live with graphics, attachments, or templates (not that it needs them) but there are no images currently in the text (just for those visual learners). But I assure you, Tom nailed it. The right info with just enough detail." https://lnkd.in/eJxu_da6

7

1 Comment

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

⌛ 📺 🔴 2 hours until next the ActiveProspect webinar is live. Today’s topic: Don’t Play the Waiting Game: Strategies for anticipating TCPA updates. Great speakers, great topics. More info and knowledge on how to operationalize the recent #FCC updates and new #TCPA 1:1 Consent Rules.  Covering the moving targets of compliancy laws, usage and compliance implications of TCPA consent language/flow, opt-out alignment (calls/texts) within an organization, and actionable steps for present and future TCPA compliance. 💡Strategies for live transfers and data privacy 💡The moving targets of compliance laws 💡Usage and compliance implications of Generative AI 💡TCPA consent language/flow 💡Opt-out alignment (calls/texts) within an organization 💡Actionable steps for present and future TCPA compliance Speakers: 🎙 Benjamin Farrar, Director of Privacy, Security, & Compliance, ActiveProspect 🎙️ Alysa Hutnik, Partner, Privacy, Information Security, Advertising/Marketing Law, Kelley Drye & Warren LLP 🎙️ Jennifer Wainwright, Senior Associate, Kelley Drye & Warren LLP 🎙️ Michael Peronto, Director of Professional Services, ActiveProspect Register to attend live and to access the recording later. https://lnkd.in/dteUwr4K

11

𝗣𝗿𝗲𝗽𝗮𝗿𝗲𝗱𝗻𝗲𝘀𝘀 𝗶𝘀 𝗸𝗲𝘆 𝗶𝗻 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲. Try this 𝗙𝗶𝘃𝗲 𝐬𝐭𝐞𝐩 𝐜𝐨𝐧𝐭𝐚𝐢𝐧𝐦𝐞𝐧𝐭-𝐟𝐨𝐜𝐮𝐬𝐞𝐝 𝐚𝐩𝐩𝐫𝐨𝐚𝐜𝐡 provided by our Digital Forensics & Incident Response Team. It might just change how you handle cyber threats moving forward. 𝗦𝘁𝗲𝗽 𝟭: 𝗗𝗲𝘁𝗲𝗿𝗺𝗶𝗻𝗲 how critical systems' availability impacts your business operations. Identify any financial implications. 𝗦𝘁𝗲𝗽 𝟮: 𝗘𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵 explicit guidelines on who has authority to make containment decisions and document all key decision points in your incident response plan. 𝗦𝘁𝗲𝗽 𝟯: 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 effective isolation strategies, such as isolating affected systems or using EDR solutions to minimize network traffic while allowing continued investigation. 𝗦𝘁𝗲𝗽 𝟰: 𝗠𝗮𝗶𝗻𝘁𝗮𝗶𝗻 comprehensive documentation throughout the process to ensure every decision and action is recorded for future audit and lessons learned evaluations. 𝗦𝘁𝗲𝗽 𝟱: 𝗥𝗲𝗴𝘂𝗹𝗮𝗿𝗹𝘆 𝗲𝘃𝗮𝗹𝘂𝗮𝘁𝗲 and update your incident response strategies based on post-incident reviews to continuously improve your containment effectiveness. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟭: Pre-define when to isolate or shut down systems to avoid improvisation during a crisis. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟮: Clearly delegate decision-making authority to avoid ambiguity during containment processes. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟯: Keep your documentation precise to streamline post-incident analysis and future incident handling improvements. You can't control the nature of every cyber threat, but you can manage your response by being prepared and organized. Watch the full video → https://lnkd.in/erfxushf ---  ��� I'm a blue team leader and proudly work for SecurIT360, an MSSP focused on cyber protection at every level. Follow, connect and make it tough for bad guys to succeed.

