Joyce Brocaglia

“On June 13, 2024, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act (SB 2500 / HB 7787). The act will now move to Governor Daniel McKee for consideration. Assuming the act becomes law, it will go into effect on January 1, 2026.” https://gag.gl/Iw9AP9 Kiteworks helps organizations comply with data privacy regulations like GDPR and CCPA by enabling visibility into where customer data is stored, who has access to it, and what's being done with it. Please visit our website to learn more. #cybersecurity #kiteworks #cyberattack #databreach #dataprotection #datasecurity

2

Living in New England, with its long and gray winters, my vegetable garden is a delightful summer highlight,  and a significant source of stress relief and enjoyment. However, much like our enterprise’s information assets, the garden represents an attractive target for malicious actors. Alas, I have to defend myself against the neighborhood assortment of critters: rabbits, squirrels, birds, raccoons, and the occasional possum or woodchuck. These hungry and decidedly malicious creatures have a variety of Tactics, Techniques, and Procedures which must be thwarted through a collection of defense mechanisms that include physical, chemical, visual, and auditory. (I have not yet escalated to kinetic or electrical defense mechanisms, although I haven’t completely ruled them out). My garden security is a decidedly imperfect defense, and I accept a certain level of breach as acceptable. For example, I have a three-foot metal mesh fence surrounding it; this keeps the rabbits out, but not the birds or squirrels. I could do better with a more robust fence, but for me it wouldn’t be worth the investment. Plus, some of the more skilled and determined (but luckily infrequent) visitors – I’m looking at you, woodchucks – could breach pretty much any defense I could deploy. Fortunately for me, at worst a garden breach will result in disappointment and minor infrastructure damage. This decidedly not the case for our enterprise IT environments. Our businesses are fully dependent on IT to operate, and a successful attack can result in significant or even existential damages to an enterprise, as well as potential civil and even criminal charges. Information security leaders need to internalize this, and create an appropriate sense of urgency within their organizations. The stakes are too high, and our landscape is too dangerous not to rapidly adopt best practices – as defined and combined within Zero Trust – throughout the enterprise. This is going to take some work, and require more rigor in our enterprises. Frankly, it’s time to improve our enterprise security maturity, and to clearly define the set of processes surrounding it. For example, security teams should not accept a lack of visibility into what is running on their network – this is a prerequisite for enforcing the principle of least privilege, and thwarting attackers via effective access control policies. I fully understand the challenges that enterprises face, including technical debt, resources constraints, and decades of organically grown enterprise network complexity. However, a Zero Trust strategy provides a clear and effective path forward, and when executed well delivers rapid and incremental improvements to the enterprise. It’s time for security leaders to assert themselves, and demand that their organizations properly organize and deploy defensive mechanisms. We know how to do this effectively – Zero Trust provides us with this guidance – and now it’s time to execute.

23

3 Comments

New Hampshire throws a curveball: Are you ready for the NH Data Privacy Act? The New Hampshire Data Privacy Act (NHDPA) is here, and it brings some unique challenges for businesses across industries. Don't get caught off guard! LightBeam.ai dives deep into the NHDPA in our latest blog post: 👉 Key provisions you need to know 👉 What it means for your data management strategy 👉 Practical steps to ensure compliance Click here to get ahead of the curve: https://bit.ly/4dE3a6o #NHDPA #dataprivacy #compliance #cybersecurity

31

1 Comment

🚨 Join cybersecurity experts Bryan Hornung, Reginald Andre, and Randy Bryan in this week’s episode of Security Squawk! 🚨 We'll be discussing the latest ransomware incidents affecting Ascension, Montclair, NJ, and Wichita, KS. Learn about the rise of Ransomware-as-a-Service (RaaS) and dive into CISA’s recent advisory on this growing threat. Discover how implementing Zero Trust Architecture and investing in cyber insurance can protect your organization. Stay informed about the emerging cyber threats of 2024 and gain insights into proactive measures to safeguard your systems. Don’t miss this crucial discussion on protecting your business from cyber attacks. 📅 Tune in live and join the conversation! #SecuritySquawk #CyberSecurity #Ransomware #ZeroTrust #CyberInsurance #LiveStream

11

🚀 Driving Innovation in Cybersecurity with NYC Economic Development Corporation 🛡️ New York City is at the forefront of the cybersecurity industry, thanks to the efforts of the NYC Economic Development Corporation (EDC). EDC is committed to fostering innovation, supporting startups, and creating a robust cybersecurity ecosystem in the city. Key initiatives by NYC EDC include: • Supporting cybersecurity startups and entrepreneurs • Developing cutting-edge cybersecurity technologies • Promoting industry partnerships and collaborations • Enhancing workforce development through training and education programs By nurturing a vibrant cybersecurity industry, NYC EDC is ensuring that New York City remains a global leader in digital security and innovation. Learn more about how NYC EDC is shaping the future of cybersecurity: https://lnkd.in/eUz-Pu6y Join us in supporting these efforts and contributing to a safer, more secure digital landscape. #Cybersecurity #NYCEDC #Innovation #TechStartups #DigitalSecurity #NYC

