Venkat Raghavan

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

185

1 Comment

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

Transcending CVEs and Leveraging Environmental Variables - part three of my seven-part series on optimizing your vulnerability and exposure management strategy. https://lnkd.in/g5dRkKwz Sevco Security #VulnerabilityManagement #ExposureManagement #CAASM

14

RSA 2024 Takeaway: AI or Die 🥵 Met dozens of CISOs, execs & founders at RSA this week. Quick observations: 1️⃣ Every vendor is AI-fying their pitch. They're leveraging AI/LLMs for various use cases - threat intelligence, SOC automation & more. Impressed by Google Cloud, CrowdStrike & Microsoft Azure security offerings with lots of LLM-powered automation across their stack 🤖 2️⃣ The other side of AI adoption? Security / Compliance / Safety. Many pitches around securing AI systems & data. AI safety will be a hot topic for a while. Congrats to Reality Defender Ben Colman for winning the RSA Conference Innovation Sandbox 👏 3️⃣ Enterprises are shifting towards unified security stacks driven by cost, simplicity & agility needs - EDR + ASPM + CNAPP + SIEM +...all-in-one. This'll trigger a new wave of acquisitions by major players like CrowdStrike, Palo Alto Networks, Zscaler, Wiz, SentinelOne. While there are many innovative exciting startups, I'm afraid most exits may be below $500M. 4️⃣ Critical infrastructure security is gaining more attention due to rising geopolitical threats. This is an urgent national security matter. I'm super proud to be an early investor in Eclypsium, Inc.. They are the MOST innovative critical infrastructure security platform for enterprises. 💪 (cc Yuriy Bulygin Alex Bazhaniuk) 5️⃣ Identity is the new perimeter. Loads of innovation here. A non-human identity layer is emerging rapidly. Cerby showcased many exciting product updates to secure new vulnerabilities in the identity stack. Watch this space 👀 Share if I miss others. #RSAC2024 #cybersecurity #IAM #EDR #SIEM #CNAPP #ASPM #criticalinfrastructure #supplychainsecurity #ai #ml #llm #largelanguagemodels

79

10 Comments

CISOs - please don't squander your earned trust on dubious purchasing decisions. I cannot verify the veracity of this article, but even the mere premise of CISOs receiving kickbacks for their security product purchases is deeply disturbing. As a profession, we have worked too hard to earn trust and credibility, and can't have our decisions second-guessed. If you are doing this, then please stop. Say no to kickbacks and declare any conflict of interests / recuse yourself from any purchasing decisions 🙏🏼 https://lnkd.in/gXgfkvd3

5

In the last couple of years, we have shaped the GRC domain to reach higher standards at Fireblocks. Governance, Risk, and Compliance group provides critical infrastructure to manage risk, ensure compliance, and guide organizations toward achieving their strategic objectives while maintaining ethical standards and operational efficiency. At Fireblocks, complying with the highest cybersecurity standards and defenses is paramount. Being a leader in the crypto industry requires leading in the standards landscape. This is why Fireblocks is the first company to have a Crypto Currency Security Standard certification, adapt NIST and multiple ISO frameworks, manage risks according to the "Three Lines of Defense" approach, TPRM policy (for both apps and open-source), and conduct continues training and awareness program. In essence, building a strong cybersecurity framework requires an integrated approach that combines technology, policy, and people. For more information on the "Three Lines of Defense," see an explanation of the model below. #CybersecurityAwareness #ResilientOrganizations #SecureDigitalAssets #FireblocksGRC

87

4 Comments

Pssssst-NISsssssT - are you ready for the future because it is here now? #NIST is close to making one of their most #monumental announcements in decades. #Cybersecurity is at the precipice of a global game changing moment. A critically relevant #quantum computer (#CRQC) is nearly upon us and QuSecure is the leading company that can help #protect you and your #data. Reach out to QuSecure to learn more about how you can be prepared with our QuProtect #PQC #crypto agile software today. https://lnkd.in/gpdXmmBJ.

