CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

Our Latest Posts

Thorn: Digital Defenders of Children

Everyone I have ever spoken to about Thorn is a huge supporter of this group. We are so proud to have them involved with our 30 April 2015 Synergy Forum.

Thorn leverages technology to combat the sexual exploitation of children. They partner with tech companies, governments and other non-governmental organizations to execute on their mission. They aim to deter predatory behavior, rescue victims, and protect vulnerable children.

Do you wonder why they named the group Thorn?  Watch this short clip for that plus more on their mission and some of their interesting technical news.

For more on Thorn visit Thorn

For other resources see:

SCADA and ME: A Book For Children and Management

TikTok now faces a data privacy investigation in the UK, too

Spookstock is secretive charity concert to help the children of fallen intelligence professionals

Influential National Association of Insurance Commissioners (NAIC) Moves On Cyber

Zoom: Leader in video-first unified communications

Influential National Association of Insurance Commissioners (NAIC) Moves On Cyber

naicCybersecurity practitioners and policymakers have long been discussing the potential positive benefits of smart insurance policy and standards to reduce risk. Of the many actions and activities we see in the insurance world today, the news of NAIC involvement is seen as particularly interesting.

What is the NAIC?

The National Association of Insurance Commissioners (NAIC) is the U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. Through the NAIC, state insurance regulators establish standards and best practices, conduct peer review, and coordinate their regulatory oversight. NAIC members form the national system of state-based insurance regulation in the U.S.

What have they announced?

NAIC has coordinated two drafts which will provide comprehensive policy for oversight of insurance regarding cybersecurity:

The first is a draft of Principles for Effective Cybersecurity Insurance Regulatory Guidance, developed by the Cybersecurity (EX) Task Force. This document will help state insurance departments identify uniform standards, promote accountability, and provide access to essential information. It also outlines the process for working with the insurance industry to identify risks and offer practical solutions.

The second draft document: the Annual Statement Supplement for Cybersecurity policies, comes from the NAIC’s Property and Casualty Insurance (C) Committee.

Here are the 18 draft principles from this first document:

NAIC’s Principles for Effective Cybersecurity Insurance Regulatory Guidance

  • Principle 1. Insurance regulators have a significant role and responsibility regarding protecting consumers from cybersecurity risks.
  • Principle 2. Insurance regulators have a significant role and responsibility regarding the insurers’ efforts to protect sensitive customer health and financial information.
  • Principle 3. Insurance regulators have a significant role and responsibility in protecting the sensitive information housed in insurance departments and at the NAIC.
  • Principle 4. Insurance regulators recognize the value of collaboration in the development of regulatory guidance with insurers, insurance producers, consumers and the federal government with the goal of a consistent, coordinated national approach.
  • Principle 5. Compliance with cybersecurity regulatory guidance must be flexible, scalable, practical and consistent with the national efforts embodied in the National Institute of Standards and Technology (NIST) framework.
  • Principle 6. Regulatory guidance must consider the resources of the insurer or insurance producer.
  • Principle 7. Effective cybersecurity guidance must be risk-based and threat-informed.
  • Principle 8. Insurance regulators should provide appropriate regulatory oversight, which includes but is not limited to, conducting risk-based, value-added financial examinations and/or market conduct examinations regarding cybersecurity.
  • Principle 9. Planning for crisis response for insurance regulators, insurers, and insurance producers is an essential component to an effective cybersecurity program.
  • Principle 10. The effective management of cybersecurity by third parties and service providers is essential for protection of consumer’s sensitive personal health and financial information.
  • Principle 11. Information sharing is important for risk management purposes; however, it must be limited to essential cybersecurity information and protect sensitive confidential information.
  • Principle 12. Cybersecurity risks should be included and addressed as part of an insurers and insurance producers Enterprise Risk Management processes.
  • Principle 13. High level information technology internal audit findings should be discussed at the insurers and insurance producers Board of Director meetings.
  • Principle 14. It is essential for insurers and insurance producers to join Financial Services Information Sharing and Analysis Center (FSISAC) to share information and stay informed about cyber and physical threat intelligence analysis and sharing.
  • Principle 15. Sensitive data collected and stored and transferred inside or outside of an insurers or insurance producers network should be encrypted.
  • Principle 16. Periodic and timely training for employees of insurers and insurance producers regarding cybersecurity issues is essential.
  • Principle 17. Enhanced solvency oversight is needed for insurers selling cyber insurance to businesses and families.
  • Principle 18. Additional data on the sale of cyber insurance products should be collected to assist insurance regulators with oversight of financial and market regulation.

Regarding  Principle 7. Effective cybersecurity guidance must be risk-based and threat-informed.  We most strongly endorse that point. Our Daily Threat Brief is now informing executives across most every sector of the economy and can provide a strong baseline on the threat to inform cyber security guidance. Subscribe for free at https://www.oodaloop.com 

For more information, visit www.naic.org.