1

Acting ethically, communicating clearly, and being accountable are essential for success as a CISO. I agree with Matthew Rosenquist's advice on how CISOs can avoid legal issues by following these basic principles. https://lnkd.in/gpna8QYf

18

As I was about to sign off yet another long workday, I came across an article on "Ethical Leadership" shared by a colleague. It was indeed a rejuvenating piece to read. Love the encouragements and reminders. All people managers should check it out. My colleague also wrote, “'Nobody writes poems about middle managers.' Well, maybe they should."  Indeed. But there is no shortage of poems in the age of AI, thanks to ChatGPT.   In the heart of our society, a quiet magic brews, In the hands of middle managers, who walk in leaders' shoes. Unsung heroes of our age, their stories seldom told, Yet in their hands, a power great, a future they uphold.   They stand amidst the chaos, where division often reigns, With trust and unity they lead, while bitterness wanes. Invisible glue, they bind us, in a world that's torn apart, Their ethical leadership, a work of humanistic art.   Knowing that moral formation, is part of their role, Like Ted Lasso, they inspire, to make each person whole. Success is not just wins and losses, it's a deeper quest, To help each one become their best, in this, they never rest.   Creating a moral ecology, standards they uphold, Like Jim Lehrer's eye crinkles, a story to be told. In their presence, we learn, how to do our jobs right, Their silent teachings guide us, like a beacon in the night.   Hyperattentive, they observe, with a caring gaze, In their light, we see ourselves, and find our own ways. Their just and loving attention, makes each person bloom, In the garden of their leadership, humanity can assume.   So here's to middle managers, their quiet magic cheers, In their ethical leadership, a better world appears. Their work may seem thankless, their praises seldom sung, But in their hands, our society, into unity is flung. #IamIntel #Ethics #Leadership #ChatGPT #AI

19

My mission: I'm excited to share with you the mission I'm deeply committed to and why it's so close to my heart. Those of you who know me, know of my passion, deep insights, and experience in the military and law enforcement sectors, as well as my C-level and academic commitment to cybersecurity. My mission is clear: To help military and police veterans transition into cybersecurity and information technology careers, and to provide mentoring and coaching services to help them along the way. Why this mission? It stems from my conviction in veterans' tremendous potential. Having worked closely with many veterans, I've seen firsthand their resilience, problem-solving skills, and unwavering dedication. These characteristics make them ideal candidates for employment in cybersecurity and IT, where their distinct viewpoints and experiences are crucial. Choosing this purpose also allows me to give back to those whom I have shared experiences with while we served our country and communities. It is about honouring their contributions and ensuring that they have full, meaningful professions after they have served. This purpose perfectly matches my enthusiasm for cybersecurity and my desire to make a positive difference. By mentoring and coaching veterans, I hope to not only help them succeed in their careers but also contribute to a stronger, more diverse cybersecurity sector. I encourage you to join me on this journey of empowerment and support. Together, we can generate opportunities, promote growth, and make a long-term difference in the lives of veterans and the cybersecurity industry. #EmpoweringVeterans #CybersecurityMission #MentorshipMatters

36

2 Comments

National Institute of Standards and Technology (NIST) released Special Publication 800-229, Fiscal Year (FY) 2023 Cybersecurity and Privacy Annual Report. This publication shares key highlights of our major cybersecurity and privacy accomplishments as we wrapped up our celebration of NIST’s 50 years of work in the cybersecurity arena; all in the linked report and a few noted below: - Key part of the National Cybersecurity Strategy and the related Implementation Plan. - Created the Phish Scale, a revolutionary tool to rate socially engineered email attacks to strengthen an organization’s security posture. - Published draft revisions of all four volumes of SP 800-63-4, Digital Identity Guidelines, to advance modern digital identity controls. - Continued the Journey to Cybersecurity Framework (CSF) 2.0 by releasing a CSF 2.0 Concept Paper, publishing a discussion draft of the CSF 2.0 Core, and issuing a draft CSF 2.0 with Core Implementation examples. Additionally, NIST published an analysis of comments received on each draft - Continued to lead and support community engagement on cybersecurity supply chain risk management through the Software and Supply Chain Assurance (SSCA) Forum. - Issued a working draft of the SP 800-55 Rev. 2, Performance Measurement Guide for Information Security. - Launched the Cybersecurity & Privacy Reference Tool (CPRT). - Continued the development of the Open Security Controls Assessment Language (OSCAL). #NISTCSF #RiskNeverSleeps https://lnkd.in/dRh7uknd

