Cyber Attacks, Supply Chain Security

Top Cyber Attacks and Data Breaches: May 2023 Round Up

Posted on June 7, 2023June 7, 2023 by Or Kadosh

07
Jun

In an era dominated by digital connectivity, the frequency and impact of data breaches continue to escalate, leaving individuals and organizations vulnerable to devastating consequences. From state-sponsored hacking campaigns to opportunistic cybercriminals, the realm of data security is constantly under siege. Recent events have once again thrust data breaches into the spotlight, as major corporations and industry giants grapple with the aftermath of malicious intrusions. In this blog post, I will delve into a series of alarming incidents that have unfolded in May 2023, shedding light on the tactics employed, the extent of compromised information, and the potential ramifications for affected individuals and businesses. Brace yourself for an eye-opening exploration of the evolving threat landscape as we navigate the treacherous waters of data breaches and their far-reaching impact.

On May 24,2023, Microsoft reported that it found targeted malicious activity by Volt Typhoon, a state-sponsored group from China, aiming to access unauthorized credentials and explore critical infrastructure networks in the US. This campaign supposedly intends to disrupt communication infrastructure between the US and Asia during future crises. Volt Typhoon has been active since mid-2021, primarily targeting critical infrastructure organizations in Guam and other US regions across various sectors. They employ stealth techniques, living-off-the-land methods, and manipulate systems using command line instructions. The threat actor maintains persistent access and attempts to conceal their activities by routing network traffic through compromised SOHO network equipment.

Sysco, a major U.S. multinational food distribution corporation, recently revealed that approximately 126,243 current and former employees may have had their sensitive data accessed and acquired in a cyberattack that took place in January. According to notification letters sent to affected individuals, Sysco’s systems were initially breached on January 14, but the intrusion was only discovered nearly two months later. The company assured that its operational systems, business functions, and customer services remained unaffected by the breach. While specific details about the data accessed for each individual are yet to be confirmed, Sysco stated that the compromised information may include personal data provided for payroll purposes, such as names, Social Security numbers, account numbers, or similar information.

On May 26, 2023, Managed Care of North America (MCNA) Dental published a data breach notification on its website, informing approximately 9 million patients that their personal data was compromised. MCNA Dental is one of the largest government-sponsored (Medicaid and CHIP) dental care and oral health insurance providers in the U.S. On March 6, 2023, the insurance provider discovered unauthorized activity in their computer system. They took immediate action to halt the activity and initiated an investigation with the assistance of a specialized team. It was determined that an unauthorized user was able to access and make copies of certain information between February 26, 2023, and March 7, 2023. The potentially compromised information includes contact details such as first and last name, address, date of birth, phone number, and email address. Social Security numbers, driver’s license numbers or other government-issued ID numbers were also accessed. Additionally, health insurance information such as plan details, insurance company information, member numbers, and Medicaid-Medicare ID numbers may have been involved. Specific information related to dental care, including visits, dentist and doctor names, past treatments, x-rays/photos, prescribed medicines, and treatment details, as well as bills and insurance claims, were also potentially exposed.

NextGen Healthcare, a vendor of cloud-based electronic health records, has been informing over 1 million individuals about a data compromise that involves the unauthorized acquisition of login credentials. This incident marks at least the second alleged data security breach that the company has probed since January. The company explained an unknown third-party gained unauthorized access to a limited set of personal data between March 29, 2023, and April 14, 2023. The accessed information includes names, dates of birth, addresses, and social security numbers. Out of the 198 significant breaches of health data that have been reported on the Department of Health and Human Services’ HIPAA Breach Reporting Tool website in 2023, impacting a total of 17.4 million individuals, it has been disclosed that at least 75 of these incidents affecting 9.8 million individuals were reported to involve business associates. Approximately 38% of the major health data breaches reported on the HIPAA Breach Reporting Tool website in 2023 involved vendors and other business associates. Interestingly, despite accounting for a smaller proportion of breaches, these incidents were responsible for impacting 56% of the individuals affected by breaches in the healthcare sector.

Luxottica, the world’s largest eyewear company known for brands like Ray-Ban, Oakley, and Chanel, has officially confirmed a data breach that occurred in 2021 via BleepingComputer. The breach exposed the personal information of approximately 70 million customers when a database was recently made available for free on hacking forums. Luxottica revealed that one of its partners experienced the breach, involving a security incident that affected a third-party contractor responsible for holding customer data. The exposed data includes sensitive details such as full customer names, email addresses, phone numbers, residential addresses, and dates of birth. Luxottica emphasized that financial information, social security numbers, login credentials, and other critical data that could endanger customer safety were not compromised. The FBI has made an arrest in connection with the incident, resulting in the shutdown of the website where the data was published.

On May 11, 2023, Brightly informed present and past SchoolDude users that a security incident occurred. SchoolDude is an online platform used by educational institutions for placing and tracking maintenance work orders. Information such as name, email address, account password, phone number, and school district name were potentially breached.

On May 8, 2023, Dragos, a company specializing in industrial cybersecurity, experienced a failed extortion scheme by a cybercriminal group. The group gained unauthorized access by compromising the personal email of a new sales employee, allowing them to impersonate a Dragos employee and access resources in SharePoint and the contract management system. Although they accessed a report with customer IP addresses, Dragos’ security controls prevented the threat actor from deploying ransomware or making further infrastructure changes. The cybercriminals resorted to extortion attempts, escalating their messages and contacting Dragos executives and known contacts. However, Dragos chose not to engage with the criminals and promptly activated their incident response retainer and involved their third-party MDR provider. The investigation is ongoing, but Dragos has implemented additional verification steps for their onboarding process and emphasizes identity and access management, multi-factor authentication, continuous monitoring, and incident response preparedness.

In other news, in May, it was discovered that Apple banned its employees from using generative AI tools like OpenAI’s ChatGPT and GitHub’s Copilot due to concerns about potential data leaks and disclosure of sensitive information. Apple’s decision is based on the fact that OpenAI stores all user interactions by default, including conversations with ChatGPT, which are used for training and subject to moderation. While OpenAI introduced an option to disable chat history, conversations are retained for 30 days for abuse review before permanent deletion. Apple worries that employees may unintentionally reveal confidential project information within ChatGPT, which could be accessed by OpenAI moderators. Similar restrictions have been implemented by other companies like JP Morgan, Verizon, and Amazon. Despite the ban, OpenAI recently launched an iOS app for ChatGPT, making Apple’s decision notable, considering the app’s availability and future expansion plans.

As data breaches continue to make headlines, it becomes abundantly clear that the protection of sensitive information is of paramount importance. The incidents highlighted in this blog post serve as a stark reminder that no individual or organization is immune to the persistent and ever-evolving threats posed by cybercriminals. As we move forward, it is imperative for individuals and businesses alike to prioritize robust security measures, including stringent access controls, advanced encryption protocols, and employee education programs. By staying vigilant, proactive, and informed, companies can fortify their defenses and mitigate the risks associated with data breaches.

Learn More About Findings

Cyber Attacks, security compliance, Supply Chain Security

Why Security Assessments Are Essential

Posted on March 6, 2023March 6, 2023 by Or Kadosh

06
Mar

Security Assessments and Why They Are Essential

Security assessments are essential tools for businesses of all sizes.

