Navigating Privacy Risks with the NIST Privacy Framework 1.1

CISO Insights: Voices in Cybersecurity

#Tech #News #Tech News #CISO Marketplace

36:16

DANMMMMM…Have I got a show for you! First, a lot of Sister Wives tea - new rumors have surfaced Janelle Brown is leaving the show. Plus, Gabe Brown gives a life update after losing and tragically finding his brother Garrison dead. Sadly, Garrison took his own life in March 2024. Then we head over to discuss the new Welcome To Plathville tea. The first pictures of Micah Plath have surfaced after being beat up by his brother Issac and it doesn’t look good for the future of his modeling career. Lastly, we discuss the latest in the Justin Baldoni v Blake Lively case, Justin is back on social media and it was the perfect social media return. Timestamps: 00:00:00 - Open and new Sister Wives news 00:05:43 - Janelle Brown leaving the show? Sister Wives Closet is officially closed 00:12:45 - A new pic of Micah Plath’s broken nose has surfaced 00:18:18 - Justin Baldoni back on social media and Taylor Swifts team is pissed at Justin Baldoni MY Go Big Podcasting Courses Are Here! Purchase Go Big Podcasting and learn to start, monetize, and grow your own podcast. USE CODE: MOM15 for 15% OFF (code expires May 11th, 2025) **SHOP my Amazon Marketplace - especially if you're looking to get geared-up to start your own Podcast!!!** https://www.amazon.com/shop/thesarahfrasershow Show is sponsored by: Download Cash App & sign up! Use our exclusive referral code TSFS in your profile, send $5 to a friend within 14 days, and you’ll get $10 dropped right into your account. Terms apply Horizonfibroids.com get rid of those nasty fibroids Gopurebeauty.com science backed skincare from head to toe, use code TSFS at checkout for 25% OFF your order Nutrafol.com use code TSFS for FREE shipping and $10 off your subscription Rula.com/tsfs to get started today. That’s R-U-L-A dot com slash tsfs for convenient therapy that’s covered by insurance. SkylightCal.com/tsfs for $30 OFF your 15 inch calendar Quince.com/tsfs for FREE shipping on your order and 365 day returns Warbyparker.com/tsfs make an appointment at one of their 270 store locations and head to the website to try on endless pairs of glasses virtually and buy your perfect pair Follow me on Instagram/Tiktok: @thesarahfrasershow ***Visit our Sub-Reddit: reddit.com/r/thesarahfrasershow for ALL things The Sarah Fraser Show!!!*** Advertise on The Sarah Fraser Show: thesarahfrasershow@gmail.com Got a juicy gossip TIP from your favorite TLC or Bravo show? Email: thesarahfrasershow@gmail.com Learn more about your ad choices. Visit megaphone.fm/adchoices…

29 days ago 16:59

MP3•Episode home

This podcast delves into the NIST Privacy Framework 1.1, a voluntary tool developed to help organizations identify and manage privacy risk while fostering innovation and protecting individuals' privacy. We explore its three core components: Core, Organizational Profiles, and Tiers, and how they enable organizations to understand, assess, prioritize, and communicate their privacy activities. Learn how to use this framework to build customer trust, meet compliance obligations, and facilitate dialogue about privacy practices.

www.compliancehub.wiki/navigating-the-complex-world-of-privacy-with-the-nist-privacy-framework-1-1

148 episodes

Navigating Privacy Risks with the NIST Privacy Framework 1.1

CISO Insights: Voices in Cybersecurity

published 29 days ago

MP3•Episode home

www.compliancehub.wiki/navigating-the-complex-world-of-privacy-with-the-nist-privacy-framework-1-1

148 episodes

#Tech #News #Tech News #CISO Marketplace

All episodes

CISO Insights: Voices in Cybersecurity

1
The Weakest Link: Navigating the Perilous Digital Supply Chain 16:53

7 hours ago16:53

16:53

In today's interconnected world, supply chains are increasingly vulnerable to sophisticated cyberattacks. This episode explores the primary threats impacting these vital networks, from exploiting trust relationships with third-party vendors to the dangers of malware and compromised software. We'll discuss the pervasive threat of ransomware attacks, like those involving the CL0P gang and the MOVEit vulnerability, and the significant risks of data breaches and theft. We'll also touch upon how social engineering and credential theft are used to infiltrate networks, the targeting of supplier-managed resources, and vulnerabilities in IoT and OT devices. Finally, we examine the rise of advanced and AI-powered attacks that are making it harder to detect and defend against these evolving threats. Understanding these risks is the first step in implementing effective cybersecurity supply chain risk management (C-SCRM) practices www.securitycareers.help/navigating-the-perilous-digital-supply-chain-key-cybersecurity-threats…