16

1 Comment

Consumer Data Privacy is poised for a transformation with the introduction of the American Privacy Rights Act (#APRA). This bipartisan bill aims to create a uniform privacy framework, reduce data collection, improve consumer consent, provide for better opt-out options and boost privacy protection enforcement. More on the APRA's impact on #DataPrivacy: https://okt.to/T8YOLA Makenzie Holland #DataProtection #Cybersecurity

4

This is the kind of effort we need to really tackle vulnerability management with a proper effort around accurate prioritizations. This effort is aimed at bringing “Common Platform Enumeration, Common Vulnerability Scoring System, Common Weakness Enumeration, and Known Exploited Vulnerabilities to CVEs” together, including a pass through an SSVC decision tree. I am beyond excited to see such an effort and yet I remain concerned that without the required support and adoption by our vendors, this will merely represent another data point we cannot easily normalize with our tools. #VulnerabilityManagement #Security #BlueTeam

15

Earlier this week, the National Institute of Standards and Technology (NIST) issued interim guidance for agencies seeking to make use of ‘syncable authenticators’ (for example, passkeys) in both enterprise-facing and public-facing use cases. What does this mean? Essentially, NIST is saying that it is acceptable to use a passkey that can be shared across multiple devices as way to meet AAL2 standards for authentication. NIST acknowledges the risk that come along with syncable authenticators, many of which we spelled out in a blog post a while ago (see here - https://lnkd.in/eiDMtNtt): - How to securely store, transmit and protect the keys - How to ensure that the keys are used by the authorized person - How to implement strong authentication in shared device scenarios The challenge becomes really obvious when you look at the definition of AAL2 with the updated definition: 1. "To meet AAL2 requirements, the syncable authenticator SHALL make use of a local authentication event to unlock the locally stored key or SHALL be used with another authenticator (e.g., a user-selected password) if no local authentication mechanism is available." So essentially, you can either unlock the key with a local authenticator (implying a biometric) or with a password. What do you think the fraudsters are going to do? 2. "Private keys stored in cloud-based accounts SHALL be protected by access control mechanisms such that only the authenticated user can access their private keys in the sync fabric." Cloud-based accounts today are also primarily protected by passwords. So again I ask, what do you think the fraudsters are going to do? We built Anonybit to handle this scenario exactly. The decentralized data vault can securely store the passkey. The passkey will then get bound to the user's biometric in the decentralized cloud. To retrieve the passkey, the user needs to authenticate themselves with the biometric. This solution ensures that only the authorized person can retrieve and use the passkey. No more tradeoffs between privacy and security. Have your cake and eat it too. DM me to see it in action. #passkeys #fido2 #authentication #passwordlessauthentication #identitymanagement #innovation #datavault #decentralizedbiometrics #enterprisesecurity https://lnkd.in/e3de-DK7

30

2 Comments

Let’s shift from reacting to proacting! Teams are grappling with scattered risks and complex platforms, which is no longer sustainable. The Hacker News highlighted the importance of a proactive approach to tackle dormant risks before they escalate. Combining security practices from various frameworks is key. In a recent discussion with This Week Health, we delved into risk unification and overcoming challenges to enhance organizational foresight. Are you and your team also navigating this terrain? Let’s connect. #intraprisehealth #229cyber #thisweekhealth #riskunification #cyberhealth #informationsecurity #riskmanagement The Hacker News Article: https://lnkd.in/e77iKYAM https://lnkd.in/ehs5KkRz