They provide an important way to identify and address any vulnerabilities in networks, systems, and applications, to protect the business from potential cyber threats. This blog post will discuss the importance of security assessments and how businesses can incorporate them into their security strategy.

Why Are Security Assessments Important?

Security assessments are important for businesses because they objectively evaluate the security of their networks, systems, and applications.

They can identify potential security flaws, weak points, and risk areas and help businesses develop plans to address any vulnerabilities.

Additionally, security assessments help businesses understand the current security landscape and identify gaps in their security measures.

This can be an invaluable process for businesses, as it can help them determine any additional security measures that need to be implemented to ensure that their networks, systems, and applications remain safe and secure.

By reviewing and assessing current security measures, businesses can ensure that their policies and procedures are optimal for their organization and that their systems are as safe and secure as possible. It can also help evaluate the effectiveness of existing security measures

Types of Security Assessments

There are a variety of different types of security assessments.

Common types of assessments include penetration testing, vulnerability scanning, and application security testing.

Penetration testing is a process of attempting to exploit any vulnerabilities in a system to gain access and gain further access to the system.
In contrast, vulnerability scanning is a process that identifies any potential security flaws or weaknesses in a system.
Application security testing is a process of testing the security of an application by analyzing the system for any potential security flaws or weaknesses.

Security assessments can also be tailored to specific needs, such as cloud security assessments focusing on the security of cloud-based systems and applications.

Why do it?

Security assessments are essential for businesses of all sizes, large and small, as they are critical in identifying and remedying potential vulnerabilities in networks, systems, and applications.

By conducting such assessments, businesses can create a comprehensive security strategy to help them keep their systems secure and protected from potential cyber threats.

Furthermore, such assessments can also provide valuable insights into potential areas of improvement, allowing businesses to remain one step ahead of any potential security risks.

You Need Automation

By automating your assessments, you can save time and money that would otherwise be spent on manual data entry and analysis.

Automation also makes it easier to quickly assess large amounts of data, which is especially helpful when dealing with complex problems or large datasets.

With automated assessment, you can also ensure more accurate and reliable results, as the software eliminates the potential for human error. Additionally, automated assessment can provide valuable insights into the data that can be used to inform your decision-making.

With Findings, digitize your assessments with ZERO effort and automate your assessment response in seconds – learn more about how Findings can help here

aicpa soc 2, CMMC, findings tech, security compliance, soc 1, Vendor Risk Management

The Insider Guide To Coordinated Vulnerability Disclosure Programs

Posted on May 11, 2022September 20, 2022 by Yogev Kimor

11
May

When you co-ordinate a vulnerability disclosure program, you follow a systematic process for communicating about, responding to and remediating vulnerabilities. Keep reading for tips on how coordinated vulnerability disclosure programs work, why they’re important and 5 steps to creating one.

What Is a Coordinated Vulnerability Disclosure Program?

A coordinated vulnerability disclosure program (CVDP) is a structured, systematic strategy for sharing information about vulnerabilities to various internal and external stakeholders whenever a vulnerability occurs. It’s a way of ensuring that information about a known vulnerability is not just available, but also that response operations are as efficient as possible. But remember not all vulnerabilities should or must be disclosed. Deciding how to react, whether to block or avoid is also an important decision.

The Benefits of Coordinated Vulnerability Disclosure

Coordinated vulnerability disclosure programs ensure that you can react efficiently and minimize the risks that vulnerabilities create. Disclosure programs minimize risks not just for your business, but also for your suppliers, partners and customers. The benefits include:

– Reduced vulnerability impact

The overall impact of the vulnerability is likely to be smaller when stakeholders coordinate their response. Patches can be developed faster, and rolled out to affected applications or systems before hackers attack them. This translates to a lower risk that the vulnerability will be exploited.

Consider CVDP as a “neighborhood watch” for your IT assets by encouraging everyone in your supply chain to report risks they discover.

– Build internal processes

Having a coordinated plan in place for vulnerability disclosure helps ensure that your employees each work efficiently to respond to vulnerabilities. A coordinated program defines what each internal stakeholder needs to do when a vulnerability appears.

– Combined stakeholder response

External stakeholders, too, can coordinate their activities much more effectively via a coordinated vulnerability disclosure program. With a program in place, each affected entity can share information efficiently and collaborate with security researchers as needed. Coordinated programs help to establish trust and positive cooperation across the supply chain with regard to vulnerabilities.

– Avoid surprises

When you have set policies in place for what to disclose and how to react to it, stakeholders from across the supply chain have the information they need to react effectively. This breeds transparency and mitigates the risk of unanticipated actions by one organization (such as a decision that a vulnerability is not severe enough to merit action) that could disrupt the responses of others.

On top of this, when you share information quickly and in a coordinated way, you avoid the risk that affected organizations will learn of a vulnerability from the media. The result is an embarrassing scenario and one that leads to slow, inefficient responses and potential damage to an organization’s reputation.

– Ethical corporate behavior

Finally, there is an ethical element to coordinated vulnerability response. Having set procedures in place, and defining how your business will interact with others during vulnerability response, sends a message that you care about transparent operations that benefit the community as a whole. It’s a sign that you’re not just tracking security risks for your own sake, but because you understand the broader impact (ESG) they can have on suppliers, partners and customers.

Did you know that your supply chain security can affect your stock value?

5 Steps for Creating a Coordinated Vulnerability Disclosure Program

Now that we know what coordinated vulnerability disclosure means and why it’s important, here’s how to implement it.

1. Create secure reporting channels

As cybersecurity analyst Keren Elazari says, “hackers can be helpful allies” in finding vulnerabilities. What she means is that good-willed third parties who are reviewing your code or systems can be a critical asset for finding security risks that you haven’t seen.

However, you need to provide secure channels through which third parties can report vulnerabilities in order to benefit from them. These channels could be as simple as resources like “security.txt” files that identify where and how someone can report a vulnerability to you.

Consider, too, integrating incentives into these reporting channels, for example, by creating a vulnerability reward program – a practice that companies like Google have used with great success.

2. Assess vulnerability severity

Every vulnerability carries a different degree of risk. What’s more, the risk can vary for different stakeholders within the supply chain.

For these reasons, your coordinated response program should include a process for assessing how severe the vulnerability is, then include that information in the disclosure report, along with technical details on how the vulnerability is exploited.

With that information, security analysts at organizations like CISA can disseminate vulnerability data that is as meaningful as possible.

3. Remediation

Determine, too, how the vulnerability should be mitigated. Does it require the creation of a patch by software vendors, for example, or can it be mitigated by changing environment configurations?

This information helps to coordinate vulnerability response because it provides actionable guidance to stakeholders on what they need to do to remediate the vulnerability across the supply chain.

4. Public awareness

In a coordinated response process, the group that identifies a vulnerability will take appropriate steps to notify users about it via all relevant channels – such as vulnerability databases, email lists and media reports.