For more see:

The Principles of Enterprise Technology

Top 10 CTO Principles

Marc Andreessen on the future of technology and implications for interactions between government and citizens

Thorn: Digital Defenders of Children

The Cybersecurity Framework in Action: An Intel Use Case

On 3 March 2015 I participated in a deep dive into some key policies and processes used by Intel (NASDAQ:INTC) to continue to reduce the business risk of cyber threats. This review was presented by Malcolm Harkins, Intel’s Chief Security and Privacy Officer. Malcolm was briefing how Intel corporation leveraged the NIST-coordinated Framework for Improving Critical Infrastructure Cybersecurity to create a more mission-focused cyber security effort across their corporation. Their approach is also helping establish a common language with suppliers to Intel, significantly extending the approach.

Intel’s use of the framework clearly got results. You can review them yourself online at http://intel.com/federal But here are some of the things that jumped out at me during the presentation:

• The framework was used as a living risk management tool, not at static compliance checklist. This is key.
• The pilot resulted in reusable tools and best practices for the company
• The pilot also produced feedback for NIST which will impact and continuously improve the overall framework.
• Benefits of the framework include an ability to more quickly focus in on areas of the enterprise security posture that need focus.
• This also supports collaboration, inside the organization and also to other organizations external to the corporation.
• Intel expects to continue to harmonize their internal risk management methodologies, technologies and language across their corporation through use of the framework.
• They also are using the framework to better inform internal risk tolerance discussions.
• Intel executives see the framework as a way to ensure cyber security activities are focused more on risk reduction vice just compliance. This has always been leadership’s intent, but the framework makes it easier.

We have written about the NIST framework here before and have long seen the value (it has helped us help many of our clients out). Intel corporation publishing a use case like this will help convince many other companies to take a look at the framework and that will help more firms adopt a common language in the security related elements of people, process, technology and the overall ecosystem.

For firms like our, we will continue to leverage this framework to inform our own security and as one of the key tools leveraged in our interactions with clients. We thank Intel for publishing their case study, it is a fantastic and very helpful contribution to the community.

DJ Patil, First US Chief Data Scientist

Everyone in the big data movement knows of DJ Patil. What you might not know about him is that he is one of many technologists who took government experience and service into the private sector to help contribute there. Yep, while everyone else, including Wired, is saying this is a story about a technology executive “defecting” to government (yes Wired used that word: see the Wired piece here), the reality is the story is one of yet another great government technologist taking lessons from his government service and smartly using them in the private sector.  You see for DJ this is about going back to government, not dipping his toe in for the first time. DJ spent time in the DoD, in the Defense Threat Reduction Agency, as a science and technology fellow. And my view is we should honor that service as much as we honor his time at eBay, LinkedIn and the VC world.  DJ is a hero to many technologists for his great work. But he also deserves our thanks for his early service to the government.

Now he deserves thanks again for his return to service.

So, sorry if I take issue with Wired. This is not DJ “defecting.”  This is DJ returning home.

Here is the announcement by Megan Smith on the Whitehouse blog:

The White House Names Dr. DJ Patil as the First U.S. Chief Data Scientist

Today, I am excited to welcome Dr. DJ Patil as Deputy Chief Technology Officer for Data Policy and Chief Data Scientist here at the White House in the Office of Science and Technology Policy. President Obama has prioritized bringing top technical talent like DJ into the federal government to harness the power of technology and innovation to help government better serve the American people.

Across our great nation, we’ve begun to see an acceleration of the power of data to deliver value. From early open data work by the National Oceanic and Atmospheric Administration (NOAA), which provides data that enables weather forecasts to come directly to our mobile phones, to powering GPS systems that feed geospatial data to countless apps and services — government data has supported a transformation in the way we live today for the better.

DJ joins the White House following an incredible career as a data scientist — a term he helped coin — in the public and private sectors, and in academia. Most recently, DJ served as the Vice President of Product at RelateIQ, which was acquired by Salesforce. DJ also previously held positions at LinkedIn, Greylock Partners, Skype, PayPal, and eBay. Prior to his work in the private sector, DJ worked at the Department of Defense, where he directed new efforts to bridge computational and social sciences in fields like social network analysis to help anticipate emerging threats to the United States.

As a doctoral student and faculty member at the University of Maryland, DJ used open datasets published by NOAA to make major improvements in numerical weather forecasting. He holds a bachelor’s degree in mathematics from the University of California, San Diego, and a PhD in applied mathematics from the University of Maryland College Park. DJ has also authored a number of influential articles and books explaining the important current and potential applications of data science.