22

SaaS DLP is important. Checkout the recent case at Disney. Metomic can help avoiding this risk. "Claims state that Nullbulge accessed Disney's Slack server and collected information about the company's upcoming projects, including concept art for Disney games. These reports also suggest that login details and personal details of workers were gathered." #SaaS #cybersecurity #dlp #slack

19

Vulnerability detection software tends to either hurt application performance or fall short in accuracy. With Datadog Code Security, you get a production-ready, IAST-based solution that has earned a 100% score in the OWASP Benchmark test. Read more: https://lnkd.in/g9Cphz9N

99

1 Comment

And the news keeps coming for BreachRx... Welcome to the team, Joe Sullivan! https://lnkd.in/eSRpjE4z "Joining BreachRx is a natural extension of his work, he said, since the company automates the process of documenting organizations' incident responses in the first hours and days." "We're in a broken place," Sullivan said. "The people who are the most intelligent about how to navigate us out of this are handcuffed by fear because they think the regulators are going to come after them." "The way Sullivan sees it, security chiefs have become accustomed to a corporate reality that doesn't provide them with the funds or employees needed to properly secure their systems." Enter, BreachRx. "The growing regulatory pressure on all executives, not just security chiefs, to clean up poor internal practices could force companies to invest more in security and help CISOs in the long run." #incidentresponse

5

Another amazing discussion on #thirdpartyrisk challenges at Evanta, a Gartner Company CISO summit - this time with Bay Area CISO's and cybersecurity leaders. Houston or the Bay Area, ONG or Technology businesses - these CISO discussions are making it clear that gaps and challenges of current #thirdpartyrisk programs are being felt across the board. Reach out to learn more about how Dataminr's approach to #AI for external #threat detection can have a significant positive impact on strategic #cyber priorities. #EvantaCISO #Thirdpartyrisk #Cybersecurity #CISO Taylor Chaffey Sam Flaherty

85

1 Comment

Today, we announced our Series C funding and unveiled Zero Trust PAM to the world. Founded in Zero Trust principles and engineered to evaluate and govern every action—no matter how minor—PAM has been remade. Each command, query, or configuration change is evaluated in real time against dynamic policies that adapt to the context of the user, the sensitivity of the action, and the prevailing threat landscape. And that, my friends, is the future of PAM. It's a future we feel extremely bullish about. And we're not the only ones. With the support of our partners, StrongDM is taking Zero Trust PAM to a global scale with massive expansions in EMEA and APAC in 2024. First, thank you to our powerhouse investment partners Anchor Capital GP, Capital One Ventures, Cisco Investments, Frontline Ventures, Singtel Innov8, GV (Google Ventures), Sequoia Capital, and True Ventures. Now, let's get to work. May the best PAM win. Read about our Series C funding, global expansion plans, and Zero Trust PAM: https://bit.ly/4a813oy #ZeroTrust #PAM #identity #infosec #startups StrongDM

210

35 Comments

⚠ Feedback Request - ISO42001 Role Determination Guide⚠ We're continually working to find better ways to help you understand how to effectively determine the role your organizations play in the AI ecosystem, a critical component in defining your organizational context. Though I will always recommend you partner with and advisory/readiness firm, I also want to be sure we're doing what we can to educate. The more you know, the better prepared you'll be and the higher the likelihood you'll create a governance and compliance program aligned to you. That said, I've been testing a set of abstracted questions intended to help you "more easily" decide what your organizational role should be for purposes of architecting your AIMS. 🔶 My ask: Would you be open to providing feedback about which of these formats (visual or written) works best? Also, honoring the balance of brevity and completeness, should we be asking different questions, or asking these questions in a different way? Option 1 - Written: ◽ Do you create or design AI systems? ▶ Explanation: If you are involved in the design and development of AI models or algorithms, you fall under the category of an AI Developer. Reference: ISO/IEC 22989 defines an AI Developer as an organization or entity concerned with the development of AI services and products, including roles like Model Designer and Model Implementer . ◽ Are you responsible for deploying AI systems into operational environments? ▶ Explanation: If you manage the setup, implementation, and maintenance of AI systems, you are considered an AI Producer. Reference: An AI Producer is defined as an entity that designs, develops, tests, and deploys products or services using AI systems . ◽ Do you use AI systems as part of your daily operations or decision-making processes? ▶ Explanation: If you utilize AI tools and systems in your work, such as using AI for data analysis or automation, you are an AI User. Reference: An AI User is an organization or entity that uses AI products or services . ◽ Do you handle data collection, preparation, or annotation for AI training? ▶ Explanation: If your role involves managing the data lifecycle for AI, including ensuring data quality and provenance, you may overlap between an AI Developer and AI Producer. Reference: Data management activities are critical in both developing AI models (AI Developer) and deploying them (AI Producer) . ◽ Are you involved in setting policies, standards, or compliance requirements for AI use? ▶ Explanation: If you establish governance frameworks, assess risks, and ensure ethical AI practices, you support roles across AI development, production, and usage. Reference: Governance roles involve creating and enforcing policies that impact all stages of the AI lifecycle . Option 2 - Visual: Included in the attached image As always, if you need help or have questions, please don't hesitate to reach out. A-LIGN #ISO42001 #ComplianceAlignedtoYou #TheBusinessOfCompliance