CISO Insights: Voices in Cybersecurity

1
Bridging the Gap: Translating Cyber Risk for the Boardroom 13:37

1 day ago13:37

13:37

Welcome to "Bridging the Gap: Translating Cyber Risk for the Boardroom." In today's complex digital landscape, Chief Information Security Officers (CISOs) face the crucial challenge of communicating intricate technical risks in a way that resonates with executive leaders and board members. This podcast explores how CISOs can effectively translate technical details into business terms that convey the potential impact of cybersecurity risks and the value of security investments. We'll delve into strategies for speaking the language of the business, using financial, economic, and operational terms to explain cyber risk. Learn how to quantify risks by focusing on the likelihood of cyber events and their potential severities or financial loss. Discover how to align cybersecurity strategies with the company's mission, strategic goals, and operational processes. Crucially, we examine the power of storytelling to make abstract risks tangible and compelling for your audience. Building strong relationships and fostering open communication with different departments and leadership levels is key to creating a collaborative environment where risk can be managed effectively. Tune in to learn how to become a more effective communicator, gain leadership buy-in, and ensure cybersecurity is viewed as a strategic enabler, not just a technical problem www.securitycareers.help/the-modern-ciso-bridging-the-technical-and-business-worlds-for-strategic-impact…

CISO Insights: Voices in Cybersecurity

1
The Resilient CISO: Navigating Stress and Sustaining Security Leadership 12:47

2 days ago12:47

12:47

The role of the Chief Information Security Officer (CISO) is more critical and demanding than ever, placing leaders in a persistent high-stress environment. This podcast delves into the unique pressures faced by CISOs and cybersecurity professionals, including the immense responsibility and potential for blame, resource constraints, excessive workload, and the relentless "always-on" nature of the job. We explore the significant mental health impacts, such as anxiety, burnout, and the psychological toll of managing data breaches, which can include feelings of violation and loss of control. More than just identifying the challenges, this podcast offers insights and strategies for building resilience and fostering well-being, drawing on experiences from security leaders. Learn how supportive organizational culture and leadership, prioritizing well-being, building strong teams, and effective stress management techniques are crucial for not only personal health but also for maintaining optimal professional performance and sustaining a vital career in cybersecurity leadership. Join us to understand how to thrive, not just survive, in the CISO's crucible. www.securitycareers.help/the-cisos-crucible-how-organizational-culture-and-leadership-shape-well-being-and-tenure www.cisomarketplace.services…

CISO Insights: Voices in Cybersecurity

1
Converging Worlds: Securing IoT, OT, and Critical Infrastructure 27:32

3 days ago27:32

27:32

The digital transformation journey in critical infrastructure organizations and other sectors like healthcare is increasingly connecting operational technology (OT) and integrating Internet of Things (IoT) devices. While this convergence of OT and IT creates efficiencies, it also introduces new vulnerabilities and expands the attack surface for cybersecurity threats. Cyber actors are actively exploiting internet-accessible OT assets against critical infrastructure, and these cyberattacks are growing in size, sophistication, and prevalence. Securing OT presents additional complexities compared to traditional IT security, partly due to differences in priorities (Availability, Integrity, Confidentiality in OT versus Confidentiality, Integrity, Availability in IT) and the mix of old and new technology used. Threats can range from insider risks and nation-state attacks to ransomware. In healthcare, integrating IoT devices offers benefits but exposes patients to unique cybersecurity threats, where compromising devices like implantable devices could cause harm The lines between physical security and cybersecurity have become blurred, as physical security systems are increasingly connected and cyber-physical systems bridge the digital and physical realms10. Siloed security functions, treating physical and cyber security separately, mean security leaders lack a holistic view of threats, creating blind spots and hindering rapid identification, prevention, mitigation, and response to complex threats. For example, an unsecured IoT device can serve as a backdoor into enterprise networks, allow unauthorized physical access, or disrupt operations by hijacking physical systems, as seen in the casino fish tank hack. Addressing these challenges requires a shift towards integrated security functions and a holistic approach that aligns physical and cybersecurity efforts. This includes unified risk assessments, enhancing visibility of unmanaged devices, implementing specific security measures like segmentation and hardening, employing robust authentication and secure design principles, establishing continuous monitoring, and developing comprehensive incident response plans, guided by frameworks such as the NIST Cybersecurity Framework, IEC 62443, and C2M2. Leveraging AI and machine learning can further enhance threat detection and anomaly detection. Ultimately, effective integrated security protects cyber-physical infrastructure and enhances resilience against hybrid threats. www.securitycareers.help/securing-the-converged-frontier-why-integrated-security-is-paramount-in-the-age-of-iot-and-ot www.secureiotoffice.world/securing-the-smart-office-why-integrated-security-is-no-longer-optional 25% off - ' LAUNCH ' https://securecheck.tools https://policyquest.diy…

