Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2024

TrustCloud Product Updates: April 2024

You know us: Every month we’re cooking up something new! Here are the updates that hit TrustCloud this month. TrustShare GraphAI will answer questionnaires for you with accurate, high-quality responses. TrustShare is getting a huge AI glow up. GraphAI’s generative AI capabilities will now fill in answers that are more context aware, more natural, and more accurate than ever before.

Introducing ISO 42001 and NIST RMF Frameworks

While AI has created exciting new opportunities for business, it has created urgent questions around ethics, responsible use, development, and management. AI also introduces a new, and often nebulous, element of organizational risk. With the introduction of two frameworks, ISO 42001 and NIST AI RMF, companies can now implement, demonstrate, track, and build their responsibility and trust around AI. TrustCloud is very pleased to announce that we support both ISO 42001 and NIST AI RMF.

Keeper Webinar: Building a Robust Governance, Risk & Compliance Framework: Challenges & Solutions

IT Compliance doesn't have to be chaotic. Join Teresa Rothaar, Keeper Security's Governance Risk & Compliance Senior Analyst, in this webinar for ActualTech Media on the challenges and solutions to build a robust GRC framework. Keeper helps every organization get full visibility and control over employee password strength, credential sharing, permissions, zero-trust network access and dark web exposure, strengthening auditing and compliance for HIPAA, PCI DSS, SOX, GDPR, CCPA and more.

PCI DSS Compliance For Banks

In today’s digital era, financial transactions are carried out using cards daily. It is of utmost importance for banks to ensure the safety and security of the cardholders’ data. The Payment Card Industry Data Security Standard (PCI DSS) compliance 4.0 offers essential guidelines and a framework to safeguard cardholders’ data and mitigate any potential data breaches that may occur in banks.

7 Steps to ensure compliance with the CJIS security policy

A high-profile case hangs in the balance. Suddenly, court systems are paralyzed. Evidence is locked away, replaced by a ransom demand. Every law enforcement agency’s nightmare is alarmingly common – 96% of organizations were hit by ransomware in the past year, according to Cisco’s 2023 report. Exposed API keys, forgotten cloud configurations, outdated systems – these seemingly small vulnerabilities are the entry points relentless cybercriminals exploit.

Top HIPAA Compliant Fax Services: Ensuring Secure Healthcare Communication

When it comes to transmitting sensitive patient data, faxing must be secure and compliant under HIPAA regulations. But what does a 'hipaa compliant fax' service entail? Without delay, this article gets to the heart of HIPAA fax compliance, detailing the necessary security measures, the severe risks of non-compliance, and how to identify credible fax services that uphold these regulations. Discover the components and benefits of dependable HIPAA compliant fax solutions that protect patient data and uphold the integrity of healthcare providers.

Insights from the Experts: Legal, Compliance, and Security Perspectives on SEC Regulations

In July 2023, the U.S. Securities and Exchange Commission (SEC) announced new cybersecurity rules that require publicly traded companies in the U.S. to disclose material cybersecurity incidents within four business days of determining whether the incident is material to the company’s financial performance. SecurityScorecard recently hosted a webinar discussing the implications of the new rules and how compliance, security, and legal experts can elevate their game to meet these new regulations.

How to Migrate from FedRAMP Rev 4 to FedRAMP Rev 5

The stereotype of the government as a slow-moving behemoth is not ill-fitting, but when it makes adjustments and changes, it does so with deliberation and intent. An excellent example is the ongoing development and evolution of things like security standards. Technology moves much, much faster than the government can respond to or that even most businesses could adjust to without a significant investment or a time delay.

Fines for HIPAA Non-Compliance

In today’s digital age, the exchange and storage of information has become very common in all sectors of the world, healthcare being no exception. But with this transmission and storage comes the dangers of security and unauthorized access. The Health Insurance Portability and Accountability Act (HIPAA) was enacted with stringent regulations to safeguard this data and its violations can be severe.

TrustCloud's New Hallucination-Proof GraphAI Shaves Hours Off Security Questionnaires

TrustCloud’s AI already pre-fills up to 80% of a security questionnaire, but we’ve developed the next iteration. TrustShare has built new generative AI capabilities called GraphAI. GraphAI will still find the right answer for a security questionnaire topic, but now it will better account for context and generate more natural, accurate responses based on your program controls. GraphAI is built on a retrieval-augmented generative (RAG) model on our large language model (LLM).

What is SaaS Security Posture Management?