28

10 Comments

Join our very own Dave Johnson on May 1st for a panel discussion "Transforming Threat Hunting with Generative AI”. The panel will include threat experts Sven Krasser at CrowdStrike, John Fokker at Trellix, Prasanth Ganesan at System Two Security, and Rafael Angelo (Raffy) Martin at ConnectWise who will moderate this discussion. Threat hunting has emerged as a critical piece of enterprise cybersecurity for actively discovering new unknown threats. Generative AI is driving innovation to threat hunting by enabling threat hunters to reason over near real-time security research using pre-trained language models and detect, identify and contain new threats within minutes with minimal human intervention. RSVP link in the comments👇 #GenerativeAI #LLM #ThreatHunting #Cybersecurity #CTI #SOC #MSSP #MDR #XDR #SIEM

30

5 Comments

really liked the takeaways SeeMetrics distilled from this, esp about consensus security metrics still being unsettled as the technology, threats, and understanding levels are changing very quickly. https://lnkd.in/gZrxbsWQ

20

1 Comment

This graphic I did on the DSPM market is starting to get out of hand! News of another acquisition in this market broke late last week, with Tenable announcing its acquisition of Eureka Security. Here are a few highlights and takeaways for Tenable and the DSPM market: → Tenable is all in on cloud security and CNAPP The message in the transaction announcement was loud and clear — Tenable is serious about its cloud security strategy. Data security was the next piece of the puzzle. The build vs. buy decision here looks pretty straightforward. Data security is a new area for Tenable, so acquiring a product and team with expertise is strategic. There were still high quality early stage targets in the market. The best decision was to buy if they could get the price they wanted. → We've had over $1 billion in DSPM financing and M&A activity Data security companies are well over $500 million in total venture capital raised. With Eureka Security, we've also had 5+ total acquisitions for a cumulative value of $1B+ (some disclosed, and me roughly estimating transaction values for the rest). DSPM has easily been one of the most active markets in the industry, and the race is far from over. → What's going to happen with the rest of the market? Cyera raised a $300 million round earlier this year at a $1.4 billion valuation, so they're playing the long game. Palo Alto Networks, CrowdStrike, IBM, Rubrik, and now Tenable have all done deals already. And Varonis just keeps doing what they do best — building a solid data security platform and scaling their business as a public company, including 17% YoY ARR growth last quarter. --- There are still high quality early stage companies who could raise capital or become acquisition targets yet this year, including several we didn't have on this graphic. We're also going to start seeing which of the strategic buyers emerge as leaders after integrating the product and GTM components of their acquisitions. This was a statement move by Tenable and a clear signal to the industry that they're more than just another vulnerability management company. Congratulations to Eureka, Tenable, and the Altitude Cyber team on a great deal.

208

26 Comments

If you're curious about how NodeZero is setting new standards in cybersecurity, I highly recommend reading this insightful discussion from Cyber Defense Magazine!

4