Umang Barman

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

Powerful technologies like quantum computing and artificial intelligence (AI) have the potential to propel the connected world forward—but in the wrong hands, their dangers are undeniable. My pal Dr. Avesta discusses how our employer DigiCert innovates in cybersecurity, focusing on trust, certificates, IoT security, content protection, encryption, machine learning, and quantum security. Learn how the leader in #digitaltrust can help you advance security and #TellYourTrustStory in a rapidly evolving digital world.

6

Hi Everyone! I'll be hosting a panel discussion on "The Advent of AI: Adapting to Emerging Threats and Balancing The Offensive and Defensive" at BSidesGoa this weekend! If you're attending the conference, be sure to stop by for this insightful discussion. It would be great to catch up and chat about AI in cybersecurity! Cyware Security BSides Goa #BSidesGoa #AI #Cybersecurity

50

1 Comment

Another amazing discussion on #thirdpartyrisk challenges at Evanta, a Gartner Company CISO summit - this time with Bay Area CISO's and cybersecurity leaders. Houston or the Bay Area, ONG or Technology businesses - these CISO discussions are making it clear that gaps and challenges of current #thirdpartyrisk programs are being felt across the board. Reach out to learn more about how Dataminr's approach to #AI for external #threat detection can have a significant positive impact on strategic #cyber priorities. #EvantaCISO #Thirdpartyrisk #Cybersecurity #CISO Taylor Chaffey Sam Flaherty

85

1 Comment

As the Internet of Things continues to transform industries and our daily lives, it's becoming increasingly clear that traditional #Identity and #AccessManagement (#IAM) solutions aren't equipped to handle the unique challenges posed by #IoT environments. As we embrace the future of #connecteddevices, evolving our IAM practices to meet the scale and diversity introduced by IoT is not just a necessity—it’s essential for ensuring robust security, seamless operations and enabling the foundation for #ZeroTrust. Join us for an engaging discussion on "Identity Transformation: The Next Wave in IAM Solutions," scheduled for 22nd June, hosted by the Cloud Security Alliance Bangalore Chapter and sponsored by Target. Register Now: https://lnkd.in/gtTjBE-j #IoT #Cybersecurity #IAM #Blockchain #DigitalTransformation #IoTSecurity #DecentralizedIdentity #CyberResilience #DataProtection #TechInnovation #Identity #Authentication #Authorization #LifecycleManagement #LeastPrivilegeAccess #DataPrivacy

29

1 Comment

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

185

1 Comment

💡 Anomali's VP of Threat Research, Steve Benton, shares insights on the recent Change Healthcare ransomware attack and provides important lessons for tech professionals. Read the latest coverage from Dice, including guidance that can help improve defense, incorporate zero trust, leverage threat intelligence, focus on resilience, and strengthen collaboration against cyber threats in the healthcare industry. Read the full article here: https://ow.ly/lXgs30sBvxb #Anomali #CybersecurityIndustryExperts #ChangeHealthcare #RansomwareAttack

6

Check out the latest VentureBeat article where Ivanti's research on adversarial #AI is featured. It's a great read on the challenges and advancements in #cybersecurity, highlighting the growing threat of deepfakes. Proud to be part of a team that's at the forefront of these critical issues!

9

6 Key Insights from a CISO Panel at Gartner SRM: Mo' Metrics, Mo' Problems: Keeping Board Reports to 4 Key Metrics 1) Put cybersecurity metrics into risk language. Consider centering your board presentation around a risk register. 2) Connect the dots, don’t get bogged down into the technical details. 3) Report on the results of your work, not the output. Link your team accomplishments to business objectives. 4) Map key projects in the cybersecurity projects to the risk; articulate if you have met the objectives and what resources you need to achieve it. 5) Show maturity of how you stack against your competitors, to be able to articulate if the organization can meet customer requirements consistently. 6) Keep your visuals simple, plan your narrative. These insights do still require efforts by the CISO to gather this information, analyze it and articulate it confidently. Human resources are limited. Learn about how Critical Start is tackling this challenges for security & risk leaders in booth #151. We'd love to demo our Quick Start assessments (with peer benchmarking), Cyber Risk Dashboards, Cyber Risk Register and more. #GartnerSEC #MDR #RiskReduction