Included in these notifications should be a timeline about which information to disclose and when to disclose it. In some instances, you may not want to include certain technical details right away; for example, if a patch is not yet available to fix a vulnerability, you may not wish to disclose how to exploit the vulnerability, in case hackers use that information to execute zero-day attacks that can’t yet be prevented.

5. Assess your response

The final step in a coordinated response program is to generate feedback about its effectiveness. Assess each disclosure by answering questions like how transparent it was and whether stakeholders had easy access to the information they needed to respond. These insights help ensure that you can continuously improve your program over time.

Coordination leads to the best outcomes

As Daniel Cuthbert, Global Head of Cyber Security Research at Santander, said in a Black Hat talk, “missing links create a vulnerability unto themselves.” In other words, the less information you have available in vulnerability disclosures, the higher your risk of damage.

Coordinated vulnerability disclosure programs minimize these risks by allowing all stakeholders to respond as effectively as possible to newly discovered vulnerabilities. They remove the blind spots in vulnerability response, while also demonstrating goodwill commitments to transparency on the part of your business.

When it comes to planning for coordinated vulnerability response, Findings can help. Findings provide end-to-end visibility into software supply chain risks, ensuring you have all the information you need to plan for effective, comprehensive vulnerability disclosure.

iso, iso27001, iso27017, iso27018, security compliance, Supply Chain Security

Crisis Management: The Missing Link In Supply Chain Security

Posted on May 2, 2022September 20, 2022 by Yogev Kimor

02
May

It’s easy to treat crisis management as an afterthought within the context of supply chain security. Businesses may assume that attacks are unlikely to happen, especially if they’ve invested in risk assessment and mitigation. Just ask some of the major vendors that have been at the root of cybersecurity crisis in the recent past, despite having taken breach prevention quite seriously.

What is a cybersecurity crisis management strategy?

A crisis management strategy provides a protocol for organizations to identify, eliminate and recover from cybersecurity attacks as swiftly as possible; its purpose is to position the organization for minimal impact of a cybersecurity incident. The protocol will unquestionably reduce the stress on your executive and IT teams in a crisis situation and everyone else involved in mitigating an attack.

The protocol typically includes, who does what in the event of a cyber incident, who is in charge of managing the crisis, aka Cybersecurity Crisis Response Team (“Response Team” or “CCRT”). It also covers which systems need to be checked for impact and where the backups are located; which partners, vendors and customers need to be notified and at what stage does the Board of Directors and media need to be addressed and how.

For many organizations, this strategy is not only the responsible thing to do, but may also be a compliance mandate.

Two policies we suggest you look at:

Your Vulnerability Disclosure Policy Can be Easier Than You Think

Meeting The CMMC Compliance challenge Head On

But where do you start? In contrast to many other security protocols – like privacy disclosure requirements, which are usually straightforward enough – there is no predefined playbook you can follow or set of boxes you can check off, to plan for crisis management.

It is therefore up to each organization to research and create their own set of protocols. We’ve highlighted what should be in yours below.

Supply chain security: Your crisis management plan

Step 1: Risk assessment

The first step is to identify your supply chain security risks.

Do this by assessing which regulations and legal requirements your business is bound to when it comes to cybersecurity. You should also evaluate your contractual obligations. Next, identify vulnerabilities that exist within your supply chain security and risk management report. Do these vulnerabilities need to be reported to other vendors within your supply chain? Or can they be easily patched? Finally, examine how a breach may impact your business’s operations.

The easiest way to check your metal here is to take risk assessments test surveys and run some gap analysis – doing so will give you a complete score on where your current efforts stand compared to where you should be and industry standards.

If you find any “show-stoppers,” you must stop your process and fix it before moving forward to avoid failure at a later stage.

With this insight, you can develop a plan for managing the impact.

Step 2: Formalize your security and risk management plan

Once you’ve identified the risks, document them and put them in writing, along with a plan that spells out which steps various stakeholders need to take during an incident to mitigate the risks.

Specifically, your plan should detail:

Whom – such as vendors, partners, customers, regulatory authorities – you need to notify about a supply chain breach. And, your head of cyber security should also be formalized.
Which processes various stakeholders – such as executive, IT and public relations teams will follow to do their part in handling the incident.
How you’ll maintain the necessary level of transparency (which should be defined within your Vulnerability Disclosure Program).
What information to disclose to the media, and how to disclose it. Not every part of every incident needs to be publicized, but you should think strategically ahead of time about how to engage with the media.

Step 3: Practice cyber drills

In order to ensure your crisis management plan actually works as you intend it to, you should run through cyber drills, which mean engaging stakeholders in responding to simulated incidents.

If you have the resources, you can hire a professional penetration testing team to create a mock incident, then test your business’s response. Alternatively, you may use your own teams to create a simulated supply chain attack, using a red team/green team model.

The more drills you practice, the better, but you should perform one drill annually at a minimum.

Step 4: Make crisis management a collective business responsibility

Next, work to ensure that everyone in the business – not just the IT team and security experts, but everyone from PR and customer relations to sales and marketing, to the C-suite and beyond – understands your supply chain crisis management plan and knows how to play their role within it.

Do this by publishing the process in a place where all stakeholders can view it. You can also ask stakeholders to explain their role in crisis management, based on the published plan.

Be sure, too, that the plan nominates someone to take the lead in crisis management unless your business already has an obvious person (such as a CISO) to take on this role.

Step 5: Leverage crisis management

Finally, to get even more buy-in for the plan and generate business value from it, educate your sales and marketing teams in particular about the investments you’ve made in crisis management.

This is important because sales and marketing teams can tout your crisis management investments when selling your products to other companies that require a high level of supply chain security and risk management. The more commitment you can demonstrate to managing supply chain risks effectively, the better positioned you’ll be to win customers who need strong supply chain security guarantees.

Winning such business is certainly not the only reason to invest in crisis management planning, but landing more customers this way can’t hurt.

CMMC, findings tech, iso, iso27001, iso27017, iso27018, security compliance, Vendor Risk Management

4 Reasons Why Your CISO Wants To Implement A CMMC Framework

Posted on April 12, 2022September 20, 2022 by Yogev Kimor

12
Apr

“Let’s pursue a new compliance framework just because we feel like it!” is not a phrase that you tend to hear business leaders utter excitedly. After all, making the changes necessary to comply with new compliance rules is a significant undertaking. Unless a specific legal requirement is at stake, businesses tend to embrace them slowly.

However, the Cybersecurity Maturity Model Certification (CMMC) is an exception. Although CMMC is not strictly required for most businesses, implementing it should be a priority for many CISOs today.

Indeed, a CISO’s main job is to harden cybersecurity wherever possible. Doing so requires identifying security risks, developing practices and policies to mitigate those risks, and creating regular reports that track the effectiveness of cybersecurity investments. Because the CMMC encourages these practices, pursuing CMMC compliance is an excellent way for CISOs to achieve their primary goals.

“All DoD contractors will eventually be required to obtain a CMMC certification,” as CSO Online notes, which may be another reason CISOs implement CMMC compliance. But it shouldn’t be the only one: Whether or not you need to do business with the U.S. Department of Defense, pursuing CMMC compliance is a great idea.

Four reasons to implement CMMC

You achieve several critical benefits when you invest the time and effort required to implement CMMC compliance.