In a cloud-first world like today, Software-as-a-Service (SaaS) is becoming the everyday solution for organizations to operate and boost their efficiency. Still, this rapid uptake of SaaS apps brings new security problems. This is precisely where SSPM comes in-a vital tool to help organizations efficiently track, audit, and enhance their SaaS application security posture. What is SaaS Security Posture Management? How does it work? In this piece, we'll break down the fundamentals of SSPM, including its benefits, features, and how it sets itself apart from other similar solutions.

Cloud Security Regulations in Financial Services

As the financial sector continues to adopt cloud technology, regulatory frameworks such as the updated NIS2 Directive and the Digital Operational Resilience Act (DORA) are shaping the cybersecurity landscape. Every second counts in such a complex environment: attackers can move quickly in the cloud, so defenders must change their strategies and tools to keep up. The financial sector has always been a prime target for cyber attacks, with the average breach costing almost 6 million US dollars.

The Ultimate Guide to SBIR/STTR Funds for Your ATO

The world advances based on innovation, and innovation can come from anywhere. The trouble is that the current capitalist economic system encourages large corporations to play conservatively with their products and their budgets while working to secure their own positions in their industries. It becomes quite difficult for a new small business to enter the field, especially if they’re trying to enter a field that requires substantial facilities, research, or resources to get established.

Advanced GDPR Compliance Strategies for Cybersecurity

As digital transformation continues to multiply pathways to personal data, complete GDPR compliance is getting harder to attain. Whether you’re a data protection officer or a cybersecurity professional helping your organization remain compliant, this blog suggests advanced GDPR compliance strategies you may not have yet considered - beyond that delightful cookie consent notice we all love.

Forward Networks Achieves SOC 2 Type II Compliance, Reiterating Commitment to Data Security and Transparency

Forward Networks announced today that it has successfully achieved System and Organization Controls (SOC) 2 Type II Compliance attestation conducted by an independent third party. The completion of the audit demonstrates Forward Networks' long-term commitment to providing its customers transparency, privacy, and data security. Forward Networks achieved SOC 2 Type I Compliance in July of last year.

Proxies Explained: The First Line Of Defense In Cybersecurity

Cybersecurity is vital in today’s fast-paced digital world, where keeping your private information safe is as crucial as the technology itself. Proxies are key players in this arena, not just for the tech-savvy but for everyone online. They work quietly behind the scenes, rerouting your internet traffic to keep your activities private, speed up your browsing, and even unlock content that’s out of reach due to geographic restrictions.

Equivalency: The Latest FedRamp Memo From DoD

The Federal Risk and Authorization Management Program has been around for nearly 15 years. In that time, it changed and was updated periodically to keep up with the times. While changes are occasionally made to the underlying security frameworks like FedRAMP, CMMC and the NIST documentation that reviews each security control, there is also communication directly from the Department of Defense and other organizations to issue additional guidance.

Cybersecurity Compliance Around the Globe: India's DPDP

In an era where data breaches and privacy concerns are increasingly shaping global discourse, India's proactive stance on data protection is noteworthy. Introducing the Digital Personal Data Protection (DPDP) Act 2023 marks a significant milestone in India's legislative landscape. This groundbreaking Act fortifies individual data privacy rights and aligns India with global cybersecurity and data protection standards, setting a new benchmark for regulatory compliance.

Leveraging Threat Intelligence for Regulatory Compliance

The US Government recently announced that state-sponsored Chinese cyber group Volt Typhoon has compromised multiple critical infrastructure organisations’ IT networks in the US and is preparing “disruptive or destructive cyber attacks” against communications, energy, transport, water and waste water systems.

Material Incident Reporting Obstacles in SEC Cybersecurity Disclosures

‍ Over the past few decades, cyber attackers have increasingly wreaked havoc on the market, taking advantage of newer, more sophisticated ways to exploit system vulnerabilities. However, in fear of losing competitive advantages, organizations had notoriously downplayed the impact of these attacks, misleading investors and resulting in stock prices that did not accurately represent the risk landscape. ‍

FIPS Compliant Algorithms for Encryption, Hashing, and Signing

With the rise of cyber threats and the increasing volume of sensitive data being transmitted over networks, organizations must prioritize the use of cryptographic algorithms that meet stringent standards for security and reliability. One such standard is FIPS (Federal Information Processing Standards) compliance, which ensures that cryptographic algorithms adhere to the rigorous criteria set forth by the U.S. government.

A06 Vulnerable and Outdated Components - OWASP TOP 10

Outdated software components are a hacker's best friend. Learn about the dangers of A06:2021 (formerly known as "Using Components with Known Vulnerabilities") in the OWASP Top 10. This threat just climbed the ranks – let's get you up to speed! In this video, we'll tackle.

