Consumers should know and exercise their #privacy rights. Here's a summary of the California Consumer Privacy Act (CCPA) at #PalUpNow!. This includes the development of new measures that extend #compliance to #California residents and beyond.
#CCPA #USA
#global
#CISO #InfoSec #DevSecOps #legal
CCPA Update From DPO Office: California Consumer Privacy Act
https://palupnow.com/blogs/f/ccpa-update-from-dpo-office-california-consumer-privacy-act
Hoe kunnen bestuurders invulling geven aan hun verantwoordelijkheid op digitaal gebied? Ga eens dineren met je #CISO, adviseert Jasper Nagtegaal van @wijzijnrdi Digitale Infrastructuur (RDI). Vind een gemeenschappelijke taal.
https://ibestuur.nl/artikel/dineren-met-de-ciso/
Stop.
Haal adem.
Zeg iets aardigs.
Stel een vraag.
I think #Microsoft have given themselves enough rope with #Recall. For Reasons, running anything like it would be flat out, no discussion, illegal in my org. As #CISO I’m sensitive to such things… :)
Sure we run a MSFT shop, and sure they theoretically have access to all that data anyhow - can’t [viably yet] process ciphertext, they see all the cleartext at some point.
The rope part is that argument. If MSFT argues that they see all data *anyway* so why not Recall, they burst our collective hallucination that various #GDPR agreements are actually worth a damn [Narrator: They’re not].
And then, my #infosec friends, I get to eject Microsoft - and coincidentally all other #US #cloud services as well as collateral damage - and finally build a full scale Linux/FOSS environment.
It’ll be more fun than I can #recall!
Are you prepared
Your cyber incident response plan is how you prepare for a possible — but if we are being honest... really, a probable #security incident or data breach. 
And no single plan will work for everyone. So, let's talk about building out the the best possible cyber incident response plan, for YOU. 
A good place to start is with these 5 best practices:
Assigning roles and responsibilities
Centralizing the incident response process
Identifying attack scenarios
Creating high-fidelity alerts
Defining reporting requirements
Get the details on "how" and "why" for each of these important steps, here.
https://graylog.org/post/5-best-practices-for-building-a-cyber-incident-response-plan/ #cybersecurity #incidentresponse #infosec #CISO #databreach
FFFFFFFound in the archive
I was cleaning up my hard drive when I found an unpublished blog post I had written in 2008 during my stint at American Airlines as an information security architect. The funny thing is that my views here have stood the test of time during my career as a security professional. If someone asked me to write on this topic in 2025 (17 years after I first wrote it), I don’t know if my current take would be much different. It would be way saltier and cynical, but otherwise unchanged.
Tap Dancing in a Minefield
or
How to be an Effective Security Professional
I am learning very quickly that an information security professional must wear many hats and be a subject matter expert on a wide array of subjects. But ultimately, no matter how much training and how many controls and policies are put into place, the effectiveness of a security pro will be measured by the amount of buy- n the business has into security as a concept and how much security is on the minds of architects, developers, and administrators. If you don’t have their cooperation, you will find yourself chasing down and trying to correct fundamental problems that could have been prevented in the early stages of the life cycle. You will have a group of very talented people trying to find ways around your controls and policies from within your enterprise. Definitely not a win-win. So, how do security professionals deal with this issue? How do we get everyone on the same page to march toward a more secure enterprise? I find that there are times when the art of social engineering comes in quite handy when dealing with people within your own company. Depending on the ego, excuse me, person I am dealing with and my knowledge of the subject, I will employ some of the following techniques in order to better secure applications and systems from the ground up.
Let’s discuss what the options are…
I use this one when people come to me early in the SDLC. I want to encourage this behavior, so I will absolutely let the developers and architects help guide the security profile of their project. I actually enjoy this method the most as I learn the most from discussing why certain security features or functions may not be feasible, but something I hadn’t thought of could be used in its place.
If you were going to get into this app, how would you do it?
This is for the times when I am shown a completed architecture but am little unfamiliar with the technology deployed or if I don’t see any apparent weakness in the proposal. I don’t use it that often, but when I do, architects and developers typically have fun with the question and come up with some pretty wild scenarios I would never lose sleep over.