1. Independent cybersecurity validation

Among the recent changes to CMMC is a new independent validation requirement for businesses with CMMC level 3 compliance. Independent validation provides a more thorough security check and vulnerability reporting than you can get from following other security guidelines, like those from NIST (which closely resembled the original version of CMMC).

Thus, CMMC is a more rigorous cybersecurity framework in many respects than anything else you can find.

2. Holistic cybersecurity best practices

CMMC is designed to encourage solid cyber hygiene for businesses of all types and industries.

It encourages a proactive cybersecurity culture (ESG benefits because it demonstrates a commitment to privacy). It facilitates education for all employees – including non-technical stakeholders – about security best practices. And it underlines the importance of managing supply chain security risks, one of the most severe categories of threats that businesses face today.

3. Increased revenue

From a purely business perspective, the additional sales opportunities that CMMC compliance opens up can lead to revenue growth.

When you achieve CMMC compliance, you can do business with U.S. government agencies that might otherwise be off-limits. This means more clients, but it often means more significant client contracts because government agencies tend to be high-value, long-term accounts.

4. Enhanced security maturity

Even in cases where clients aren’t government agencies and don’t require CMMC compliance, being CMMC compliant can nonetheless be a significant boon to business. It helps you demonstrate a commitment to cybersecurity and serves as a stamp of quality/security on the security front, which can help you close more deals and retain more clients.

The enhanced security maturity that comes with CMMC compliance can help you stay ahead of the competition, which may comply with less rigorous mandates but not with CMMC.

Here are the CMMC Compliance Requirements: Everything You Need To Know

Granted, CMMC implementation is not a simple task: It’s essential for CISOs to understand the challenges before undertaking a CMMC compliance initiative:

Process: You have to apply for CMMC compliance. That’s another task for CISOs to manage on their already full plates.
Buy-in: CISOs need to get buy-in from shareholders and management for the CMMC process. That’s important not just culturally but also because business leaders will need to play a valuable role in the CMMC application process by filing forms, tracking progress and reporting, etc.
Multiple steps: Applying for CMMC compliance is not a one-and-done affair. It usually involves multiple steps, with changes or additional information required as you progress through the process.
Maintenance: You need to keep your compliance strategy continuously updated to meet CMMC compliance requirements. That increases your time and effort even further.
Cost: For most businesses, CMMC compliance will require new tools and processes, which come at a cost. And depending on what level of CMMC compliance you need, an outside advisor may also be required.

None of these challenges should prevent businesses from pursuing a comprehensive CMMC framework to protect against cyberattacks compliance. But it’s essential to be aware of the potential objections and barriers before starting the process.

Even if CMMC compliance is technically optional for your business, there’s a good reason not to treat it as an option. Instead, CISOs should embrace CMMC implementation as an intelligent way to strengthen their business’s cybersecurity – and, in turn, open up new business opportunities.

Learn more by scheduling a demo.

findings tech, iso, iso27001, iso27017, iso27018, security compliance, Vendor Risk Management

Your Vulnerability Disclosure Policy Can Be Easier Than You Think

Posted on April 4, 2022September 20, 2022 by Yogev Kimor

04
Apr

It’s easy to recognize the importance of creating a vulnerability disclosure policy. Vulnerability disclosure policies, or VDPs, are important because they help you track vulnerabilities within your supply chain and determine how to disclose security risks that arise within the supply chain. That’s a best practice for any business, not to mention a formal requirement for companies wishing to do business with the DOD and U.S. government agencies.

It can be pretty hard, however, to figure out how to define and enforce such a policy. If you’re like many businesses, you may struggle to determine which types of vulnerabilities to disclose, how to report them, and how to integrate these rules into a policy document that your business uses as a systematic guide whenever supply chain vulnerabilities arise.

Fortunately, it’s easy enough to work past these challenges. By taking a step-by-step approach to creating a vulnerability disclosure policy, you can define and enforce disclosure rules tailored to your business’s needs with much less effort than you may imagine.

More information below on managing and building relationships with your vendors:

The insider’s guide to coordinated vulnerability disclosure

Watch below: How you can interact with vendors and suppliers – headache free

The main purpose of vulnerability disclosure

Establishing an effective vulnerability disclosure policy starts with understanding what such a policy is supposed to do.

Vendor disclosure programs have two main benefits:

Streamlined vulnerability reporting: A VDP defines who in your organization handles vulnerability reporting. This is important because many companies don’t know who the right person is to generate and distribute reports. Without a predefined reporting policy, you’re likely to end up with delays, or reports that never happen at all because no one knew who was supposed to create them.

Real-time reporting: Just as important, VDPs make it possible to react in real-time to vulnerabilities and breaches. As soon as you detect a security issue, you can report it to stakeholders or CISA, as required based on factors like which systems the incident impacts and how severe it is. The ability to disclose issues immediately and be fully transparent demonstrates a strong commitment to security on the part of your organization, which in turn helps your brand weather security events. Rapid disclosure may also be a compliance requirement for some businesses, as we’ve noted. But rapid disclosure means you need a complete view over your whole supply chain, not an easy task unless you have an automation tool to help with checking and reporting vulnerabilities.

Every VDP should be designed with these benefits in mind.

The six components of a vulnerability disclosure policy

To enable efficient, real-time vulnerability reporting, you should create a VDP in the form of a document that details six key facets of vulnerability disclosure.

1. Compliance policies

Your VDP should specify which compliance rules your business needs to meet, and which vulnerability disclosures those rules require.

The details in this section of the VDP will vary depending on your business and its compliance context. Not only do compliance requirements vary between geographies and industries, but businesses may also be exposed to different mandatory disclosure rules based on factors like the size of the business and the nature of a given breach. These are a few of the important policies you may come across ISO27001, NIST, ENISA, CMMC ISO, GDPR, HIPPA, CPPA (to name a few), and these need to be kept up-to-date with compliance rules changing every so often.

Whatever your specific requirements are, the goal of this section of your VDP should be to spell out the business’s disclosure responsibilities relative to its compliance mandates.

2. Contractual obligations

In addition to compliance mandates, your business may be required by the contracts it signs with vendors, customers or partners to disclose vulnerabilities. Thus, one section of your VDP should address contractual vulnerability disclosure obligations.

Be sure to detail in this section not just when and to whom you have to disclose security issues, but also how the disclosures should be communicated. Typically, your agreements with other businesses will specify how communication is to be maintained in this context. By including this detail in your VDP, you ensure that you can find it easily, without having to piece through contracts.

3. Supply chain obligations

If vulnerabilities arise somewhere in your supply chain as opposed to your own systems, you may need to disclose those, too. Your VDP should include a section that spells out your obligations in this regard. It should also include information about how you maintain visibility into your supply chain and determine that a vulnerability has affected it.

4. Risk management and assessment

Every vulnerability is unique, and the ability to contextualize it based on its seriousness is critical for effective disclosure. Toward this end, define within your VDP how to calculate the overall security severity of each vulnerability, as well as how this security score impacts your disclosure procedures.

If you use risk assessment tools to automate the scoring process (as you should if you want it to take place in real-time and with minimal effort on the part of your team), include that information in the VDP, too.