CISO Insights: Voices in Cybersecurity

1
Zero Trust for Critical Infrastructure: Securing the OT/ICS Backbone 35:28

4 days ago35:28

35:28

Delve into the essential and intricate application of Zero Trust (ZT) principles within Operational Technology (OT) and Industrial Control Systems (ICS) environments. This episode explores the unique challenges of securing critical infrastructure, where safety, reliability, and availability are primary objectives, and legacy systems, unique protocols, and often unencrypted communications present distinct complexities compared to traditional IT security models. We'll discuss how the increasing convergence of IT and OT, driven by digital transformation, is reshaping the threat landscape and exposing previously isolated systems. Learn about the tailored roadmap for implementing Zero Trust in these vital sectors, employing a systematic five-step process: defining Protect Surfaces, mapping operational flows, building a Zero Trust Architecture (ZTA), creating policies, and ongoing monitoring and maintenance. Discover how established frameworks like the ISA/IEC 62443 Zone and Conduit Model and the SANS Top 5 Critical Controls for OT/ICS integrate with and are fortified by a Zero Trust approach to enhance security and resilience in the face of evolving threats. www.securitycareers.help/securing-the-industrial-heartbeat-why-zero-trust-is-imperative-and-different-for-ot-ics…

CISO Insights: Voices in Cybersecurity

1
Cyber Resilience Through Bundling: The Regulatory Challenge 17:53

5 days ago17:53

17:53

Explore the emerging practice of bundling cyber insurance with security products and services, a strategy aimed at enhancing cyber resilience by incentivizing policyholders to adopt proactive security measures from the outset. This episode delves into the potential benefits, such as encouraging better cyber hygiene, aligning the long-term goals of insurers and policyholders to reduce incident frequency and impact, improving risk mitigation, providing deeper risk insights through real-time data, offering guidance on effective security controls, and making security more accessible and affordable for SMEs and SLTTs. We also examine the significant concerns and barriers preventing wider adoption. These include historical worries about insolvency, potential impairment of risk assessment and pricing, the risk of discriminatory practices in partnering with security vendors, and inherent conflicts of interest in business-to-business relationships between insurers and service providers. A major hurdle is the complex and varied regulatory landscape across different states, where differing interpretations of anti-inducement, anti-rebating, and anti-bundling laws create uncertainty and a "chilling effect" that hinders innovation and widespread implementation. Discover why navigating these concerns requires careful oversight and regulation to balance cybersecurity effectiveness with market choice www.securitycareers.help/a-cisos-guide-leveraging-cyber-insurance-for-enhanced-resilience-across-the-enterprise www.breached.company/beyond-the-breach-how-cyber-insurance-can-drive-proactive-cybersecurity https://cyberinsurancecalc.com…

CISO Insights: Voices in Cybersecurity

1
Beyond the URL: Decoding Domain Intelligence Threats in 2024 14:40

6 days ago14:40

14:40

In the ever-evolving digital landscape, security teams face the immense challenge of evaluating over a hundred million newly observed domains registered each year. This episode dives into how analytical methods are providing crucial insights into domain intelligence threats. We explore techniques like domain attribute analysis to identify patterns used by threat actors, risk scoring to quantify the likelihood of a domain being malicious, and DGA detection to uncover domains generated by automated systems used in malware and botnets. We also discuss the importance of keyword and topic analysis for identifying domains used in credential harvesting, malware delivery, and scams, and how analyzing new TLDs and likeness to high-profile events helps spot emerging threats and deceptive tactics like typosquatting. Furthermore, we touch upon analyzing webpage attributes to understand attack infrastructure and using anomaly detection to investigate spikes in domain registrations. Ultimately, building a shared knowledge base and fostering community collaboration by sharing insights and observed techniques is essential for strengthening our collective defenses against external threats and making the internet safer. This episode draws insights from an analysis comparing 106 million newly observed domains from 2024 against a large reference set of known malicious domains. breached.company/decoding-the-digital-deluge-how-domain-intelligence-informs-cybersecurity-defenses-in-2024 https://policyquest.diy -> Coupon 15% off -> 'podcast'…