The Socratic Method (or Doing the Machiavelli)
This technique is for the times when I am given an architecture or proposal that has holes that are pretty easy to see or if I know which direction I want to head in but don’t want to issue edicts. I will start asking pointed questions to get the architects and developers thinking on a certain track, slowly (sometimes painfully) leading them to the design flaws or the inherent weaknesses. When I get them to see the issue, I will begin another line of questions that gets them towards the solution I think is best. Of course, I will listen to them if they convince me that fears are unfounded or if there are mitigating controls I don’t see or didn’t know about.
What do you want me to say?
I took this one straight from the auditors’ playbook. Sometimes, political pressures are put upon architects and developers to do things they know are wrong. So they come to me looking for my disapproval along with the rationale they can take back to their superiors. Sometimes, the security professional’s role is that of the official bad guy, and who am I to disappoint?
If we could tear this down and start over…
This one is reserved for legacy systems that are being refreshed using the same design and architecture as the previous version. Whether the reason is technical constraints, political pressure, or intellectual laziness, I try to reinvent the wheel whenever possible, so I use this method to get the creative juices of the developers and architects going. Sometimes, the architecture gets approved as-is with minimal changes, but I have also seen complete redesigns after I have posed this question in a meeting.
You will respect my authoritah!
This is the nuclear option for security professionals. I have to use this one every so often, but I have it at the ready at all times. If a project manager, developer, business unit manager, etc., are not willing to budge on their proposal despite my attempts to get them to make their system more secure, I will dig my feet in, draw the proverbial line in the sand, and basically force someone above my head to override me. I guess, in some ways, it’s a CYA maneuver that shifts the blame if something goes wrong and my vocalized fears are realized.
This is a very short list, and most of the time, I use techniques that incorporate more than one of the above, with others I haven’t included. Securing a large enterprise is a difficult task that cannot be solved with technology alone. I am fairly confident I will write about this subject in the future, perhaps with some concrete examples of how I used one of the techniques to make an insecure proposal into a (more) secure system.
2008 Dan at WorkIs your organization truly encrypting email or just assuming it's secure?
Despite rising threats and regulatory pressure, encrypted email adoption remains low in many industries. Most sensitive messages are still exposed after delivery—leaving you open to breaches, insider threats, and compliance risks. Principal Consultant Ben Kast dives into the technical details in his new blog, as well as advice on the pros and cons of different email encryption options.
Check it out: https://www.lmgsecurity.com/securing-the-email-flow-implementing-encrypted-email-in-microsoft-365-exchange-and-onward/
The post-quantum era is closer than you think!
It’s time to tighten up that security hygiene and future-proof your organization’s data before quantum computing renders today’s encryption obsolete.
Here’s your crypto checklist:
Audit your encryption infrastructure
Automate certificate/key management
Educate teams on quantum risk
Pilot NIST’s post-quantum algorithms
Start now—retrofitting later will cost you
Quantum threats don’t wait. Neither should we.
#CyberSecurity #PostQuantum #Encryption #CISO #ITOps #QuantumComputing #CyberResilience
https://www.darkreading.com/vulnerabilities-threats/post-quantum-planning-security-hygiene
High-severity cloud alerts jumped 235% in 2024 — part of a 388% overall rise in #cloud attacks, per Palo Alto Networks. Threats are more targeted than ever. Need a cloud #security checkup? Please contact us.
https://www.darkreading.com/cyber-risk/high-severity-cloud-security-alerts-tripled-2024
Heading to RSA Conference 2025? Let’s connect!
Let’s grab a coffee and chat about today’s biggest cybersecurity challenges! https://www.lmgsecurity.com/contact-us/
We also invite you to join @sherridavidoff & @MDurrin's must-see sessions:
Session 1: From Leak to Breach – How Hackers Use AI to Exploit Stolen Source Code | April 28, 9:40 AM
Session 2: Deepfake Cyber Extortion – A Tabletop Learning Lab | April 28, 1:10 PM (Limited capacity—reserve your spot!)
We hope to see you there!
CISO Alert: Security Tool Fatigue Is Real — and Dangerous
More tools ≠ more security. In fact, 68% of orgs use 11+ security tools — and many are facing alert fatigue, talent strain, and visibility gaps.