5. Insurance coverage

In many cases, insurance can cover at least some losses incurred due to a security issue within your supply chain. For this reason, be sure that your VDP details which security insurance you have and how it applies to disclosures.

6. Incident response plans

Disclosing vulnerabilities is one thing, mitigating is another.. Your VDP should include an overview of how your business responds to security incidents in order to ensure that they are remediated. In addition, if you’re required to keep stakeholders aware of progress toward remediation while an incident response is underway, spell out how you’ll do that within your VDP.

Take a look at how Log4j, Kaseya and other recent supply chain attacks have caused damage

How vulnerability disclosure statements optimize security

With a comprehensive VDP statement, you ensure that you are prepared to react in a way that minimizes the incident’s impact on your business, your vendors, your partners, your customers, and your supply chain in general.

In turn, you can make informed decisions about the following:

When to keep doing business with vendors who introduced a vulnerability into your supply chain
How to work with vendors to keep their risk levels low – and, by extension, keep your supply chain secure
When to switch to different vendors to lower your risk
Communicate effectively both “upstream” (meaning with your vendors and suppliers) and “downstream” (with customers and partners) when a vulnerability arises, as the image below from FIRST.org, a global organization focused on security improvements, illustrates

You can’t prevent every vulnerability or security incident. But you can prepare ahead of time to react quickly and effectively in meeting your obligations to disclose security issues when they happen – whether they stem from a vulnerability within your own IT estate or a problem that originated with another business in your supply chain.

You can make the vulnerability disclosure process even more efficient, which automates supply chain security detection and reporting.

Findings – Optimizing Supply Chain Compliance

findings tech, iso, iso27001, iso27017, iso27018, Trade Compliance

Russian sanctions made trade Compliance a Burning Issue – Here’s Everything You MUST Know

Posted on March 28, 2022August 31, 2022 by Yogev Kimor

28
Mar

You may have heard about trade compliance before, but do you know its meaning? It’s an essential part of international trade, and it’s amongst the few things that will put your company at risk if you don’t abide by it.

Here is everything you must know about trade compliance and why it matters so much these days with everything going on with Russia.

What Does Trade Compliance Cover?

In short, trade compliance requirements can impact your ability to import or export into foreign markets and effectively operate within your territory. Trade compliance applies to any company operating across borders; even if you plan on staying stateside and selling in only one jurisdiction, there is still a good chance that a local regulator will make contact at some point in your company’s life cycle. It isn’t always apparent whether a law requires you to comply with its provisions.

Trade compliance is defined as “an aspect of corporate compliance which ensures that all import and export transactions are in conformance with the laws and regulations of the countries involved,” according to Daw Jones Risk and Compliancy glossary.

What is the U.S. Department of Commerce Rules Regarding Export Control?

The U.S. Department of Commerce maintains a set of rules regarding export control that every business should know about—even if you don’t think your company is doing any business abroad. These rules include what products can be shipped outside of our borders and how they can be traded (and sometimes not traded).

These guidelines ensure we’re not selling or sending anything to countries we have sanctions against—like Iran or North Korea—or the newly star Russia.

What might surprise you is that there are particular nuances to how trade compliance works.

Russia made trade compliance a priority.

As part of Russia’s aggression and invading Ukraine, The U.S. has issued sanctions against Russia’s banks, business people, and other financial services to disrupt these funding sources.

U.S. sanctions don’t apply to U.S. companies or people, but they impose restrictions on non-US persons’ dealings. The broad range of U.S. sanctions programs and rules means that almost any non-US citizen or entity doing business with a person on a sanctioned list violates U.S. law. This includes foreign subsidiaries of U.S. companies.

U.S. trade sanctions can have serious consequences, including fines and imprisonment. For that reason, it’s essential for firms operating internationally to make sure they have systems in place to comply with trade compliance laws. It’s also important to understand that these penalties are not just reserved for trade sanctions; sentences can be imposed against those who fail to take reasonable steps to ensure their trade partners are not violating trade compliance laws.

Businesses must understand trade compliance regulations so that they don’t run afoul of them or understand their risks to manage them appropriately.

There are four ways that trade compliance applies to you:

1) You might import goods into or export goods out of a sanctioned country

2) You might do business with someone who does

3) Your customer may purchase goods from someone who does

4) Your customer may sell goods to someone who does

Suppose you import goods into or export goods out of a sanctioned country. In that case, The Office of Foreign Assets Control (OFAC), which falls under the Treasury Department, administers and enforces trade sanctions against targeted countries.

OFAC tracks all U.S.-based financial transactions and shipments leaving and entering U.S. ports via air freight or sea freight transport services. If you import goods into or export goods out of a sanctioned country, those goods will fall under trade compliance rules administered by OFAC.

You must file a report with OFAC before importing or exporting those goods to ensure that neither you nor your customers violate trade sanctions.

For example, suppose one of your supplier’s purchases steel from Russia and ships it to China, where it is assembled into final products. In that case, Chinese importers have to comply with trade sanctions if they want to re-export those products back into the United States. This could also apply if you have manufacturing facilities in China since any imported raw materials would still fall under trade compliance rules administered by OFAC.

Risk Management – Effective Trade Compliance And Supply Chain Management

CAATSA, or The Countering America’s Adversaries Through Sanctions Act, will profoundly impact global trade compliance. CAATSA was signed into law by President Trump in August 2017 and mandates sanctions against Iran, North Korea, Russia, and Venezuela. It also prohibits foreign entities from doing business with U.S. companies unless they are compliant with CAATSA.

Many organizations also want to do business with sanctioned countries like Russia, Iran, and North Korea because they offer lower prices than other suppliers. However, before engaging in any trade activity involving these countries or individuals under U.S. sanctions laws, you must ensure that your organization has effective trade compliance programs. Otherwise, you risk facing severe penalties under CAATSA if you engage in transactions involving blocked persons without first obtaining authorization from OFAC (Office of Foreign Assets Control).

Effortless Trade Compliance

Cut the processing time in half and ignore “experts advisors” – When you use the findings’ platform, you can automate your entire trade compliance process.

Automate your assessments, enable best practices, and give your supply chain the advantage.

What to learn more about what findings can help you with? Start your free trial today.

findings tech, security compliance, Vendor Risk Management

Why Cyber Insurance Won’t Save You When You’re In Need

Posted on March 21, 2022November 7, 2022 by Yogev Kimor

21
Mar

Cyber Insurance Is Great – Except When It’s Not

It would be great if cybersecurity insurance provided an affordable, reliable means of protecting your business from the innumerable cyber threats it faces today.

Unfortunately, it doesn’t. While cyber insurance has its purposes and can be a good investment, it’s hardly a panacea when defending against cybersecurity risks. It’s a type of product that has hit a “plateau,” as Harvard Business Review puts it because cyber insurance has not evolved quickly enough to meet modern security threats.

That’s why, for example, cyber insurance won’t reliably protect you against supply chain security attacks. Even if you find a policy that does address supply chain threats, actually claiming your insurance benefit may take so long that the insurance doesn’t end up doing your business much good following a significant breach.

Please keep reading for an overview of the advantages and drawbacks of cyber insurance and tips on when it does and doesn’t make sense to rely on cyber insurance alone.

