Naor Penso

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

This graphic I did on the DSPM market is starting to get out of hand! News of another acquisition in this market broke late last week, with Tenable announcing its acquisition of Eureka Security. Here are a few highlights and takeaways for Tenable and the DSPM market: → Tenable is all in on cloud security and CNAPP The message in the transaction announcement was loud and clear — Tenable is serious about its cloud security strategy. Data security was the next piece of the puzzle. The build vs. buy decision here looks pretty straightforward. Data security is a new area for Tenable, so acquiring a product and team with expertise is strategic. There were still high quality early stage targets in the market. The best decision was to buy if they could get the price they wanted. → We've had over $1 billion in DSPM financing and M&A activity Data security companies are well over $500 million in total venture capital raised. With Eureka Security, we've also had 5+ total acquisitions for a cumulative value of $1B+ (some disclosed, and me roughly estimating transaction values for the rest). DSPM has easily been one of the most active markets in the industry, and the race is far from over. → What's going to happen with the rest of the market? Cyera raised a $300 million round earlier this year at a $1.4 billion valuation, so they're playing the long game. Palo Alto Networks, CrowdStrike, IBM, Rubrik, and now Tenable have all done deals already. And Varonis just keeps doing what they do best — building a solid data security platform and scaling their business as a public company, including 17% YoY ARR growth last quarter. --- There are still high quality early stage companies who could raise capital or become acquisition targets yet this year, including several we didn't have on this graphic. We're also going to start seeing which of the strategic buyers emerge as leaders after integrating the product and GTM components of their acquisitions. This was a statement move by Tenable and a clear signal to the industry that they're more than just another vulnerability management company. Congratulations to Eureka, Tenable, and the Altitude Cyber team on a great deal.

208

26 Comments

GLBA / FTC Safeguard Rule - This explains in plain language the specific information you need to provide. The revised Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a security breach involving the information of at least 500 consumers. Here is the link to the online reporting form you'll need to fill out: https://lnkd.in/dJUwQxAG

2

Best of breed (the best tools) still matter ...

7

Vulnerability detection software tends to either hurt application performance or fall short in accuracy. With Datadog Code Security, you get a production-ready, IAST-based solution that has earned a 100% score in the OWASP Benchmark test. Read more: https://lnkd.in/g9Cphz9N

99

1 Comment

RSA 2024 Takeaway: AI or Die 🥵 Met dozens of CISOs, execs & founders at RSA this week. Quick observations: 1️⃣ Every vendor is AI-fying their pitch. They're leveraging AI/LLMs for various use cases - threat intelligence, SOC automation & more. Impressed by Google Cloud, CrowdStrike & Microsoft Azure security offerings with lots of LLM-powered automation across their stack 🤖 2️⃣ The other side of AI adoption? Security / Compliance / Safety. Many pitches around securing AI systems & data. AI safety will be a hot topic for a while. Congrats to Reality Defender Ben Colman for winning the RSA Conference Innovation Sandbox 👏 3️⃣ Enterprises are shifting towards unified security stacks driven by cost, simplicity & agility needs - EDR + ASPM + CNAPP + SIEM +...all-in-one. This'll trigger a new wave of acquisitions by major players like CrowdStrike, Palo Alto Networks, Zscaler, Wiz, SentinelOne. While there are many innovative exciting startups, I'm afraid most exits may be below $500M. 4️⃣ Critical infrastructure security is gaining more attention due to rising geopolitical threats. This is an urgent national security matter. I'm super proud to be an early investor in Eclypsium, Inc.. They are the MOST innovative critical infrastructure security platform for enterprises. 💪 (cc Yuriy Bulygin Alex Bazhaniuk) 5️⃣ Identity is the new perimeter. Loads of innovation here. A non-human identity layer is emerging rapidly. Cerby showcased many exciting product updates to secure new vulnerabilities in the identity stack. Watch this space 👀 Share if I miss others. #RSAC2024 #cybersecurity #IAM #EDR #SIEM #CNAPP #ASPM #criticalinfrastructure #supplychainsecurity #ai #ml #llm #largelanguagemodels

79

10 Comments

The Future of Compliance is Now-

67

2 Comments

Last year, a staggering 102 billion banking calls were made through OpenAPIs, projected to grow to 580 billion over the next three years. Recognizing the security implications, APIs and associated risks were featured for the very first time in PCI 4.0 in early 2022. It also went into great detail in highlighting how APIs should be created, governed, and disposed of under PCI DSS 4.0 Initially created by major credit card companies to foster trust in online digital payments, PCI is now widely adopted by any organization that stores, transmits, and processes credit card payments. The key deadlines for it are as follows:  1. March 31, 2024, for the first phase of PCI DSS 4.0 requirements 2. April 1, 2024, for certain mandatory practices and new reporting templates 3. March 31, 2025, for full compliance with all PCI DSS 4.0 requirements Organizations that are Phase 1 compliant now have less than a year left to implement the rest of the best practices under Phase 2. Go through the carousel below to know how you can remain PCI Compliant⬇️ #esg #compliance #fintech #deadline #apis #apisec #payments