2

I loved how this article brought forth the strategic advantages enabled by collaboration between seemingly disparate elements of a business. Taking an approach to culture and development that sees goals as congruent and multi-faceted leads to better outcomes for all involved parties. Leaders everywhere can improve their outcomes by collaborating closer with other executives in similar situations. #Cybersecurity #Innovation #Diversity

2

Governor Josh Shapiro's recent signing of PA Senate Bill 824, which amends the Breach of Personal Information Notification Act, lowers the threshold for mandatory notification to the state attorney general from 1,000 to 500 state residents affected by a data breach. Changing the lower limit by 500 isn't dramatic, but it is a reminder that for local PA governments to meet the requirement, they must have a breach response plan with active data monitoring and ongoing auditing in place. Just as importantly, executive leadership needs to encourage and support a culture where potential breaches are reported immediately (e.g., lost laptop, inadvertently emailed file with PII). My experience is that a HIPAA and/or CJIS committee, if led by top-level executive sponsors, can motivate all stakeholders to invest in routine compliance audits and address cybersecurity and data privacy gaps (on an ongoing basis). The update to the Act is designed to improve the protection of residents' personal information and enhance public trust in the local government's ability to manage data breaches effectively. However, this can only be achieved through organized effort and with leadership from the top of local government. #cybersecurity #dataprivacy #localgov https://lnkd.in/e6bBJKX8

15

Cybersecurity assessments your business can rely on for real answers and real results. Contact Dox at doxnet.com or call (585) 473-7766. #Cybersecurity #Assessments #Dox

1

If you're a financial institution in NY subject to regulation by the NYS Department of Financial Services - this is for you! Are you aware of the sweeping amendments to the NY CRR 500 Cybersecurity legislation passed late last year? I brings a large amount of clarity to what the state is expecting companies to do in regards to cybersecurity programs, monitoring, and reporting. It's one of the first laws that REQUIRES MFA, Encryption at Rest, Event Monitoring and other advanced platform capabilities. If you have Salesforce we can help! We wrote this comprehensive white paper which breaks down the law piece by piece to help understand how to tackle this big piece of legislation. Check it out at the link below, and send me a message if you'd like to catch up and discuss. We have a lot of experience helping companies attain their desired level of compliance with laws such as this. https://lnkd.in/gcyVSTEM

12

1 Comment

Imperial Security Bureau Podcast 2 with Keyaan Williams, Managing Director of CLASS-LLC Great conversation folks! Keyaan is very knowledgeable in the cybersecurity strategy and GRC space. Follow for more interviews with leaders in Cybersecurity. Timestamps: 2:02 - How he was named "Funniest Man in Cybersecurity"? 3:48 - Favorite Star Wars Movie 6:11 - How he landed in Cybersecurity 8:50 - How he manages his time 10:40 - 502 Project Panel Discussions and Webinars 13:30 - Biggest challenges facing the cybersecurity industry 18:59 - Buying cyber insurance versus investing in cybersecurity 24:00 - Keyaan's go-to sources of information 26:23 - How AI will disrupt the industy 30:29 - Biggest problem with AI (spoiler alert = bias) 34:15 - EU AI Act 35:34 - Project Cerebellum 37:04 - Keyaan's ideal cybersecurity team 40:00 - Advice on breaking into cybersecurity careers 44:52 - How to be successful in the profession 47:05 - Dealing with the stress of the job 50:21 - If we were neighbors, we'd be boys 51:20 - What he is most excited about in cybersecurity 55:04 - Where he can be found 56:15 - Final thoughts from Keyaan (read Linchpin by Seth Godin) What was your favorite part? Oh yeah - let me give credit the band Galactic Empire for the intro/outro song "Star Wars Main Theme" #cybersecurity #GRC #cybersecuritygovernance #AIgovernance #cybersecuritystrategy #cybersecurityriskmanagement FOR JOB SEEKERS: I offer a 45 minute consultation for $250 which includes a resume & LinkedIn profile review, career positioning & job search advice, and elevator pitch refinement. Afterward the meeting you'll receive an updated resume in word and PDF format, directions on updating your LinkedIn profile section by section, and a custom LinkedIn banner to upload. Use this calendar link to schedule a consultation: https://lnkd.in/ed2K9jmV FOR HIRING MANAGERS: I'm actively seeking new job orders to work on. If you need recruiting support, fill out a New Job Order Search Request Form: https://lnkd.in/e756wJwr I'll review and get back to you ASAP if it's something I can help with. Watch on YouTube:

12

Bob Zukis, as always, thank you and the Digital Directors Network team for being on top of these breaking (and obvious/inevitable) developments about C-suite responsibility and board oversight of cybersecurity. Senator Wyden's letter to the FTC and SEC underscores these responsibility and oversight failures. To me, some of the most striking comments are: 😷 "I write to request that your agencies investigate UnitedHealth Group’s (UHG) negligent cybersecurity practices, which caused substantial harm to consumers, investors, the health care industry, and U.S. national security." 😷 "This incident and the harm that it caused was, like so many other security breaches, completely preventable and the direct result of corporate negligence." 😷 "The consequences of UHG’s apparent decision to waive its MFA policy for servers running older software are now painfully clear. But UHG’s leadership should have known, long before the incident, that this was a bad idea." 😷 "While UHG has not yet made public the full details of this incident, UHG’s failure to require MFA is unlikely to be the company’s only cybersecurity lapse." 😷 "Such a failure to adopt a resilient technology architecture [cloud] demonstrates a total failure by the company to plan for and mitigate the clear, obvious risk posed by ransomware." 😷 "One likely reason for UHG’s negligence, and the company’s failure to adopt industry-standard cyber defenses, is that the company’s top cybersecurity official appears to be unqualified for the job. Steven Martin, UHG’s chief information security officer (CISO), had not worked in a fulltime cybersecurity role before he was elevated to the top cybersecurity position at UHG in June, 2023, after working in other roles at UHG and Change Healthcare." 😷 "Just as a heart surgeon should not be hired to perform brain surgery, the head of cybersecurity for the largest health care company in the world should not be someone’s first cybersecurity job." 😷 "Due to his apparent lack of prior experience in cybersecurity, it would be unfair to scapegoat Mr. Martin for UHG’s cybersecurity lapses. Instead, UHG’s CEO and the company’s board of directors should be held responsible for elevating someone without the necessary experience to such an important role in the company, as well as for the company’s failure to adopt basic cyber defenses." 😷 "One likely explanation for this board-level oversight failure is that none of the board members have any meaningful cybersecurity expertise." 😷 "The cyberattack against UHG could have been prevented had UHG followed industry best practices."

4

1 Comment

Nothing beats meeting colleagues, customers, suppliers and partners in person at the Health-ISAC Spring Summit. It has been great to catch up with friends in healthcare and cybersecurity. Below is a free disaster recovery plan template for healthcare companies. Healthcare organizations handle sensitive data every day, making their IT systems critical fortresses that must withstand disruptive events. The recent article, "Disaster Recovery in Healthcare: Free Plan Template and Overview," highlights a crucial reality: being unprepared is not an option. The article offers a valuable resource: a free disaster recovery plan template specifically designed for healthcare institutions. This tool can significantly reduce risks and ensure continuity of care, even during chaotic times. I fully support the article's message. With my experience across the US Military, Government, and Private Sector, I've seen firsthand the importance of preparedness, especially in healthcare. This article not only emphasizes the need for a disaster recovery plan but also provides a practical starting point for organizations that may be starting from scratch. For healthcare providers, protecting patient data is as important as patient health. The consequences of neglecting these responsibilities are too serious to overlook. Let this be your motivation to ensure your disaster recovery strategies are as resilient as the care you provide. https://lnkd.in/emfqtCPC

15

1 Comment

Email phishing attacks are getting more sophisticated, but protecting your business can be simple. Here are five tips to keep your inbox—and your business—secure: 🖱️ Think Before You Click: If an email looks suspicious, don’t click on any links or download attachments. Take a moment to verify the sender first. 🔐 Enable Multi-Factor Authentication (MFA): Adding an extra layer of security to your accounts makes it harder for hackers to gain access, even if they have your password. 🎓 Educate Your Team: Regular training on how to spot phishing emails can make all the difference. Awareness is your first line of defense. 💪🏼 Use Strong, Unique Passwords: Encourage your team to use complex passwords and update them regularly. Consider a password manager to keep things organized. 💾 Keep Software Updated: Regular updates ensure your security tools are equipped to handle the latest threats. Make it a priority to keep all software current. Taking these simple steps can go a long way in protecting your business from phishing attacks. Take the first step in securing your business today! Follow this link to Book a FREE cybersecurity consultation with us: https://www.oramca.com/ #OramCybersecurityAdvisors #CyberAttack #SlowComputer #CyberSecurity #ComputerBreach #DataBreach

10

1 Comment