Tag: regulation

21% of CISOs pressured to not report compliance issues

Feb 6, 2025 10:06 AM

by

Andy Stern

in SecurityNews

Tags: awareness, breach, business, ceo, ciso, compliance, control, corporate, cybersecurity, data, dora, finance, framework, governance, incident response, infrastructure, insurance, law, nis-2, regulation, resilience, risk, security-incident, training

CISOs are increasingly getting caught between business pressures and regulatory obligations, leaving them struggling to balance corporate loyalty and legal accountability.To wit: One in five (21%) security leaders have been pressured by other executives or board members not to report compliance issues at their companies, according to a recent study by security vendor Splunk.The same…
Cybersecurity, government experts are aghast at security failures in DOGE takeover

Feb 4, 2025 7:12 PM

by

Andy Stern

in SecurityNews

Tags: cybersecurity, government, law, regulation

Elon Musk’s takeover of key systems across the federal government is ignoring decades of laws, regulations and procedures, experts told CyberScoop. First seen on cyberscoop.com Jump to article: cyberscoop.com/musk-doge-opm-treasury-breach/
DEF CON 32 Navigating the Turbulent Skies of Aviation Cyber Regulation

Feb 1, 2025 8:12 PM

by

Andy Stern

in SecurityNews

Tags: conference, cyber, regulation

Authors/Presenters: M. Weigand, S. Wagner Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/def-con-32-navigating-the-turbulent-skies-of-aviation-cyber-regulation/
5 ways boards can improve their cybersecurity governance

Jan 28, 2025 11:36 PM

by

Andy Stern

in SecurityNews

Tags: attack, breach, business, ciso, cloud, cyber, cybersecurity, data, election, endpoint, finance, gartner, governance, government, group, identity, incident, india, infrastructure, jobs, middle-east, network, ransomware, regulation, risk, skills, technology, threat, training

As chairman of the board for Cinturion Group, Richard Marshall is intimately involved in ensuring the security of the fiber optic network his company is constructing from India through the Middle East and on to Europe.The monumental Trans Europe Asia System (TEAS) will be difficult enough to build given it will be buried beneath thousands…
US takes aim at healthcare cybersecurity with proposed HIPAA changes

Jan 28, 2025 10:03 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, best-practice, breach, compliance, control, csf, cyber, cyberattack, cybersecurity, data, defense, detection, dora, encryption, finance, framework, government, group, healthcare, HIPAA, incident response, infrastructure, insurance, intelligence, jobs, law, malware, mfa, network, nist, penetration-testing, phishing, privacy, ransom, ransomware, regulation, resilience, risk, security-incident, service, skills, technology, threat, tool, update, usa, vulnerability, vulnerability-management

The US Department of Health and Human Services (HHS) has launched a consultation on stricter rules for the safeguarding of electronic health records.The proposed revamp of security rules covered by the Health Insurance Portability and Accountability Act (HIPAA) is designed to address the increased risk from cyberattacks such as ransomware against healthcare environments.The revamped rules…
Privacy Roundup: Week 4 of Year 2025

Jan 28, 2025 12:03 AM

by

Andy Stern

in SecurityNews

Tags: access, ai, apt, attack, backup, botnet, breach, cctv, cve, cybersecurity, data, data-breach, detection, email, exploit, firmware, flaw, google, group, identity, infrastructure, korea, lazarus, leak, login, malicious, malware, north-korea, phishing, phone, privacy, regulation, remote-code-execution, risk, router, scam, service, software, startup, technology, threat, tool, update, virus, vulnerability, windows

This is a news item roundup of privacy or privacy-related news items for 19 JAN 2025 – 25 JAN 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
Cyber Insights 2025: Cybersecurity Regulatory Mayhem

Jan 27, 2025 5:03 PM

by

Andy Stern

in SecurityNews

Tags: cyber, cybersecurity, regulation

Cybersecurity regulations are facing a tipping point. There are too many and they are too complex to manage and it’s getting worse. The post Cyber Insights 2025: Cybersecurity Regulatory Mayhem appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cyber-insights-2025-cybersecurity-regulatory-mayhem/
Data Privacy Day 2025: A Chance to Take Control of Your Data

Jan 27, 2025 3:03 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, awareness, business, cloud, compliance, control, country, data, encryption, governance, law, password, privacy, regulation, service, software, strategy, technology, tool

Data Privacy Day 2025: A Chance to Take Control of Your Data madhav Mon, 01/27/2025 – 09:19 Trust is the cornerstone of every successful relationship between businesses and their customers. On this Data Privacy Day, we reflect on the pivotal role trust plays in the digital age. It’s earned not just through excellent products or…
âš¡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [27 January]