10

1 Comment

Clause 6 of ISO 42001 is essential for compliance executives to effectively manage risks and opportunities in AI systems. Here are my thoughts on the key requirements and how to address them: 1. Address Risks and Opportunities (6.1)   - Identify AI risks and opportunities considering internal and external factors (6.1.1)   - Establish AI risk criteria to assess and prioritize risks (6.1.1)   - Conduct AI risk assessments to identify, analyze, and evaluate risks (6.1.2)   - Perform AI system impact assessments to evaluate potential consequences on individuals, groups, and societies (6.1.4)   - Develop AI risk treatment plans to mitigate identified risks (6.1.3) To comply, integrate AI risk management into your overall risk framework. Establish processes for regular AI risk and impact assessments, and document and implement risk treatment plans based on the results. 2. Set AI Objectives and Plan (6.2)   - Define measurable AI objectives that align with your AI policy and support organizational goals   - Determine resources, responsibilities, and timelines for achieving AI objectives To meet these requirements, collaborate with stakeholders to set specific, measurable, achievable, relevant, and time-bound (SMART) AI objectives. Allocate necessary resources and assign clear responsibilities for achieving these objectives. 3. Plan Changes (6.3)   - Ensure changes to the AI Management System (AIMS) are carried out in a planned and controlled manner Establish a robust change management process for the AIMS. This should include impact assessments, communication protocols, and documentation requirements to minimize disruptions and maintain the integrity of your AI governance framework. 💡 Key Takeaways 1. Adopting a risk-based approach is crucial for effective AI governance. Regular AI risk and impact assessments help prioritize mitigation efforts and allocate resources appropriately. 2. Aligning AI objectives with your AI policy and organizational goals ensures that AI initiatives are strategically focused and contribute to overall business success. 3. Managing changes to the AIMS in a controlled manner is essential to maintain the integrity and effectiveness of your AI governance framework. 🚀 Next Steps - Integrate AI risk management into your existing risk framework to ensure a comprehensive approach to risk governance. - Work with relevant stakeholders to define clear and measurable AI objectives that support your organization's strategic goals. - Develop a well-defined change management process for the AIMS, including impact assessments, communication protocols, and documentation requirements. By focusing on these key aspects of Clause 6, you can establish a strong foundation for responsible AI deployment and ensure compliance with ISO 42001 requirements. Proactive planning and risk management are essential for the long-term success of your AI initiatives. #ISO42001 #AIGovernance A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

11

On June 18, 2024, the SEC charged R.R. Donnelley & Sons Company (RRD) for failing to maintain adequate internal accounting controls and disclosure controls. These charges violate Section 13(b)(2)(B) of the Securities Exchange Act of 1934. RRD settled with a $2.125M civil penalty due to inadequate policies that led to a ransomware attack, resulting in data encryption, data exfiltration, and business disruptions. Two SEC Commissioners dissented about the SEC's approach. This action is the second time the SEC has used Section 13(b)(2)(B) to fault a company after a cyberattack. The first action against SolarWinds Corporation is under litigation in the Southern District of New York. The SEC's broad interpretation of its jurisdiction is being challenged. Two Commissioners criticized the SEC’s use of Section 13(b)(2)(B) to enforce cybersecurity policies. They argue that the SEC is overreaching by using unrelated statutes to mandate cybersecurity controls. The criticisms are like those against the FTC's use of Section 5 of the FTC Act to require cybersecurity measures not explicitly covered by the statute.  The SEC's actions have significant ramifications for companies dealing with cybersecurity breaches. The broad interpretation suggests that companies' information systems are assets, and unauthorized access could lead to SEC violations. This interpretation may regulate public companies' cybersecurity practices. The dissenters argue that internal accounting controls should not extend to broader administrative controls. The SolarWinds case challenges the SEC's interpretation of its jurisdiction under Section 13(b)(2)(B). The outcome may influence whether the SEC can penalize companies victimized by cybercrime. #cybersecurity #SEC #regulation

