Nicole Michaelis

Learn how SS8's lawful and location intelligence platform, Intellego XT, empowers law enforcement agencies to dismantle complex criminal networks. By leveraging advanced data analytics, Intellego XT provides invaluable insights to investigators. #cybersecurity #lawenforcement #technology #SS8 #IntellegoXT

3

Consumer Data Privacy is poised for a transformation with the introduction of the American Privacy Rights Act (#APRA). This bipartisan bill aims to create a uniform privacy framework, reduce data collection, improve consumer consent, provide for better opt-out options and boost privacy protection enforcement. More on the APRA's impact on #DataPrivacy: https://okt.to/T8YOLA Makenzie Holland #DataProtection #Cybersecurity

4

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

This webinar is for State lawmakers and their staff, and should be a good one!

6

📣 3 things I learned about communicating security to individuals: Lessons from patient conversations and learnings for AI 📞 At Eucalyptus, I used to jump on phone calls with individual patients who were concerned about the security of their data. These individuals ranged from experienced info sec specialists to parents concerned about their (or their family's) data. 📝 Information asymmetry was often a significant challenge for these conversations: - Individuals may not have the relevant technical background. - Specialists can't see into our systems to verify posture themselves. Through this process, we learned 3 simple lessons: 1️⃣ Trust is the core problem to solve: The pain that many of these patients were experiencing was a deterioration or lack of trust, not a direct issue with how we had established or maintained our technical cybersecurity posture. 2️⃣ Independent accreditations are not a silver bullet to this trust problem: Accreditations (eg ISO27001, SOC2, DTAC) help but don't solve the core problem unless: (a) there is familiarity for the framework, and (b) the framework itself is trusted. 3️⃣ Relatable (if not perfect) anchors help bridge the information asymmetry gap: Leading with relatable (even if not technically correct) references like 'bank-grade encryption' can help build trust by providing a relatable anchor. Conversations can then deep-dive into what this means. 💡 We're starting to see similar parallels appear in the AI space: - Trust appears to be the biggest issue for potential users of AI (see comments) - ISO only released its first independent standard for AI in December last year (see attached). - Common questions are appearing (eg, 'Does [LLM] train its models on my business data?') but we're still some way off from relatable terminology. 👉 In those circumstances, AI providers could leverage some of the learnings we've had in cybersecurity to help bridge the trust and information asymmetry gaps. We'll also likely see this trust gap close as we get more of 2️⃣ and 3️⃣. https://lnkd.in/gmydxqmD Other relevant links in the comments below! #ai #cybersecurity #trust #ArtificialIntelligence #privacy #dataprotection

20

1 Comment

If #privacy and your #brand a matter let’s connect. Fast track to avoid fines!

4

There's nothing worse than using hacks and workarounds to avoid regulatory issues. If you're dealing with HIPAA and customer data, it's crucial to do the right thing to ensure trust and privacy are at the center stage. US-based companies dealing with PHI, be warned: leveraging proxies to hide your data is not the answer. Check out this article to learn more about why you should think twice before using proxies to block YouTube from tracking patient HIPAA data. #CDP #HIPAA #Healthcare #Hacking

7

Most "third party risk management" programs are a colossal waste of resources. Look at the data you're collecting and ask "what changes am I making based on these answers?" If you can't answer "what changes" then you're inventorying risk, not managing it. Period.

148

15 Comments

Last week, OpenID Connect (OIDC) actually became an ISO standard. This is a big deal, not only from the acknowledgement point of view but from a support and compliance standpoint. If you have an RFP that includes the vague "and other relevant standards", OIDC is in play. Details here: https://lnkd.in/g3ZQGp5v

29

3 Comments

Regulatory compliance? 🙄 I know right? But ensuring that you enforce geographic specific access to certain systems doesn't need to be hard... one simple policy...