Here’s the top reasons why CMMC will be good for your business

What Does Cyber Insurance Cover?

Cyber insurance was introduced in the 1990s and was hailed to protect against IT-related risks that are typically not covered by other types of business insurance. The original intent was to give companies a means of protecting against the financial fallout resulting from data breaches and disruptions to critical IT systems.

Several insurance companies offer cyber insurance today, including Hiscox, The Hartford, CNA, and Nationwide.

5 Potential Disadvantages of Cyber Insurance

On the surface, cyber insurance probably sounds like a simple way to make sure a cyber attack doesn’t render your business bankrupt. In reality, though, cyber insurance isn’t necessarily so rosy. There are a number of potential pitfalls or drawbacks to purchasing cyber insurance.

1. High Costs

The first is the simple cost of cyber insurance. Although cyber insurance premiums were relatively affordable in the past, they have surged in cost in recent years, as this graph of policy costs shows:

Source: https://blog.alta.org/2021/09/cyber-coverage-premiums-increase-25-survey-shows.html

Thus, the cost of cyber insurance may be too high for many businesses today.

2. Management Challenges

Cyber insurance is not a set-it-and-forget-it affair. You have to manage your coverage actively by ensuring that your policy is kept up-to-date as your risks change – which they typically will, because you’ll roll out new systems or collect new types of data, for example, your original policy may not have covered that.

Most cyber insurance policies also place strict requirements on the insured to keep detailed records, secure their systems, and manage risks. If you fail to demonstrate that you took the steps required to protect your business against a breach, an insurer may deny your claim.

This isn’t to say that managing cyber insurance is infeasible. But it is to say that businesses shouldn’t underestimate how much effort goes into it.

3. Coverage Limitations

It’s easy to fall into the trap of assuming that as long as you’ve purchased cyber insurance, you’re covered against any and all cyber-related risks.

The truth, unfortunately, is that cyber insurance policies will always have exclusions or limitations regarding what they cover. “Insurers are demanding great security and are cutting back the amounts of cover they are willing to offer,” ZDNet reports. If you don’t read your policy disclosures very carefully, you may find that a breach you thought was covered is not.

Also, remember that merely interpreting coverage rules can be complicated – so complex that you may need to go to court to prove you are entitled to coverage. That’s what Merck had to do in a recent claim involving $1.4 billion in losses following a cyberattack. Merck, whose insurer said the claim was excluded from its cyber insurance policy because it was an act of war instead of a standard cyberattack, prevailed in that case.

But for smaller companies, in particular, this should be a warning: Going to court to defend your cyber insurance entitlements can be costly and time-consuming. Even if you have a legitimate claim, you may never get a payout if your insurer contests it and you lack the resources to defend it.

4. Claiming Insurance Takes Time

Even if you don’t have to go to court to get your insurer to payout, there’s no guarantee that cyber insurance will result in immediate financial assistance following a breach. The claims process could take months or even years, especially if it requires collecting detailed information about the source of a breach to determine whether the breach is covered.

If a cyber event causes significant financial disruption, then your business may not be able to survive it if the insurance claim process takes too long.

5. The Supply Chain is Not Insured.

In general, cyber insurance covers risks that affect your IT resources directly. Software supply chain threats originate in third-party systems and are not usually covered.

This is especially bad news given that advanced supply chain attacks are projected to increase by about 650 percent in the coming years. It means that investing in cyber insurance is not reliable for protecting against supply chain risks. For that, you need different tools – like a software supply chain risk assessment and disclosure platform.

Here is your supply chain security crisis management plan

The Future of Cyber Insurance

Cyber insurance may well evolve to close the gaps described above in the future. We may see a reduction in costs, for example, or the creation of new policies that specifically address supply chain risks. Indeed, the U.S. Government Accountability Office has found that more insurers are creating dedicated cyber insurance policies, which could lead to more comprehensive coverage down the line.

Even if that happens, though, it’s impossible to guarantee that any cyber insurance product will fully protect your business against all threats. That’s why it’s critical to invest in other tools that help you detect and respond to risks. The security blanket of a cyber insurance policy doesn’t suffice to keep your business safe.

We agree, by all means, to invest in cyber insurance if it makes sense for your business. But don’t blindly entrust your company’s financial health to insurance alone.

Instead, invest as well in solutions like Findings, which automates cyber risk assessment and management – including not just within your business’s environment but across your supply chain.

findings tech, security compliance, Vendor Risk Management

3 Predictions about CMMC 2.0’s Impact on Compliance Operations in 2022

Posted on March 14, 2022October 6, 2022 by Yogev Kimor

14
Mar

Most compliance frameworks change from time to time. But it’s sporadic to see the exceptional level of change that the Cybersecurity Model Maturity Certification, or CMMC, is currently undergoing. In a bid to make CMMC compliance more straightforward and affordable – and, by extension, help smaller businesses sign contracts with the U.S. Department of Defense, which requires CMMC compliance from its vendors – the U.S. federal government has revamped or rewritten critical components of the CMMC. The updated version is known as CMMC 2.0.

But, if you follow compliance news, you probably already know that the CMMC is evolving. You may not yet know what the CMMC changes mean for the typical business.

To provide some insight into that topic, here’s a look at the top three changes likely to result from the CMMC overhaul. Changes have already started to take effect over 2021 and will continue throughout 2022 for many businesses as they adapt to the brave new world of CMMC 2.0.

Here are the CMMC Compliance Requirements: Everything You Need To Know

Prediction 1: Increased CMMC compliance self-assessments

One of the most meaningful updates the government has made to CMMC is allowing self-attestation of compliance. Previously, businesses hired outside auditors to attest to their CMMC compliance.

Couple that change with the fact that the CMMC 2.0 has only three compliance steps instead of five, and it would seem very likely that we’ll see more and more businesses performing CMMC self-assessments in 2022 and beyond. Instead of hiring outside auditors and consultants, companies will take the more cost-effective self-assessment approach.

This change will also likely translate into a more significant number of SMBs becoming CMMC-compliant. In the days of CMMC 1.0, when compliance assessments cost a lot more, it was harder for smaller businesses to gain compliance attestation.

It’s essential to keep in mind that not every business can self-attest, of course. According to the DoD, only about 140,000 of the 220,000 total companies in the defense industrial base hold “federal contract-related data,” which entitles them to self-assessments. The rest will have to use the traditional, more costly assessment approach to get a higher level of assessment.

There are specific procedures to follow, including having a senior company official attest to your compliance and submitting the attestation to the Supplier Performance Risk System (SPRS). Keep in mind, too, that even if you self-assess, you can’t simply file a report and call your business CMMC-compliant. Still, the process is cheaper and easier than relying on outside consultants.

Prediction 2: More CMMC compliance transparency

More self-assessments will likely also contribute to a tendency among companies to embrace the principle of transparency when it comes to CMMC compliance. That’s because disclosing security vulnerabilities is an essential step toward making self-attestations credible.

As a result, expect transparency to become the rule, not the exception, for companies pursuing CMMC compliance. In particular, more businesses are likely to establish vulnerability disclosure programs to communicate clearly about security issues.