12

4 Comments

🚀 Navigating ISO42001 AIMS Controls: Your Roadmap to Controls Implementation 🚀 As compliance executives, implementing ISO42001 AIMS controls can be a daunting task. Below are my thoughts on how to incrementally select, design, and then implement controls for your AIMS. 1️⃣ Identify Standards & Conduct Risk Assessments: Start by understanding the specific ISO42001 requirements applicable to your AI systems. Conduct a detailed risk assessment to uncover potential vulnerabilities and threats. For instance, if your AI handles sensitive data, focus on controls that address data privacy and security risks. 2️⃣ Design Tailored Solutions: Design controls that are tailored to the risks you’ve identified. Ensure these controls not only comply with legal and ethical standards but are also practical for your daily operations. Engage stakeholders from various departments—like IT, legal, and operations—to gather a variety of insights that ensure comprehensive coverage. For example, if your risk assessment highlights a potential for data breaches, you might design an AI control that includes both encryption of data at rest and rigorous access controls. 3️⃣ Implement Controls "Smoothly": Integrate these controls seamlessly into your existing business and IT processes. Before full implementation, pilot these controls in a controlled/dev environment to iron out any issues. Comprehensive training for all users is critical to ensure smooth adoption. For example, after introducing a new AI monitoring tool, conduct training sessions to help your staff understand how to use the tool effectively and recognize signs of system anomalies. 4️⃣ Monitor, Document, and Adjust: Maintain detailed documentation of all AI controls, their implementation processes, and their effectiveness. Regular monitoring is vital — set up dashboards that track compliance in real-time and alert you to any deviations if you aren’t using a platform like Vanta or Drata. Regularly review and refine your new controls to adapt to new technological developments or changes in regulatory requirements. For instance, if a new data protection regulation is passed, review your AI data handling controls to ensure they remain compliant across geographies. 🌐 Interested in a deeper dive or specific examples tailored to your industry? Connect with me for a personalized discussion on optimizing your ISO42001 AIMS implementation!  #AICompliance #AIManagement #ISO42001 #Cybersecurity A-LIGN #iso42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

5

Yesterday, the National Institute of Standards and Technology (NIST) released a draft publication that was announced by the Department of Commerce on new actions to implement President Biden’s Executive Order on AI. This is a significant step towards regulating AI in an ethical and responsible way. It is essential to ensure the safety and privacy of individuals while also promoting innovation. The publication identifies 12 major risks posed by generative AI and outlines 400 potential actions/controls organizations can take to mitigate those risks throughout the AI lifecycle.  The risks cover specific areas like biosecurity threats, generation of misinformation, privacy violations, environmental impacts, unsafe recommendations, intellectual property concerns, and perpetuation of biases/toxicity. The profile provides a tailored framework to help organizations assess and manage generative AI risks based on their specific use cases and risk tolerances. #airegulation #ethicalAI #genai #knowledgesharing #Anthropic #OpenAI

2

UnitedHealth Group just filed its second Form 8-K/A on its material #cybersecurity incident. It references this Press Release that was recently filed. Observation wise, they do cover a range of material ASPECTS of the incident in the PR, including remediation status with detail of specific services restored, e.g., claims, eligibility systems, pharmacy services, payment processing. Also they disclose a small amount of patient PII and PHI was released on the dark web and a nice new website where you can go to talk to someone and feel much better about the incident. But disclosure remains very light on the far ranging and long-tail "material" IMPACTS or reasonable likely MATERIAL impacts of the incident. With news reports of this closing in on $2BN in costs, announced negative .74 per share earnings impact, a "substantial portion" of Americans impacted, far reaching third-party impacts, tons of liability and litigation coming, etc. it would seem like the story on the material FALLOUT related to the incident is still light on detail. This is consistent with my other observations of 8-K #cybersecurity disclosures. Companies are not complying with the new SEC disclosure rules when it comes to describing material IMPACTS. Precisely what the SEC wants the focus of the new disclosure rules to be. We'll be talking about this at #DOMINO24 in 3 weeks. Join us. https://lnkd.in/gruJ5-zR

32

14 Comments

Digital transformation accelerated during the pandemic, leading to a proliferation of applications and APIs. Watch Nanhi Singh's interview with Techstrong TV to learn about the changing application security landscape and ways that Imperva is innovating to protect customers. #TeamImperva #ApplicationSecurity #CyberSecurity #APIsecurity

16