Jan 27, 2025 3:03 PM

by

Andy Stern

in SecurityNews

Tags: ai, cybersecurity, healthcare, regulation, threat, tool, update, vulnerability

Welcome to your weekly cybersecurity scoop! Ever thought about how the same AI meant to protect our hospitals could also compromise them? This week, we’re breaking down the sophisticated world of AI-driven threats, key updates in regulations, and some urgent vulnerabilities in healthcare tech that need our attention.As we unpack these complex topics, we’ll equip…
HHS Office for Civil Rights Proposes Measures to Strengthen Cybersecurity in Health Care Under HIPAA

Jan 23, 2025 11:22 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, breach, business, cloud, compliance, control, cyber, cyberattack, cybersecurity, data, data-breach, defense, encryption, endpoint, hacker, healthcare, HIPAA, insurance, mfa, network, nist, office, privacy, regulation, risk, risk-assessment, service, software, strategy, threat, unauthorized, update, vulnerability

HHS Office for Civil Rights Proposes Measures to Strengthen Cybersecurity in Health Care Under HIPAA madhav Thu, 01/23/2025 – 06:25 Data Breaches in Healthcare: Why Stronger Regulations Matter A data breach involving personal health information isn’t just about stolen files”, it’s a gut punch to trust and a serious shake-up to people’s lives. Think about…
Box-Checking or Behavior-Changing? Training That Matters

Jan 23, 2025 5:22 AM

by

Andy Stern

in SecurityNews

Tags: awareness, compliance, corporate, cybersecurity, GDPR, HIPAA, regulation, training

Exploring New Ways to Deliver and Measure Cybersecurity Awareness Programs Regulations like GDPR, HIPAA and CMMC have made security awareness training a staple of corporate security programs. But compliance is only part of the story. Organizations face an even deeper challenge: influencing employee behavior in ways that create a truly secure workplace. First seen on…
25 on 2025: APAC security thought leaders share their predictions and aspirations

Jan 22, 2025 8:22 PM

by

Andy Stern

in SecurityNews

Tags: access, advisory, ai, api, attack, authentication, awareness, best-practice, breach, business, ciso, cloud, compliance, control, cryptography, csf, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, data-breach, deep-fake, detection, disinformation, encryption, endpoint, exploit, extortion, finance, framework, fraud, government, group, hacking, Hardware, identity, incident, incident response, infrastructure, injection, intelligence, international, iot, malicious, malware, microsoft, monitoring, network, nist, phishing, privacy, ransomware, regulation, resilience, risk, risk-management, scam, service, skills, social-engineering, software, spear-phishing, strategy, supply-chain, tactics, technology, threat, tool, training, update, vulnerability, warfare, zero-trust

As threat actors and security teams harness the growing potential of artificial intelligence (AI), who will prevail? From generative AI (GenAI) to agentic AI, we look through the lens of 25 of Asia-Pacific’s thought leaders in security and dive into their predictions and goals for the year. src=”https://b2b-contenthub.com/wp-content/uploads/2025/01/Athikom.jpg?quality=50&strip=all” alt=”athikom” loading=”lazy” width=”400px”>Athikom Kanchanavibhu Chief Information Security…
The Quiet Rise of the ‘API Tsunami’

Jan 22, 2025 8:22 PM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, breach, business, cloud, compliance, control, data, data-breach, encryption, endpoint, finance, GDPR, healthcare, HIPAA, infrastructure, law, leak, mail, malicious, mfa, mobile, monitoring, network, privacy, programming, regulation, risk, security-incident, service, threat, tool, unauthorized, update, vulnerability

As enterprises increasingly adopt cloud-native architectures, microservices, and third-party integrations, the number of Application Programming Interfaces (APIs) has surged, creating an “API tsunami” in an organization’s infrastructure that threatens to overwhelm traditional management practices. As digital services proliferate, so does the development of APIs, which allow various applications to communicate or integrate with each other…
Security chiefs whose companies operate in the EU should be exploring DORA now

Jan 22, 2025 7:22 AM

by

Andy Stern

in SecurityNews

Tags: attack, business, ciso, compliance, conference, corporate, cyber, cybersecurity, data, detection, dora, finance, framework, GDPR, incident, network, regulation, resilience, risk, service, technology, threat, vulnerability

If your enterprise operates in Europe, you should care about the Digital Operational Resilience Act (DORA), which took effect on January 17. DORA, also known as Directive (EU) 2022/2555 of the European Parliament, aims to enhance and build the EU’s cybersecurity capabilities and it has been hanging like the Sword of Damocles over the heads…
GDPR Compliance in the US: Checklist and Requirements