This will mark a significant shift from the present. Traditionally, companies have tended to be tight-lipped about vulnerabilities. They had only disclosed them when they were legally required to do so. But in the future, adopting a transparency approach to security and openness will help businesses establish their credibility and good-faith commitment to the CMMC – and, by extension, it will help position them to win government contracts.

Prediction 3: CMMC compliance will demand-supply chain security automation

While VDPs are one step toward transparency and self-assessing your CMMC compliance, another critical practice is automating software supply chain security. Given the sharp uptick in software supply chain security risks, that’s especially true.

Supply chain security automation tools make it fast and accessible to identify security risks within the supply chain and document and disclose them based on compliance requirements. Instead of manually tracking and disclosing risks, as they do today, businesses seeking CMMC compliance are likely to embrace supply chain security automation.

SMBs, in particular, are poised to take more significant advantage of supply chain security automation tooling, which will help them decrease compliance costs and complexity. (This is another reason, by the way, why the updated CMMC framework is likely to result in more involvement by SMBs in the CMMC space.)

Crystal balls

These are our predictions about how CMMC 2.0 will change the way businesses approach CMMC compliance. But since we here at Findings have built a world-class supply chain security and compliance automation platform, we’d like to think we have a pretty well-informed perspective on this topic.

We’d also like to think that, as more and more businesses seek solutions for automating CMMC compliance, they’ll turn to Findings. Findings offer the automated assessments, best practice recommendations, and reporting features businesses to need to self-assess and simplify compliance operations. In turn, it reduces the number of questions you need to answer during compliance processes from hundreds to just a few.

Ultimately, Findings places compliance with frameworks like CMMC within reach of every business, not just those with teams of compliance experts and expensive compliance consultants.

Learn more by signing up for a free trial

aicpa soc 2, findings tech, iso, iso27001, iso27017, iso27018, security compliance, soc 1, Vendor Risk Management

The Top 20 Cybersecurity and Supply Chain Conferences of 2022

Posted on March 1, 2022October 6, 2022 by Yogev Kimor

01
Mar

As the supply chain security and cybersecurity landscape evolve, the industry becomes increasingly savvy about protecting digital assets. This year brings a slew of events dedicated to managing and enhancing cybersecurity knowledge and awareness. Some events will take place in person, while others will be virtual, making it possible for anyone to participate. We love this new reality!

These conferences will not be missed, so open your calendar app and plan accordingly!

Cybertech Global TLV

March 1 – 3, 2022

Tel Aviv, Israel

Cybertech features a diverse array of speakers from dozens of countries worldwide who are leaders in the cyber industry. Top executives, government officials, and leading decision-makers in the field will give the talks and lectures at the event. Cybertech includes conference sessions, special events by invitation, and a grand exhibition allowing attendees to meet and mingle with one another.

Speakers include known industry personalities from Israel, the US, and Europe, including Amir Sage, Cyber Coordinator of the Cyber Security Department in Israel’s Ministry of Foreign Affairs; Merav Kenan, CEO of the Israeli High-Tech Association; Umino Atsushi, Director of the Office of the Director-General for Cybersecurity, MIC, Japan; and Janne Kankanen, CEO of the National Emergency Supply Agency of Finland.

Pharma Supply Chain & Security World 2022

Corvus Global Events

March 15 – 16, 2022

Online

Counterfeit drugs are an ongoing problem for pharmaceutical companies that enter the supply chain at several points. This virtual event focuses on optimizing supply chain challenges in the pharmaceutical supply industry. In this online conference, participants will learn to create value across the supply chain by streamlining and designing an optimal supply chain network.

Innovations like IoT, AI, ML, and blockchain will be explored for their applications in transforming the pharmaceutical supply chain.

Among the speakers at the Pharma conference is Emre Gollu, Supply Chain Associate Director at UCB, and Himanshu Agrawal, Director – Global Process Owner & Innovation Lead, Supply Chain Logistics at GSK.

Women in Cybersecurity

March 17 – 19

Cleveland, Ohio

The three-day WiCyS conference is the flagship event of Women in Cybersecurity. This organization has been around for a decade and is dedicated to advancing the role of women in the field of cybersecurity. The conference brings together veterans and newcomers to the industry from all walks of life and offers resume review and career mentoring opportunities.

This event is focused on opportunities for women but is open to all genders.

A slew of workshops, presentations, panel discussions, and more will feature speakers such as Sarba Roy, Product Security Engineer at Intel, and Natalie Pittore, Chief of Enduring Security Frameworks at the NSA.

CISO Sydney

March 22 – 23, 2022

Sydney, Australia

Managing digital assets and services risks for supply chain security will major this year’s CISO Sydney event. At this event, Australia’s leading experts in information security will share their insights into improving cybersecurity culture and awareness. CISO Sydney encourages participants to “Be inspired, collaborate, disrupt.”

The featured keynote speaker is the Honorable Karen Andrews, MP Minister for Home Affairs of the Australian government.

She will discuss the government’s plans to protect the country, communities, and industries against cyberattacks. CISO Sydney promises to be a lively, social gathering exploring how Australian organizations approach cybersecurity from a holistic perspective.

Cybertech Miami

(This conference was postponed)

Miami, Florida

This year’s Cybertech family of conferences will include an inaugural event in Miami. The summit will gather cyber leaders from the United States and Latin America to discuss challenges and solutions in cybersecurity today.

Some of the themes will include the role of media organizations in cybersecurity, cyber influence on intelligence-gathering, and the impact of 5G technology on cybersecurity. The full lineup of speakers at Cybertech Miami is yet to be announced, but seeing as this event is part of the Cybertech Global family, it promises to be an exciting, dynamic conference.

The Official Cyber Security Summit

March 25, 2022

Atlanta, GA and online

This 7th annual daylong conference is jam-packed and focuses on educating attendees about protecting vulnerable business applications and critical infrastructure. It offers attendees the opportunity to meet some of the leading solution providers in the United States and discover products and services bringing innovation to enterprise cyber security.

The sessions, presentations, and panel discussions feature some top cybersecurity experts today. Admission includes meals and networking opportunities, and a virtual live-stream option is available.

Chad Hunt, Supervisor of the FBI’s Computer Intrusion Squad, will be a keynote speaker at the summit. Those looking to get a head start can already access the summit’s online Security Content Sharing portal to learn about protecting businesses from cyber attacks.

GFMI’s 14th Edition Third-Party Vendor Risk Management for Financial Institutions

April 11 – 13, 2022

New York, NY

The Global Financial Markets Institute’s 14th edition event will offer third-party risk professionals innovative perspectives on supply chain resilience and provide new insights into managing third-party risk.

Taking place in the heart of the world’s financial center, speakers at this event include some of the foremost experts in cybersecurity and risk management from the big banks.

Key sessions include Scotiabank’s talk on boosting supply chain resilience and MUFG Union Bank’s session on identifying concentration risk. Among the notable speakers are Donald Saxinger, Chief of IT Supervision at FDIC, and Dolly Singh, Managing Director, Global Head of Corporate Third Party Oversight at JP Morgan.