As Chief Data Scientist, DJ will help shape policies and practices to help the U.S. remain a leader in technology and innovation, foster partnerships to help responsibly maximize the nation’s return on its investment in data, and help to recruit and retain the best minds in data science to join us in serving the public. DJ will also work on the Administration’s Precision Medicine Initiative, which focuses on utilizing advances in data and health care to provide clinicians with new tools, knowledge, and therapies to select which treatments will work best for which patients, while protecting patient privacy.

As part of the CTO team, DJ will work closely with colleagues across government, including the Chief Information Officer and U.S. Digital Service. DJ’s work will also include data science leadership on the Administration’s momentum on open data and data science.

Over the past six years, the Obama administration has made historic progress in this area. In addition to making more than 138,000 data sets available to the public for innovation and entrepreneurship, the Administration is also empowering Americans with secure access to their personal data and expanding our capacity to process and examine large and complex datasets. Utilizing data for innovation holds amazing potential for the future of our country.

DJ’s work will help ensure government remains effective and innovative for the American public in our increasingly digital world. We welcome DJ to our team.

Megan Smith is the U.S. Chief Technology Officer.

 

Don’t Buy A Samsung Smart TV Till You Understand The Threat To Your Business And Personal Information

wpid-Samsung-PN51D550-51-Inch-3D-Plasma-TVThe fine print offered by Samsung regarding their new Smart TV is something you need to dwell on.

Not only does the TV recognize your voice, but it will record your conversations even when you do not know you are being listened to. Additionally, this information will be used by Samsung. And, according to their fine print, may also be used by third-parties they decide to work with.

But, they say, don’t worry, they take our privacy very seriously.

This story was first broken by @ShaneHarris of The Daily Beast and then also reported on by @ChrisMatyszczyk of CNET. We all owe these writers a big debt of gratitude for bringing this to our attention.

The Samsung privacy note reads, in part: “Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”

We will continue to track the reporting on the topic.

Our recommendations:

  • For now you have to play it safe. The threat to your personal or business privacy is too great for you to have one of these devices anywhere. Do not order one.
  • If you have already ordered one, return it. Get something safer.
  • If you already ordered a Samsung smart TV and if returning it is not an option, disconnect it from the Internet.
  • If you are gutsy and a gambler, maybe order one of these for one of your competitors. Some of their conversations might end up at some Samsung third party vendor that gets compromised by anonymous (sorry, just poking fun at Samsung with this one, we actually don’t recommend anyone, even your competitors, use this).

Bottom line: make your own risk-based decision, but arm yourself with all the facts first, and till you have all the facts don’t get this device.

Simplifying The Overwhelming Cyber Security World For Boards of Directors

We have previously reported on the great, community coordinated and extensively vetted work on cyber risks and governance by organizations like The Institute of Internal Auditors (IIA), The Information Systems Audit and Control Association (ISACA),The Internet Security Alliance (ISA), and The National Association of Corporate Directors (NACD). For example, see our post titled Cyber Security and Corporate Governance: The five principles every corporate director should embody. The principles there and the execution tips provided in that post remain valid, with the only big change being there is even more of a sense of urgency now.

Another source of insight we like is the Security and Exchange Commission. The recommendations and guidance they have been putting out is in consonance with NACD (which is good don’t you think) and is absolutely worth reviewing.

All board members should take a look at the SEC Guidance on disclosure obligations relating to cybersecurity risks and cyber incidents.

Another reference with good context is the very simply articulation of cyber risk actions plans for boards provided by  SEC Commissioner Luis A. Aguilar in a June 2014 presentation at the “Cyber Risks and the Boardroom” conference at the New York Stock Exchange titled “Boards of Directors, Corporate Governance and Cyber Risks: Sharpening the Focus.”

Here is the gist of what he recommends:

  • Cyber-risk must be considered as part of the board’s overall risk oversight (“boards that choose to ignore, or minimize, the importance of cybersecurity oversight responsibility, do so at their own peril.”)
  • Boards should assess the corporation’s cybersecurity measures including corporate policies and annual budgets for privacy and IT security programs.
  • Consider the creation of a separate enterprise risk committee on the board (this is already required by Dodd-Frank for large financial institutions).
  • Ensure the company have the right personnel to carry out effective cyber-risk management and provide regular reports to the board on breaches and IT risks. Know who is responsible for cybersecurity risk oversight and for ensuring the adequacy of the company’s cyber-risk management practices.
  • Prepare for breach! The company must be ready to respond fast. There is no one-size-fits-all way to do this, but preparation is key. Response plans should include a communications and crisis response plan.
  • Take action to curtail the knowledge gap and focus director attention to known cyber-risks. This could include mandatory cyber-risk education for directors, or ensuring that the board be at least adequately represented by members with a good understanding of information technology issues that pose risks to the company.

