Frank #CompuWatcher Piscitello☕🍺🧑‍💻🖖Apr 20, 2023

New Privacy laws #swphl23

Security protects from external threats. Privacy is how data is collected, shared and used.

Every state has a breach notification law. No federal law covering everything. Only certain sectors.

No federal privacy law. There's industry specific ones like HIPAA, glba, gdpr. States have various ones.

New for 2023 Cpra(California updated), vcdoa(Virginia), cpa(Colorado), ctdpa(Connecticut), ucpa(Utah)

Laws will have rules and regs to help interpret the laws. They should be the starting point.

Iowa is coming out in 2025

IAPP is a good resource. https://iapp.org/join/

Individual Membership

The Value of Membership The IAPP welcomes professionals like you from around the world who are thriving in today’s information economy. It’s the only place that brings together the people and resources you need to succeed in a data-powered world. Member Benefits ...

Frank #CompuWatcher Piscitello☕🍺🧑‍💻🖖Apr 20, 2023

#swphl23 #infosec session on small teams...

Entry level is not 3 to 5 years of experience...

So many technology solutions that are procured to solve one problem. #techOverload. Instead, figure out how to use more of the tools you have already.

Never ending threats. Many focus on end users. #userawareness is needed.

Limited resources including people. Orgs need to realize they may need to train for experience instead of finding unicorns.

Lots of compliance requirements. Don't waste resources doing compliance if it's not required from outside motivations. Internal measures of program can do better to tell the story to mgmt. (Measure risks and mitigation instead.)

The 5 phases of the NIST CSF framework can be used to help define your program, but still use a business risk approach.

Swatting at flies is ineffective and inefficient.

Frank #CompuWatcher Piscitello☕🍺🧑‍💻🖖Apr 19, 2023
@BarCode getting ready to talk at Secure World Expo. #swphl23
Show threadFrank #CompuWatcher Piscitello☕🍺🧑‍💻🖖Apr 19, 2023

The next session is about hiring the newbies. #swphl23

99.9% companies are less than 500 employees.

85% of infosec staff over the age of 30.

Take a look at the top 10 mitigation according to CISA rva report fy21.

Have the junior staff manage the fundamental mitigations.

Entry level job descriptions shouldnt be a book and actually be entry level 0 to 1 year experience.

Entry level interviews should be asking critical thinking, like why would you use something. Idea: Give them a doc and ask for a summary and opinion.

Blind hiring to reduce biases. Name, age, school names, hobbies should be removed.

Prevent resignation by clear expectations. Challenge them. If the do want to leave, help them where you can by sharing your network.

Take a look at cybesecurity gatekeepers foundation.

Show threadFrank #CompuWatcher Piscitello☕🍺🧑‍💻🖖Apr 19, 2023

The next session on Incident Response. #swphl23

Have a comms plan that includes legal and law enforcement.
Know what data should be monitored during an incident and where to find it.
Rely on "Spidey sense" and report on things that look weird.

Have some runbooks that can quickly identify false alarms accurately. Triage is important.

The rest was a brief on a recent incident with lessons learned.

Note: it's always good when real world sharing happens. Let others learn the same lessons that can be applied to their environment.