The supply chain is a complex environment that goes deep inside a business and involves the majority of its infrastructure, operations, personnel, and outer relations: vendors, partners, and customers. To protect that matrix is extremely difficult, as there are numerous sensitive nodes, lines, and processes that a security team has to take care of: software and hardware resources, cloud, hybrid and local environments, platforms, and web apps.
If you’re not aware already, then be prepared for change, because a new version of ISO27001 was published in October 2022! It’s all very exciting! The last change to the standard was in 2017. The changes made back then were fundamentally cosmetic, with a few minor tweaks to wording. The changes barely caused a ripple and, even today, organisations are still certified to ISO27001:2013, meaning that no fundamental changes to the standard have taken place for around ten years.
LinkedIn says it is beefing up its security in an attempt to better protect its user base from fraudulent activity such as profiles that use AI-generated deepfake photos, and messages that may contain unwanted or harmful content. The new features, which are being rolled out globally over the next several weeks, have been previewed in a blog post by LinkedIn's Vice President of product management, Oscar Rodriguez.
If you were to take a look at the cybersecurity news cycle, you’d be forgiven for thinking that it’s only large enterprises with expansive customer bases and budgets that are the most vulnerable to attacks. But that’s not entirely true. Even if it’s at a much smaller scale, small- and medium-sized businesses (SMBs) still have stores of sensitive information that’s appealing to bad actors — and they’re often much less equipped to protect that data.
If you're in the cybersecurity sector, you'll know that October is “Cybersecurity Awareness Month,” a time when cybersecurity specialists everywhere push hard to get the message out that cybersecurity is important. Each year, there is a different theme, and for 2022, the theme is "See Yourself in Cyber." According to the CISA website, the theme is meant to demonstrate that "while cybersecurity may seem like a complex subject, ultimately, it's really all about people.
The NIST Cybersecurity Framework was meant to be a dynamic document that is continuously revised, enhanced, and updated. These upgrades allow the Framework to keep up with technological and threat developments, incorporate lessons learned, and transform best practices into standard procedures. NIST created the Framework in 2014 and updated it with CSF 1.1 in April 2018.
Law firms owe their clients several types of duties, such as the duty of care, duty to provide competent representation, as well as other ethical responsibilities. Their duties even extend to former clients and must be upheld long after they no longer have a formal attorney-client relationship. More specifically, lawyers have a duty to not disclose any information about a client or prospective client, unless that individual consents, or an exception is dictated by law.
In the cybersecurity profession, some names stick out among the great creators and contributors. I recently had the opportunity to speak with Richard Benham about the role of a Chief Information Security Officer (CISO). Professor Richard Benham is known globally as a pioneer in the world of Cybersecurity, Artificial Intelligence, and Cyber Warfare.
As budgets start to tighten for countless businesses concerned about the potential financial winter that many are predicting, security teams across the world are reviewing where best to place their investment to ensure they get the best “bang for their buck”. With that in mind, now might be time to explore some key areas where I see organisations spending wisely to deliver great results on a budget.
In the past, teams incorporated security testing far after the development stage of the Software Development Lifecycle (SDLC). Security testing would influence whether the application would to proceed to production, or get passed back to the developers for remediation. This process caused delays while teams worked on remediation or, worse yet, it increased security risks when teams released software without applying the necessary security measures.