CISO Insights: Voices in Cybersecurity

1
US State Privacy Laws: Navigating the Expanding Consumer Rights Patchwork 45:55

7 days ago45:55

45:55

Explore the complex and rapidly evolving landscape of US state data privacy laws, drawing on insights from recent legislative developments across states like California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, and Texas, plus Washington's focused health data act. We break down the core consumer rights becoming standard nationwide – including the right to access, delete, correct, and opt out of data sales, targeted advertising, and certain profiling. Learn about the heightened focus on sensitive data, such as health information and data from children and teens, often requiring explicit opt-in consent. We discuss key differences like scope thresholds, variations in the definition of "sale", and the emergence of mandatory universal opt-out signals. Understand the differing enforcement approaches by state Attorneys General, the role of cure periods (and their sunsetting in many states), and the limited private rights of action. This episode helps untangle the intricate patchwork, highlights the practical implications for businesses implementing compliance systems, and touches on how consumer expectations and trust are shaped by these new regulations. www.compliancehub.wiki/navigating-the-patchwork-an-in-depth-look-at-u-s-state-comprehensive-privacy-laws/ https://globalcompliancemap.com/ https://generatepolicy.com/…

CISO Insights: Voices in Cybersecurity

1
Beyond Encryption: Ransomware's New Game & Top Exploits of 2024 18:22

8 days ago18:22

18:22

Tune in to explore the rapidly evolving cyber threat landscape of 2024 from Huntress 2025 global Cyber Threat Report, where attackers standardized sophisticated techniques across businesses of all sizes. We dissect the significant shifts in ransomware strategies, including the fragmentation of major groups following takedowns like LockBit, Dharma, Hive, and Phobos. Discover how agile affiliate networks like RansomHub and INC/Lynx emerged, offering high payouts and dominating the landscape. Learn about the pivot from traditional encryption to data theft and extortion as a cost-saving tactic due to improved defenses. We'll also break down the most impactful vulnerabilities exploited, including the critical ConnectWise ScreenConnect flaws (CVE-2024-1709 & CVE-2024-1708) that spurred a major campaign, the zero-day CrushFTP vulnerability (CVE-2024-4040), and the continued exploitation of the older ProxyShell Exchange vulnerability (CVE-2021-31207). Finally, we'll cover the pervasive use of abused tools like RATs, RMM software, malicious scripts, LOLBins, and sophisticated phishing techniques that defined attacker methodologies throughout the year. This episode provides crucial insights for defenders navigating this complex and challenging environment breached.company/navigating-the-new-frontier-key-cyber-threats-exploits-and-tools-of-2024…

CISO Insights: Voices in Cybersecurity

1
The Accelerating Threat Landscape: Inside Modern Cybercrime 15:39

9 days ago15:39

15:39

Delve into the complex and rapidly transforming world of cyber threats. This episode examines notorious ransomware groups like Black Basta, LockBit, BlackCat/ALPHV, Phobos/8Base, Medusa, and Clop, exploring their Ransomware-as-a-Service (RaaS) models and distinctive tactics, techniques, and procedures (TTPs). We also discuss state-sponsored cyber warfare, such as the activities of Iran's APT42 and its impact on critical infrastructure, hacking groups like Scattered Spider, and the individual hacker USDoD, as well as significant law enforcement disruptions like Operation Cronos against LockBit and the arrests of key figures behind Phobos and 8Base. We'll touch upon the emerging challenges of AI-enabled crime and the continuous escalation in the scale and sophistication of cyberattacks. breached.company/global-cybercrime-crackdown-major-law-enforcement-operations-of-2024-2025…

CISO Insights: Voices in Cybersecurity

1
Cybersecurity Unpacked: Breaches, Billions, and AI's Double Edge 10:34

10 days ago10:34

10:34

In this episode, we dive into the recent developments shaping the cybersecurity landscape as of May 2025. We discuss major incidents like the significant breach of the LockBit ransomware gang, which exposed sensitive data including negotiation messages and user credentials. We'll also explore the growing sophistication of financial cyberattacks, highlighted by the uncovering of the "industrial-scale" FreeDrain cryptocurrency phishing operation targeting digital wallets with sophisticated methods. The episode examines landmark legal actions, such as Meta's $168 million victory against spyware firm NSO Group, signaling a pushback against surveillance abuses. We explore the evolving role of AI, which offers speed in threat detection but also introduces risks from vulnerabilities in AI-generated code and "shadow AI". Finally, we look at how governments and corporations are responding with new initiatives to bolster defenses, including the UK's Cyber Resilience programs, CISA's advisories for critical infrastructure, and corporate innovations like HPE's Secure Gateway for small businesses and Microsoft's patching of critical cloud vulnerabilities. Join us as we unpack these challenges and responses in a dynamic digital world. www.compliancehub.wiki/cybersecurity-frontlines-recent-breaches-legal-battles-and-the-double-edged-sword-of-ai…

