The road to cybersecurity compliance has changed dramatically in recent years, with proactive efforts such as incident response, forensic investigation and threat hunting on the rise.
However, compliance standards have typically not kept pace with the need for companies to level-up their security stance in an era of...
Cybersecurity has seen an increase in requirements and complexity as more data is moved to the cloud or outsourced to third parties. The posture now includes third parties, IT systems, regulations (e.g., PCI, PII), standards (e.g., NIST, SCF, ISO), access management and more. CISOs not only need to understand and...
In a decision that will have major implications for the cybersecurity industry, the U.S. Supreme Court ruled Thursday to limit the scope of the Computer Fraud and Abuse Act. Security researchers and civil liberty groups argued that the 1986 law was too broadly written and outdated for today.
The Department of Homeland Security has issued a cybersecurity directive that requires the operators of oil and gas pipelines to report ransomware attacks and other security incidents to the government and take other security steps.
The U.S. Department of Homeland Security is preparing cybersecurity regulations for the oil and gas industry in the wake of the ransomware attack on Colonial Pipeline Co. that resulted in the company suspending operations for several days, according to The Washington Post.
Where were you on May 25, 2018? That was the day the EU's General Data Protection Regulation went into full effect. Three years later, some legal and privacy experts say that while the global privacy discussion and expectations have evolved, GDPR still has some growing up to do.
Insurance company CNA's apparent decision to pay attackers a $40 million ransom and Colonial Pipeline Co.'s payment of a $4.4 million ransom are stirring debate over whether such payments should be banned under federal law.
It's not just traditional data governance – it's about business risk. And in the age of GDPR and CCPA, you’d best have a handle on data discovery and classification. Patrick Benoit of CBRE gives the BISO's perspective on data risk governance.
"They’re playing games," is how one security expert describes Conti ransomware-wielding attackers' "gift" of a decryptor to Ireland's crypto-locked health service, while still demanding a ransom to not leak stolen health data. The same could be said of the DarkSide gang's promised retirement.
As a global CISO and privacy officer, Rebecca Wynn has earned her stripes. And she's upfront with her expectations: She will take your security organization to the next level. But she also won't hesitate to walk away if she sees that cybersecurity commitment is nothing but talk.
In a session at RSA Conference 2021, three cybersecurity experts said top priorities among the U.S. Cyberspace Solarium Commission's recommendations that have not yet been carried out are adopting a federal data breach notification law and improving public-private partnerships.
Since the supply chain attack that targeted SolarWinds was uncovered in December 2020, some members of Congress have been pushing for a nationwide data breach notification law. In a panel discussion at RSA Conference 2021, federal officials and a legal expert offered insights on what such a law might require.
The ransomware attack that targeted Colonial Pipeline Co. earlier this month, which continued to cause gas shortages Monday, has prompted lawmakers to introduce measures designed to address cybersecurity shortcomings in the nation's critical infrastructure - especially gas and oil pipelines.
An acceptable use policy (AUP) is a set of guidelines for approved ways an employee
is permitted to use the internet, a network or a connected device. AUPs can help drive appropriate use of resources, limit exposure to online threats and protect organizations against security compromises. Yet many companies don’t...