More dashboards = less clarity. Tool sprawl leads to noise, missed threats, and wasted budget. Redundant tools ≠ value. Many platforms overlap, offering the same functions in different UIs. Talent gets stretched thin. New tools require onboarding, management, and integration. The illusion of coverage. Without full ecosystem visibility, risks go unnoticed and unowned.
Solutions that work:
・Take inventory of tools and evaluate actual usage.
・Prioritize integration over expansion.
・Invest in training and unifying data—not flashy features.
・Embrace platform consolidation for long-term security resilience.
#CyberSecurity #CISO #SecurityStrategy #ToolFatigue #SecurityOps #Visibility #ThreatDetection #security #privacy #cloud #infosec
https://www.helpnetsecurity.com/2025/04/07/ciso-security-platform-fatigue/
Sometimes being a #CISO makes me a little sad. Not stressed, not frustrated - sad.
It’s the days when I fail to convince some part of the business to improve their #security posture in some fully critical way, on the #BCP / #DR level, and the manager of that part of the business lets slip their true view of #infosec and #IT:
They truly think the whole information processing infrastructure they use every millisecond of their work is fully replaceable, at will. That no intricate and evolved symbiosis is there. So rather than GAF about securing it, they’d ”just replace it if it breaks”.
These are smart highpowered people, but utterly priviliged in the way they can afford to think their unique skills will offer them a new job, if their negligence to be responsible in this one destroys the org.
I see many sinners in this group, but more than anywhere else among creatives - text, art and code.
A good Reality Slap might do wonders.
Splash zone @CypherCon for a talk with bentenpas and @alyssam_infosec
Are You Ready for Red Team Penetration Testing?
In our latest blog, penetration testing expert @tompohl shares how to choose the best test for your organization's cybersecurity maturity stage. We'll cover the difference between penetration testing and red team penetration testing, how to determine if your company is ready for a red team assessment, and tips for planning your test that will maximize your ROI!
Read More: https://www.lmgsecurity.com/are-you-ready-for-red-team-penetration-testing/
Worried about making your #flight
plan public in case it endangers your property and family?
Sawyer at #PalUpNow! leads #information #security. They #anonymize your profile such that your #travel plans can't be tied to you. Your personal #data is shared only after you're matched.
#CISO #priv...Sawyer, A PalUpNow! Bot, Reduces Risk And Increases Compliance
https://palupnow.com/blogs/f/sawyer-a-palupnow-bot-reduces-risk-and-increases-compliance
As a #CISO I am daily both astonished and dismayed at the number of coworkers who say ”Whatever, if I can’t work in this insecure way with these vulnerable tools, IDGAF, I’ll go somewhere I can”. Even from *engineers*.
Dude, you’re breaking The Code, figuratively and literally. We techs are supposed to engi things more cleverly and robust than anyone could expect - not build mansions on stilts.
Are #infosec people the only ones left with some pride and sense of duty?
Are Encryption Backdoors Putting Your Organization at Risk?
In this clip, @sherridavidoff and @MDurrin explain why encryption backdoors are a nightmare for organizations, creating security gaps that cybercriminals can exploit.
Watch this full episode of Cyberside Chats to hear Sherri and Matt break down Apple’s battle against the UK’s demands for backdoor access, the worldwide backlash, and what it all means for cybersecurity professionals.
We'll cover: 
Listen to the podcast: https://www.chatcyberside.com/e/the-encryption-battle-security-savior-or-cyber-risk/
Someone send the CISO Musical to me. I kinda want to see it, ngl. It's hilarious 
.
Cybersecurity budgets: Cost or competitive edge? I contributed insights to this @CyberhavenSec article on how CISOs can prove ROI, align security w/business goals, and secure boardroom buy-in. Read more: https://zurl.co/dBmhk
#Cybersecurity #CISO #RiskManagement #Leadership
Is Your Security Communications Strategy Ready for 3rd Party Incidents?
Join us this Wednesday (April 2) for a new Discernible Drill where you'll step into the role of a #CISO facing a real-world third-party vulnerability scenario.
In this hands-on simulation, you'll:
Navigate stakeholder communication when disclosure isn't legally required
Balance transparency values against security considerations
Turn a potential reputation challenge into a trust-building opportunity
Leverage existing company assets in your response strategy
Only 24 hours left to subscribe & join this session!
Subscribe now: https://discernibleinc.com/drills