Jan 22, 2025 5:22 AM

by

Andy Stern

in SecurityNews

Tags: compliance, data, GDPR, international, regulation
Three Keys to Modernizing Data Security: DSPM, AI, and Encryption

Jan 21, 2025 10:22 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, automation, best-practice, business, cloud, compliance, container, control, cyber, cybercrime, data, data-breach, detection, encryption, GDPR, incident response, infrastructure, privacy, regulation, risk, saas, security-incident, skills, software, strategy, threat, tool, vulnerability

Three Keys to Modernizing Data Security: DSPM, AI, and Encryption andrew.gertz@t“¦ Tue, 01/21/2025 – 14:56 Organizations worldwide face a “perfect storm” of increasing and ever-evolving cyber threats. Internal and external factors are at play, elevating cyber risks and their consequences and mandating new approaches to safeguard data. A recent study based on responses from over…
Privacy Roundup: Week 3 of Year 2025

Jan 20, 2025 7:22 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, android, apt, blockchain, breach, cctv, china, computer, cve, cyber, cybersecurity, data, detection, email, exploit, finance, firmware, github, google, group, guide, leak, malicious, malware, microsoft, phishing, privacy, regulation, router, scam, service, smishing, social-engineering, software, technology, threat, tool, update, virus, vulnerability, windows

This is a news item roundup of privacy or privacy-related news items for 12 JAN 2025 – 18 JAN 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
EU privacy non-profit group filed complaints against TikTok, SHEIN, AliExpress, and other Chinese companies

Jan 18, 2025 12:22 AM

by

Andy Stern

in SecurityNews

Tags: business, china, data, group, privacy, regulation

noyb files complaints against TikTok, AliExpress, and other Chinese companies for illegal EU user data transfers to China, violating data protection laws. Austrian privacy non-profit group None of Your Business (noyb) has filed complaints accusing companies like TikTok, AliExpress, SHEIN, Temu, WeChat, and Xiaomi of violating data protection regulations in the European Union by unlawfully…
DORA Takes Effect: Financial Firms Still Navigating Compliance Headwinds

Jan 17, 2025 10:55 AM

by

Andy Stern

in SecurityNews

Tags: compliance, dora, finance, regulation

The EU’s DORA regulation is in effect as of January 17, with mixed evidence around compliance levels among financial firms First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/dora-financial-firms-compliance/
Large Language Models and Regulations: Navigating the Ethical and Legal Landscape

Jan 15, 2025 2:02 PM

by

Andy Stern

in SecurityNews

Tags: business, regulation

Leverage the full potential of Large Language Models (LLMs) for your business while staying compliant. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/large-language-models-and-regulations-navigating-the-ethical-and-legal-landscape/
Biden Issues Final Maritime Cybersecurity Rules

Jan 14, 2025 10:02 PM

by

Andy Stern

in SecurityNews

Tags: attack, china, cyber, cybersecurity, incident, incident response, regulation

White House Mandates Cyber Incident Response Plans Amid Growing Chinese Threat. Federal regulations unveiled Tuesday require the U.S. maritime industry to implement baseline cybersecurity measures amid concerns over exposure to attacks from adversaries such as China. The rules mandate cybersecurity plans and clearly-defined cyber positions in ports and maritime facilities. First seen on govinfosecurity.com Jump…
Fifteen Best Practices to Navigate the Data Sovereignty Waters

Jan 14, 2025 9:46 AM

by

Andy Stern

in SecurityNews

Tags: access, attack, automation, awareness, backup, best-practice, breach, cloud, compliance, computer, computing, container, control, country, crypto, cybersecurity, data, encryption, governance, iam, identity, international, law, least-privilege, monitoring, network, privacy, ransomware, regulation, resilience, risk, security-incident, service, software, strategy, threat, tool, unauthorized, update, zero-trust

Fifteen Best Practices to Navigate the Data Sovereignty Waters josh.pearson@t“¦ Tue, 01/14/2025 – 08:04 Data sovereignty”, the idea that data is subject to the laws and regulations of the country it is collected or stored in”, is a fundamental consideration for businesses attempting to balance harnessing the power of data analytics, ensuring compliance with increasingly…
CISOs embrace rise in prominence, with broader business authority

Jan 13, 2025 11:26 AM

by

Andy Stern

in SecurityNews

Tags: ai, attack, business, ceo, cio, ciso, compliance, control, corporate, cyber, cyberattack, cybersecurity, data, governance, healthcare, infrastructure, intelligence, network, privacy, regulation, risk, risk-management, security-incident, strategy, technology, threat, update