GDPR - Do You Need to Comply?

I thought it would be a good idea to revisit GDPR, just as a reminder to all of us to take stock and see how ready we are. For the uninitiated, the EU Commission, Parliament, and Commission negotiated and finalized the text of what is called the “General Data Protection Regulation” (GDPR) in December of 2015. This was officially approved as Law in April 2016 and goes into effect on May 25, 2018.

A Guide to NIS 2 Requirements and How Cyberint Helps Meet Them

Cyber threats against critical infrastructure – such as energy and transportation networks – remain pervasive as ever, with 2023 witnessing an astounding 420 million such attacks in total. That’s the bad news. The good news is that critical infrastructure is set to become more secure, at least in the European Union, thanks to the NIS 2 Directive (also known as E.U. Directive 2022/2055).

Remote Work Business Continuity: Best Practices

Incorporating remote work among companies has been one of the developments in recent years. In fact, a staggering 98% of employees express their desire to have this kind of dynamic in their jobs. The shift is here to stay as more and more organizations are adopting it as part of their work culture because of its many advantages. This integration is essential as employers move forward with their business continuity plans.

CMMC vs NIST 800-171

January 2020 is when the Department of Defense (DoD) released the Cyber Maturity Model Certification (CMMC) framework, aimed at evaluating and strengthening the cybersecurity readiness of the Defense Industrial Base (DIB). As per the DoD’s directive, all prime contractors and subcontractors within the supply chain must undergo auditing and certification under the CMMC framework.

Security vs. Compliance: What's the Difference?

Security and compliance – a phrase often uttered in the same breath as if they are two sides of the same coin, two members of the same team, or two great tastes that go great together. As much as I would like to see auditors, developers, and security analysts living in harmony like a delicious Reese’s cup, a recent gap analysis that I was part of reminded me that too often, the peanut butter and chocolate sit alone on their own separate shelves.

What is Internal Revenue Service Publication 1075 (IRS Pub 1075)?

Here at Ignyte, we talk a lot about the most common and popular security certifications and frameworks for cloud service providers and others, FedRAMP, CMMC, and their associated NIST publications. These are very important, but they’re far from everything that can be relevant to a CSP or to businesses looking to maintain their security credentials. Most CSPs have to deal with basic PII, CUI, and other forms of protected information that may be treated broadly the same.

5 Common Cybersecurity Blunders Often Made by Commercial Enterprises

Big businesses carving out their place in the digital age find themselves in a constant battle against cybersecurity threats. Despite their access to state-of-the-art technology and substantial financial resources, these commercial giants are not impervious to attacks. The complexity of their networks and the voluminous data they handle magnify their attractiveness as targets for cybercriminals.

NIS 2 explained: Security Compliance Path

The ever-evolving cybersecurity threat landscape make the competent authorities adapt to reality by establishing new security regulations and laws. According to Forbes Advisor in 2023, there were more than 2K cyberattacks with more than 340 million victims all around the world, which made a significant increase of 72 % in data breaches since 2021.

Avoid Threats and Vulnerabilities with HIPAA Risk Assessment

Nearly 50 million healthcare records were compromised in 2022, highlighting a dire need for proactive data security measures in this rapidly evolving digital landscape. For healthcare entities storing ePHI (Electronic Protected Health Information), a comprehensive HIPAA Risk Assessment is a foundational step towards protecting sensitive data and ensuring compliance. Furthermore, establishing robust Business Associate Agreements (BAAs) is a HIPAA mandate; failure to do so invites substantial penalties.

Navigating the Digital Transformation in the Insurance Sector

The insurance industry stands at a crossroads, with digital transformation dictating a new direction for traditional practices and operations. As customer expectations evolve and technology advances at an unprecedented pace, insurers are pressed to adapt, redefining their business models and strategies. This adaptation is not merely about adopting new technologies but also about embracing a cultural shift towards innovation, agility, and customer-centricity.

[Downloadable Template] How to audit your outdated security processes

As your business grows, there are new demands of the security team, like adding additional compliance frameworks, more security questionnaires, or new, advanced requirements from large enterprise customers. ‍ While this growth is exciting, it also comes with growing pains — like outgrowing your existing security processes.

How to Create Emergency Response Plans for Schools

Security is crucial in daily life. It is the responsibility of the school management to develop reliable security measures for the children of their school. It includes laying down adequate emergency response plans for potential scenarios threatening the institution. Schools will safeguard lives by following emergency response plans. Explore each idea to help you make more informed decisions and be fully prepared. Remember that everyone needs to know the plan at their fingertips and practice it when required.