CISO Insights: Voices in Cybersecurity

1
The Accelerating Adversary: Inside the 2025 Threat Landscape 13:52

10 days ago13:52

13:52

Join us for a deep dive into the Global Threat Landscape Report 2025 by FortiGuard Labs. This episode explores the dramatic escalation in cyberattacks, revealing how adversaries are moving faster than ever, leveraging automation, commoditized tools, and AI to gain advantage. We'll shed light on the surge in automated reconnaissance, the evolving darknet ecosystem where credentials and corporate access are traded, and how AI is supercharging cybercrime through tools like FraudGPT and deepfakes. Discover the trends in exploitation volumes targeting exposed systems and IoT devices, the stealthy nature of post-exploitation tactics including lateral movement and C2, and the persistent challenges in securing cloud environments plagued by misconfigurations and identity compromise. We'll also break down the changing adversary landscape, from fragmented ransomware groups and the rise of RaaS on the darknet to the dangerous convergence of hacktivism and ransomware and the ongoing operations of state-sponsored actors. Finally, we'll discuss the critical need for organizations to shift from reactive defense to proactive Continuous Threat Exposure Management (CTEM) to counter this accelerating threat. breached.company/navigating-the-accelerating-threat-landscape-proactive-defense-in-the-era-of-adversary-acceleration…

CISO Insights: Voices in Cybersecurity

1
2025 Cyber Attack Playbooks: Navigating the Future Threat Landscape 42:13

11 days ago42:13

42:13

This podcast delves into the critical insights found within the 2025 Cybersecurity Attacks Playbooks, exploring the diverse and evolving threat landscape organizations face. We examine playbooks covering threats from AI-enhanced phishing and advanced ransomware to the complexities of supply chain compromises, zero-day exploits, and AI-powered malware. We also discuss emerging threats like deepfake social engineering, quantum computing vulnerabilities, and securing IoT devices. Each episode breaks down the essential stages outlined in the playbooks for specific attacks: Preparation to build foundational defenses, Detection to identify threat indicators, Analysis to understand the attack's scope and methods, Containment/Eradication tailored to the specific threat vector, and Recovery to restore operations and resilience. Gain a deeper understanding of modern attack vectors like credential stuffing, fileless malware, rogue access points, SQL injection, steganography-based data exfiltration, and cache poisoning, as well as network attacks like homograph attacks, Denial-of-Service (DoS), and watering hole attacks, and complex infiltrations like island hopping and Advanced Persistent Threats (APTs). Tune in to learn how the playbooks guide organizations through detection, response, and the vital Lessons Learned process to continuously improve their cybersecurity posture. www.securitycareers.help/navigating-the-2025-threat-landscape-preparing-for-and-responding-to-advanced-cyber-attacks…

CISO Insights: Voices in Cybersecurity

1
Beyond the Scan: Unmasking Hidden Risks and Unfixed Flaws in the Age of AI 20:13

12 days ago20:13

20:13

In this episode, we dive deep into the findings of the State of Pentesting Report 2025 to explore the real state of cybersecurity. Organizations may feel confident, but pentesting consistently reveals hidden, exploitable vulnerabilities that automated scanners miss. We'll uncover the most significant risks identified through human-led pentests, from common web and mobile application flaws like Server Security Misconfiguration and Missing Access Control to the rapidly emerging and uniquely challenging security issues in AI and Large Language Models (LLMs). Learn why AI/LLM tests have a significantly higher proportion of serious findings and the specific threats like Insecure Output Handling, Prompt Injection, and Unbounded Consumption. More critically, we'll address the disconnect between perceived security and reality by examining why less than half of all findings ever get resolved and how even serious vulnerabilities often remain open for months or years, far exceeding targeted SLAs. We'll explore the factors influencing this remediation struggle, including criticality, pentest type, organizational size, industry, and internal processes. Tune in to understand the critical need for a programmatic approach to offensive security and the challenges teams face in fixing what pentesters find. www.securitycareers.help/beyond-the-scan-the-hidden-reality-of-unfixed-security-risks-revealed-by-pentesting-data…

CISO Insights: Voices in Cybersecurity

1
Building Cyber Warriors: The Evolving Cyber Professional 33:42

13 days ago33:42