21

CISOs - please don't squander your earned trust on dubious purchasing decisions. I cannot verify the veracity of this article, but even the mere premise of CISOs receiving kickbacks for their security product purchases is deeply disturbing. As a profession, we have worked too hard to earn trust and credibility, and can't have our decisions second-guessed. If you are doing this, then please stop. Say no to kickbacks and declare any conflict of interests / recuse yourself from any purchasing decisions 🙏🏼 https://lnkd.in/gXgfkvd3

5

SaaS DLP is important. Checkout the recent case at Disney. Metomic can help avoiding this risk. "Claims state that Nullbulge accessed Disney's Slack server and collected information about the company's upcoming projects, including concept art for Disney games. These reports also suggest that login details and personal details of workers were gathered." #SaaS #cybersecurity #dlp #slack

19

Pretty incredible story emerging wrt compensating CISO's for "product feedback". I know several people listed on their website personally, and each of them operates with incredibly high integrity, but it can be a slippery slope. Per the article, it sounds like a few slipped quickly down that slope and made questionable product purchases in exchange for earning "compensation credits" "The first sales come from the loyal CISOs who work with the fund." "I recruited a new CISO for a financial organization that I managed out of a desire to refresh the cyber defense system. I gave him a free hand because I trusted him and I see this position as a position of trust. Six months later, I noticed that, surprisingly, almost all of the new logos that the CISO introduced were portfolio companies of Cyberstarts," "After I confronted the CISO on the subject, he admitted that he is on the list of advisers of Cyberstarts and receives a percentage of the funds from them. Shortly after this, he left the company " "upon the appointment of a new CISO, I asked him to inform me if he was contacted by Cyberstarts. Within a few weeks, he had already received an email from them with a description of their kind of 'loyalty program' that details exactly what he will receive the more he works with the fund." https://lnkd.in/ga7VsAfu #infosec #cybersecurity

33

Last month #CDK was hit with a #ransomware attack which affected ~15,000 auto dealerships in North America and estimates suggest about $1B USD in losses. There are some outlets reporting CDK paid the $25M USD ransom two days after the attack but it still took them a few weeks to recover and get back to normal operations. However, their losses don’t stop there as they will likely have to provide some sort of financial relief to the 15,000 dealerships in hopes they don’t go to a competitor. #LITrendingTopics #supplychain #resiliency   https://lnkd.in/gycjaFNj

41

Transcending CVEs and Leveraging Environmental Variables - part three of my seven-part series on optimizing your vulnerability and exposure management strategy. https://lnkd.in/g5dRkKwz Sevco Security #VulnerabilityManagement #ExposureManagement #CAASM

14

Senvest Management, a New York-based private fund manager, recently settled with the SEC for for how its employees communicated using ephemeral messaging apps. From January 2019 to December 2021, Senvest employees, including supervisors, used personal messaging apps for business discussions, against company rules and the Investment Advisers Act of 1940, which demands recording such communications. Key Points: - Senvest employees broke company policies by using personal devices for business-related communications, violating recordkeeping requirements. - One issue was messages set to auto-delete after 30 days, complicating record retention. The Securities and Exchange Commission (SEC) found these practices problematic but did not offer additional guidance in their Order on applying record-keeping rules to electronic communications on employee devices. The SEC emphasized that firms must have effective controls to prevent such violations. It noted that Senvest didn't review its employees' personal devices, even though it was allowed, to ensure compliance. Senvest agreed to a $6.5 million settlement, which includes hiring a compliance consultant and making policy changes. The SEC acknowledged Senvest's cooperation and efforts to correct its policies. This case highlights the importance for firms to: - Review and enforce communication policies. - Ensure effective monitoring and archiving of business communications, even on personal devices. - Ensure that they have evidence of continuous compliance to address investigations or litigation. #SEC #cybersecurity #risk

6

3 Comments

Trigger warning. This post is about usage-based pricing for security operations. Omer on Security is a safe space to discuss sensitive topics like this one. … … … ... Fears around the “pay for what you use” model are one reason more SOC use cases aren’t being migrated from Splunk to Snowflake. They also drive Anvilogic customers to use a managed Snowflake security data lake instead of bringing their own. This post puts those fears to rest and gives you the confidence to move from ingest-based to usage-based SOC data platforms. #securitydatalake

49

10 Comments

🚀 Embracing the Future of Cybersecurity Compliance 🚀 I am excited to share Suridata's latest blog, whitepaper and checklist on the new SEC Cybersecurity Disclosure Requirements. These resources are designed to help publicly traded companies enhance their cybersecurity practices, ensure compliance, and protect investor interests. We believe that these guidelines will not only help in meeting regulatory requirements but also in building a stronger, more resilient cybersecurity posture. Read the blog post and download the whitepaper and checklist here: https://lnkd.in/eyJHyNCS Let's work together to elevate our cybersecurity standards! 💪🏻

19

1 Comment

Three years ago, people were skeptical of the idea that a container scanner and an SCA could converge into one powerful, runtime-based open-source security solution. Fast forward, Kodem changed the way people think about #AppSec. Today, we announce the next phase of the revolution - covering proprietary code as well with our runtime-based #SAST. This couldn't have happened without the dedication of our amazing team who keeps innovating and delivering #NoMatterWhat.

41