9

Couldn’t tune in to The Geeks, Geezers, and Googlization Show livestream last week? Now’s your chance to listen to the podcast episode featuring Ivanti CMO Melissa Puls as she discusses the future of work. Learn about the challenges and solutions for office, hybrid, and remote work models and how Ivanti is leading the charge in creating flexible, secure workplaces. #EverywhereWork​

7

with the latest news on #Crowdstrikes update causes BSOD, I am reminded why we do things in OT like we do and there is a reason behind why most #OT vendors (like ABB) test and approve a selection of 3rd party software and every patch of it in combination with their control systems and updates of it, before it is released to customer Systems - which limits one on the variety of possible supported solutions but also limits the risk on false positives or bugs creating situations like this in #critical environments. Fingers crossed for all the #response teams that need to fix this now. #SupplyChain https://lnkd.in/eMdUZF6V maybe a #workaround (not tested by myself just shared): https://lnkd.in/eyv2tSW5

81

6 Comments

New Release: Anomali's 2024 Cybersecurity Priorities Study! 🚨 We've surveyed 150 security experts from $1B+ revenue companies across North America and Western Europe to uncover the top ten security priorities in 2024 ↓ Read more about the insights from the industry’s top-tier professionals: https://ow.ly/y6v530sC1NA #CybersecurityTrends2024 #SecurityInsights #InfoSec #TopCyberPriorities #SecuritySurvey

7

Pssssst-NISsssssT - are you ready for the future because it is here now? #NIST is close to making one of their most #monumental announcements in decades. #Cybersecurity is at the precipice of a global game changing moment. A critically relevant #quantum computer (#CRQC) is nearly upon us and QuSecure is the leading company that can help #protect you and your #data. Reach out to QuSecure to learn more about how you can be prepared with our QuProtect #PQC #crypto agile software today. https://lnkd.in/gpdXmmBJ.

22

CISA's Deputy Director Nitin Natarajan underscores the inevitability of cyberattacks on healthcare providers. He emphasizes the need for resilience and proactive defense measures to mitigate risks effectively. Moreover, as healthcare organizations face budget constraints, leveraging free federal resources becomes crucial in bolstering cybersecurity defenses. Natarajan advocates for a shift towards a "secure by design" approach to ensure robust protection against cyber threats in the long term. I'd add the significance of addressing the C-suite's potential inability to seize cyber opportunities, stressing the importance of leadership alignment and investment in cybersecurity measures. Cybersecurity initiatives work best backed by leadership support. #HealthcareCybersecurity #CSuiteLeadership #CyberRisks #HealthcareSecurity

5

All too often, businesses take a closed-minded approach to innovative concepts. CISO Eric Freeman challenges organizations to harness the power #AI within a well-defined governance framework to maximize outcomes while reducing risk. Learn more via the Trellix blog.

6

This is a great, concise explanation of "infamous "critical infrastructure attacks laying out the attack flow in a way security and non-security experts can understand. Thanks Irfan!

5

Video Log 7: CISO-Legal Collaboration in Mitigating Risk and Responding to Breaches Cybersecurity is no longer purely a technical issue. With a rapidly evolving legal landscape, Chief Information Security Officers (CISOs) and legal teams must collaborate proactively. In this insightful conversation, Jennifer Ruehr emphasizes the importance of early legal involvement in cybersecurity planning, outlines a framework for seamless collaboration, and highlights crucial legal considerations for CISOs in case of potential breaches. Key Takeaways: - Collaboration between CSOs and legal teams should begin from the outset of cybersecurity planning, ensuring alignment with legal and regulatory requirements. - Implementing frameworks like the Driver-Approver-Contributor model fosters seamless collaboration between security and legal teams, clarifying roles and responsibilities. - Proactive tabletop exercises and continuous communication prepare teams to effectively handle cybersecurity incidents, avoiding confusion and ensuring compliance with legal obligations. - Awareness of emerging legal and regulatory challenges, such as SEC cybersecurity requirements and state-specific laws, empowers organizations to proactively adapt their strategies and engage with legal teams for guidance.

19

2 Comments