We we so glad to see this point about the need for boards to take action to address the knowledge gap. The entire thesis of our book on The Cyber Threat is that this knowledge gap needs to be addressed right away so better decisions can be made. For boards that are looking for more, including tailored threat briefs, quick turn cyber assessments or longer term end to end cyber posture evaluations please Contact Us Here.

FBI Provides An Update On #SonyHack Investigation Including Some Tech Details On Attribution

The FBI just posted the first official written articulation of why they believe North Korea is linked to the ongoing Sony Hack.

As someone who has worked with FBI investigators in the past I have to tell you they do not go public like this unless they have evidence.

It is true they have been wrong before, and it is a very American trait to be skeptical of government assessments. But this is important context that should inform the dialog for sure.

I believe the FBI is right about the DPRK being involved, but having seen complex situations before it is also reasonable to assume others were also playing key roles. I believe this attack involved many actors including some unwitting insiders and some witting criminals. There is always a chance that groups like the Chongryon were somehow playing parts. But the DPRK was involved.

As for me, the most important thing the FBI report tells us all is that organizations should take steps now to enhance their defense. This includes establishing the right relationship with law enforcement before breach so you will know who to plug in to after breach.

Here is what the FBI had to report:

Update on Sony Investigation

Washington, D.C.December 19, 2014 FBI National Press Office(202) 324-3691

Today, the FBI would like to provide an update on the status of our investigation into the cyber attack targeting Sony Pictures Entertainment (SPE). In late November, SPE confirmed that it was the victim of a cyber attack that destroyed systems and stole large quantities of personal and commercial data. A group calling itself the “Guardians of Peace” claimed responsibility for the attack and subsequently issued threats against SPE, its employees, and theaters that distribute its movies.

The FBI has determined that the intrusion into SPE’s network consisted of the deployment of destructive malware and the theft of proprietary information as well as employees’ personally identifiable information and confidential communications. The attacks also rendered thousands of SPE’s computers inoperable, forced SPE to take its entire computer network offline, and significantly disrupted the company’s business operations.

After discovering the intrusion into its network, SPE requested the FBI’s assistance. Since then, the FBI has been working closely with the company throughout the investigation. Sony has been a great partner in the investigation, and continues to work closely with the FBI. Sony reported this incident within hours, which is what the FBI hopes all companies will do when facing a cyber attack. Sony’s quick reporting facilitated the investigators’ ability to do their jobs, and ultimately to identify the source of these attacks.

As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

  • Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
  • The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
  • Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.

We are deeply concerned about the destructive nature of this attack on a private sector entity and the ordinary citizens who worked there. Further, North Korea’s attack on SPE reaffirms that cyber threats pose one of the gravest national security dangers to the United States. Though the FBI has seen a wide variety and increasing number of cyber intrusions, the destructive nature of this attack, coupled with its coercive nature, sets it apart. North Korea’s actions were intended to inflict significant harm on a U.S. business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior. The FBI takes seriously any attempt—whether through cyber-enabled means, threats of violence, or otherwise—to undermine the economic and social prosperity of our citizens.

The FBI stands ready to assist any U.S. company that is the victim of a destructive cyber attack or breach of confidential business information. Further, the FBI will continue to work closely with multiple departments and agencies as well as with domestic, foreign, and private sector partners who have played a critical role in our ability to trace this and other cyber threats to their source. Working together, the FBI will identify, pursue, and impose costs and consequences on individuals, groups, or nation states who use cyber means to threaten the United States or U.S. interests.

Other Resources:

FBI vs Apple: Context from a cyber law perspective

The Attack We Have Long Predicted Just Occurred: Highly destructive cyber attacks drop a power grid

Why Big Data And The Internet of Things Are A Match Made In Heaven

Don’t Buy A Samsung Smart TV Till You Understand The Threat To Your Business And Personal Information

7012 Regs and Cyber insurance on collision course with small business

 FBI vs Apple: Informed Dialog on Privacy vs Security Is Key

Recorded Future Provides Awareness Into Issue of Government Credentials On The Open Web

Examining New Mission-Focused Capabilities Coming From The Cloudera And Intel Engineering Partnership

The video at this link and embedded below captures the content and dialog of a webinar which examined new capabilities of Cloudera and Intel, with a focus on capabilities that provide a full stack solution to many key enterprise mission needs. The webinar included insights by Cloudera’s Senior Director of Technology Webster Mudge and Intel’s Enterprise Technology Specialist Ed Herold, plus questions from an informed audience. Results of the recent CTOlabs.com white paper on this topic were also presented.

 

https://www.youtube.com/watch?v=0KgxCb2X_Bo

This information can inform your design trades and is relevant to enterprise architects, engineers and line of business leaders.

We would love to get you feedback on the webinar video and/or white paper. Please contact us with your thoughts.

We track Cloudera in our list of Big Data disrupters.

We track Intel as a Tech Titan

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]