It’s a familiar refrain: As cybersecurity has become a core business priority, it is no longer a siloed operation, and the responsibilities of CISOs have grown, giving them greater prominence within the organization.According to CSO’s 2024 Security Priorities Study, 72% of security decision-makers say their role has grown to include additional responsibilities over the past…
2025 Cybersecurity and AI Predictions

Jan 11, 2025 11:42 AM

by

Andy Stern

in SecurityNews

Tags: access, ai, api, attack, backdoor, backup, browser, business, chrome, communications, compliance, control, corporate, crowdstrike, crypto, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, exploit, finance, firmware, flaw, framework, fraud, GDPR, hacker, Hardware, identity, intelligence, international, korea, LLM, malicious, mitigation, monitoring, network, open-source, privacy, regulation, resilience, risk, risk-assessment, scam, service, skills, supply-chain, switch, technology, threat, tool, training, unauthorized, vulnerability

The cybersecurity and AI landscape continues to evolve at a breathtaking pace, and with it, the associated risks. Snowballing cybercrime costs are compounded by a cybersecurity workforce gap of nearly 4.8 million professionals, as reported by ISC2. Meanwhile, ISACA’s end-2024 State of Cybersecurity Report shows that nearly half of those surveyed claim no involvement in…
SEC rule confusion continues to put CISOs in a bind a year after a major revision

Jan 10, 2025 8:18 AM

by

Andy Stern

in SecurityNews

Tags: attack, breach, business, ciso, citrix, compliance, control, cyber, cyberattack, cybersecurity, data, government, incident, incident response, law, network, privacy, regulation, risk, security-incident, software, strategy, supply-chain

Confusion around when and how to report cybersecurity breaches continues to plague companies a year after revised US Securities and Exchange Commission (SEC) cybersecurity breach reporting rules came into effect, experts say.As the agency that regulates and enforces federal US securities laws continues to flex its enforcement muscles against organizations that violate the strict rules,…
8 Cyber Predictions for 2025: A CSO’s Perspective

Jan 10, 2025 1:18 AM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, business, ceo, ciso, cloud, compliance, computing, control, credentials, cryptography, cyber, cyberattack, cybercrime, cybersecurity, data, defense, detection, encryption, exploit, extortion, firewall, framework, governance, group, hacker, hacking, healthcare, identity, intelligence, international, law, leak, malicious, mfa, microsoft, network, north-korea, organized, phishing, privacy, ransom, ransomware, regulation, risk, risk-management, service, social-engineering, software, strategy, supply-chain, theft, threat, tool, update, wifi, zero-trust

As we step into 2025, the cyberthreat landscape is once again more dynamic and challenging than the year before. In 2024, we witnessed a remarkable acceleration in cyberattacks of all types, many fueled by advancements in generative AI. For security leaders, the stakes are higher than ever. In this post, I’ll explore cyberthreat projections and…
European Court Fines European Commission for Privacy Breach

Jan 9, 2025 8:19 AM

by

Andy Stern

in SecurityNews

Tags: breach, privacy, regulation, technology

Transfer of German Man’s IP Address Wins Him 400 Euros. European privacy regulation – bane of American technology companies and a favorite cudgel of activists – came to haunt no less an organization than the European Commission, which must pay 400 euros to aggrieved German national Thomas Bindl, peeved that Facebook obtained his IP address.…
European Court Fines European Commission for Privacy Violation

Jan 9, 2025 1:18 AM

by

Andy Stern

in SecurityNews

Tags: privacy, regulation, technology

Transfer of German Man’s IP Address Wins Him 400 Euros. European privacy regulation – bane of American technology companies and a favorite cudgel of activists – came to haunt no less an organization than the European Commission, which must pay 400 euros to aggrieved German national Thomas Bindl, peeved that Facebook obtained his IP address.…
European Court Fines European Commission for GDPR Violation

Jan 8, 2025 11:18 PM

by

Andy Stern

in SecurityNews

Tags: GDPR, privacy, regulation, technology

Transfer of German Man’s IP Address Wins Him 400 Euros. European privacy regulation – bane of American technology companies and a favorite cudgel of activists – came to haunt no less an organization than the European Commission, which must pay 400 euros to aggrieved German national Thomas Bindl, peeved that Facebook obtained his IP address.…
Court orders European Commission to pay its first-ever GDPR fine

Jan 8, 2025 6:18 PM

by

Andy Stern

in SecurityNews

Tags: data, GDPR, privacy, regulation

A German citizen will receive Euro400 from the European Commission for a violation of the General Data Privacy Regulation (GDPR), the first time the EU’s executive arm will pay such a fine.]]> First seen on therecord.media Jump to article: therecord.media/european-commission-pays-gdpr-fine-german-citizen