Supply Chain Meetup

April 26 – 28, 2022

Online

Focused on the retail supply chain’s current state and evolution, Supply Chain Meetup is a virtual gathering that provides collaboration, networking, learning, and career development opportunities. The online event will bring together hundreds of experts from across the retail supply chain. The full lineup will be announced in the coming weeks.

Cybersecurity and Privacy Professionals Conference

May 3 – 5, 2022

Baltimore, MD

This event allows attendees to discuss trends and issues in information security and privacy with their peers and hear from some of the leading solution providers in the field.

The theme of this year’s conference is The Future is Ours to Shape: Developing Staff and Operations for Tomorrow’s Cybersecurity and Privacy. Cybersecurity and privacy professionals were invited to submit their proposals for this grassroots educational event, including information-sharing, networking, and collaboration.

Cybertech Asia

(Postponed: Cybertech Asia has been postponed till May 2023 )

Sands Expo, Singapore

Cybertech Asia will take place in Singapore next summer. The event will be being held in partnership with Milipol, Asia-Pacific’s leading international homeland security international event. The conference will feature a range of sessions and special events on cybersecurity. The entire speaker schedule is yet to be announced, but interested parties can already get involved through an online portal that can be used for networking with other conference-goers.

Cybertech Asia serves as a dialogue on threats and solutions that impact the global community. Topics covered at the conference include finance, mobile, health, mobility, insurance, and more.

RSA San Francisco

June 6 – 9, 2022

San Francisco

At the four-day RSA Conference, cybersecurity professionals come together to discuss perspectives and challenges and network with one another. The event features an Expo in which attendees will find products and solutions and a digital-only option for those unable to attend the conference in person.

Some of the notable speakers include Dr. Christopher Pierson, Founder and CEO of BlackCloak. Tim Weston, Cybersecurity Coordinator at the DHS/TSA, and Alyssa Miller, Business Information Security Officer at S&P Global Ratings.

Gartner Security and Risk Management Summit

June 7 – 10, 2022

National Harbor, MD

The Gartner Management Summit is aimed at chief information security officers and leaders in cybersecurity and risk management. It will feature keynote speakers from leading IT security personalities alongside experts from Gartner’s team of unbiased analysts. The conference will focus on establishing an agile security program, fostering a human-centric security culture, and devolving risk ownership.

Participants will choose to attend sessions from among eleven unique tracks, such as Cyberthreat: Mitigation, Preparedness, Exposure Management; Infrastructure Security; Midsize Enterprise; Identity and Access Management, and several others.

Cybertech Global UAE – Dubai

June 13 – 14, 2022

Dubai, United Arab Emirates

Cybertech Dubai will focus on timely topics in cybersecurity with industry experts and government officials worldwide. Cybertech Dubai features a diverse range of speakers in the global hub that connects Europe, Africa, and the Far East.

The sessions and special events will focus on AI, Advanced IoT, big data, cloud, blockchain, and more. Leaders will deliver talks in government and enterprise from throughout the US, Europe, the Middle East, and Asia.

Total Security Conference Hong Kong

July 7, 2022

Hong Kong

CISOs, heads of IT, heads of security, and regulators face a rapidly-changing climate filled with new vulnerabilities. As cyberattacks become more sophisticated and remote work becomes the norm, security and risk mitigation priorities evolve. The 8th annual Total Security Conference focuses on ensuring a seamless transition to virtualization through efficiently securing data, endpoints, and operational touchpoints. This conference features information sessions, meetings, and networking to allow corporate, public, and government agencies to enhance their approach to cybersecurity.

The lineup of speakers is not yet finalized; stay tuned…

CSO50 Conference and Awards

September 2022

Location to be announced

The CSO50 Conference and Awards feature risk strategies for rising threats. It will showcase innovation to protect and defend risk leadership and innovation to preserve and defend risk leadership and innovation.

Top leaders in risk management and cybersecurity will be awarded at the conference and present talks on recent developments in the industry.

Some of the speakers slated to present at this conference include Keith Slotter, VP Corporate Security at JetBlue Airways; Nicole Ford, VP & CISO at Carrier; and Jessica Bair, Director of the Cisco Secure Technical Alliance at Cisco.

National Cyber Summit

September 21 – 22

Huntsville, Alabama

NCS2022 is billed as the nation’s most innovative cybersecurity-technology event. It offers educational, collaborative, and workforce development opportunities for industry visionaries and rising leaders in the field.

The summit will bring together leaders of both enterprise and government organizations to discuss digital forensics, supply chain cybersecurity research, data mining, and the societal impacts and ethics of cybersecurity. Several tracks of the conference will run concurrently, and the list of speakers includes Chris Cleary, Principal Cyber Advisor of the US Navy; Brian Turner, Executive Assistant Director of the Criminal, Cyber, Response, and Services Branch of the FBI; and Merritt Baer, Principal Security Architect at Amazon Web Services.

InfoSec World

September 26 – 29, 2022

Coronado Springs, Lake Buena Vista, Florida

One of the longest-running events of its kind, InfoSec World is in its 28th year and offers some of the industry’s premier education and networking opportunities. This year’s conference includes summits and workshops on supply chain security, ransomware, threat testing, cryptocurrency, cloud security, and more. Each of these topics will be expanded upon at the conference, such as the cloud security summit and supply chain workshop, taking place on the event’s final day.

Speakers are yet to be finalized, and the world’s leading companies have been presenters at previous InfoSec conferences. InfoSec World provides attendees with the tools and information they need to stay at the forefront of today’s cybersecurity challenges.

International Cyber Expo

September 27 – 28, 2022

London, England

The International Cyber Expo unites government, industry, and academia at a series of roundtable discussions, pavilions, exhibitions, demonstrations, and a summit. All focused on the primary issues facing cybersecurity professionals today. The expo will also showcase the latest products, technologies, and services from over 350 leading industry suppliers. Attendees will include leaders in cyber policy, government, CISOs, export leaders, and other C-suite professionals coming together to discuss protecting and securing high-level networks.

Cyber Security World Asia

October 12 – 13, 2022

Marina Bay Sands, Singapore

This event brings together industry leaders from some of the top cybersecurity companies throughout Asia and the world. Cyber Security World is suitable for security professionals in dozens of roles who share a common desire to invest in cybersecurity and defend their businesses from cyber threats.

This year’s lineup is still being finalized, but past exhibitors include the world’s leading cyber security suppliers and the latest technologies and solutions. An exciting rapid-fire pitch showcase will feature at the conference, allowing companies to pitch their products and solutions to potential investors, partners, and customers.

Insider Threat Summit

3 November 2022

Monterey, California

The Insider Threat Summit unites government agencies with private enterprises to discuss the problem of insider threats. This year’s conference will focus on vulnerabilities about cybersecurity challenges. Topics will include risk analysis and continuous evaluation or monitoring, AI and machine learning, economic espionage, counterintelligence, threat monitoring, and more.

There you have it – our picks for the top 20 cybersecurity and supply chain security events of 2022. Whether you plan to attend in person or join some of these events virtually from the comfort of your own home, you’re sure to gain valuable insights into the latest cybersecurity developments.

Waiting for that next conference and eager to learn more about automating your supply chain security? Request a demo