Tag: Compliance & Legal
There is an unspoken assumption that pervades the information security industry. It is a vestige from the days when system administrators were the security staff, and the ways in which customers and organizations interacted with the Internet were markedly different from how they are now. This assumption is that the boundary that separates our network…
Read MoreImagine a network of intelligent sensors and content filters that connects to every endpoint in an enterprise network. It is scalable, resilient, adaptable, and features the gold standard (for the moment at least) in natural language processing. It has an average uptime of 98% during business hours. Even better, all organizations already have this tool.…
Read MoreThis is the first in a three-part series on the new Department of Defense (DoD) audit requirement called Cybersecurity Maturity Model Certification (CMMC). This first part introduces CMMC and what it means for the future of U.S. government suppliers of cybersecurity. Part two will discuss how to prepare for a CMMC audit. Part 3 will…
Read MoreThis is the second in a three-part series on the new Department of Defense (DoD) audit requirement called Cybersecurity Maturity Model Certification (CMMC). Part one introduced the DoD CMMC model and what it means for the future of U.S. government cybersecurity suppliers. Part two goes into more detail about the CMMC audit itself. CMMC did…
Read MoreThis is the third in our series on the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC). Our previous articles introduced the DoD CMMC model and how to prepare for DoD CMMC audits. This final article covers how a CMMC audit is expected to play out for an assessed organization. In an American court…
Read MoreIn general, organizations should implement just enough necessary cybersecurity to mitigate risk and meet compliance requirements. We’ve talked about how to mitigate known, foreseeable cyberthreats, but what is the lowest bar for a typical organization with respect to cybersecurity? To figure this out, we need to think about universal compliance and legal obligations for any…
Read MoreRegulators are increasing enforcement actions and penalties against the big banks for failures in cyber risk management, and the rest better take notice. Between August and October of 2020, the Office of the Comptroller of the Currency (OCC), an independent bureau of the U.S. Department of the Treasury, imposed $625 million in fines on major…
Read MoreWhy does vulnerability management fail? There are a couple of reasons: Enterprise IT teams can’t keep up with all the vulnerabilities because secure coding hasn’t been, and still isn’t, a priority across all organizations that write software. In a recent F5 security event where 300 participants responded to live polling, 21% of respondents said they…
Read MoreThe Power of Data Massive amounts of new data are generated every day. In 2017, IBM calculated that 90% of all the world’s data had been created within the past two years. Data shapes our knowledge, decisions, and everyday life; data has power. Thanks to the fact that technology devices are getting smaller and smaller,…
Read MoreHeadlines about breaches and compliance penalties give us a strong idea of what we do not want for our security programs. Of the breaches in 2020, the financial sector had the highest percentage at 17 percent, as noted in the 2021 Application Protection Report. With breaches, come regulator attention. In 2017, New York’s Department of…
Read More