2

A 31x increase in deepfake fraud year over year. With BEC still being a top risk this is concerning. By using Cyber Risk Quantification we can identify the financial impact of deepfake usage against executives. Look forward to digging into the details of this report. Tony Hynes any thoughts?

4

I'm super excited to be speaking at International Legal Technology Association (ILTA)'s Evolve conference next week in Charlotte. My talk is titled: Common Active Directory Misconfigurations That Are Abused In Real Attacks.... I'm going to share what those attacks look like & provide actionable and tangible advice (including free resources) IT admins and defenders can use to better secure and protect their environments from attack. If you're going to be at the event, please drop me a DM I would love to meet up and nerd out on Active Directory security!

30

11 Comments

The Consumer Financial Protection Bureau has proposed a new rule (https://lnkd.in/giuxe2n9) to limit the hugely grey area that Data Brokers operate within. Glad this is getting news coverage, it's long overdue. #CFPB #DataPrivacy #ConsumerProtection #DataSecurity #PrivacyLaw #Cybersecurity

6

Just in time for October Cybersecurity Month - check out SeeMetrics newly updated boards for all people in the security org! From GRC to vuln management to product to CISO, each one can see real-time relevant metrics for what's needed. This month's webinar w/ CEO Shirley Salzman below:

2

I have had several industry professionals reach out to me today with the general question of "Does Cyolo have access to any sensitive customer credential, application or resource data in a test, QA or production environment that could put customers at risk if it were compromised". My response to them is as follows. Cyolo has no access to and has no need to be entrusted with any of this data because we are truly a ZERO Trust design (and I am not referring to NIST SP 800-207). We are not and never will be a Vendor Trust design where a vendor is entrusted with or has access to any of this customer information. (And there is a significant difference, as past breaches have shown). This means Cyolo has ZERO Access to any sensitive customer data in any environment (Test, QA, Production) in any location, be it on their premise, in a data center, within the cloud or anywhere else. This information is controlled, managed, maintained and only accessible by the customer. I hope this helps others understand the value of what true ZERO Trust and not Vendor Trust design is. #zerotrust #vendortrust #securitybydesign

27

If you're a legal tech company working on some kind of "agent" product, you might take a look at how Replit Agent does it for software development. Here are 10 quick things I really like about Replit's approach, which might be translatable to legal: 1. After user's initial prompt, the product creates a plan and presents that plan for approval/adjustment before proceeding. 2. The proposed plan always includes some suggested "additional" features that can be selected by user. 3. Once the plan is approved, it executes, with each step of the execution displayed explicitly so user can monitor (and learn from) what is happening to carry out the approved plan. 4. All the generated code is shown to user, and the user can further inspect and edit all of the generated files. 5. At tricky spots, the product checks in and asks the user to verify that the code is doing what was expected/intended. 6. Once initial code generation is finished, the product presents a clear "how to test" roadmap for the user. It does not assume all is fine. Instead, it assists the user in doing the work to test and validate the result. 7. When errors occur, it works with you to debug and address, and it tells you what it is doing to try to fix the problem. 8. Along the way, it creates various "checkpoints" to record progress and key changes. User can easily "rollback" to prior point by clicking a button at the checkpoint. 9. It works systematically, like a real developer. It does not hide what's going on behind some magic curtain. For example, if it can't resolve an error, it first adds debugging statements and tries to isolate the error with the user's assistance. 10. Overall, it is a programming agent that operates like a member of a technical team, not like a mystical code wizard casting obscure spells. Broadly speaking, I think a lot of legal AI products could do more to operate like this. Don't be a "robot lawyer" that obscures whatever it is you're doing. Be a productive, collaborative member of a legal service team, that shows the work you're doing, enlists the help of expert colleagues and respects the actual process of doing good legal work.

68

11 Comments

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

34 Comments

Human's are really bad at self reporting. Asking someone what was difficult for them and why will return suspect data. When you watch someone attempt to do something, like we do when we perform usability testing, you get valid feedback and actionable information.

20

4 Comments