Peter Gunst, MBA

Olaf Classen, one would argue that the role of the CISO is quite well defined. More so as cyber regulation takes effect across covered firms. It maybe that CISOs have not yet evaluated what they should do to support their boards manage cybersecurity risks and subsequently articulated that well enough. The challenge CISOs face is there are no agreed professional standards that define their role. As there are for Chief Finance Officers, General Counsel, Chief Audit Officer or Chief Engineer for example. Or professional associations such as the IIA, AICPA, CIMA, IMechE, WCoSP and more for CISOs. All acronyms that denote professional bodies. Thaddeus Dziekanowski Veritas GRC #cybersecurity #cyberriskmanagement #ciso

4

The right way …

1

Meet (and follow) my cofounder Dror-John for fufu foo and deep insights across all Tellerrands:

7

2 Kommentare

#Cybersecurity in die #Geschäftsleitung zu tragen ist nicht nur in #Deutschland eine #Herausforderung: ""#ICO warns that many #UK businesses are still cybersecurity laggards" "“While cyberattacks are growing more sophisticated, we find that many organisations are not responding accordingly and are still neglecting the very foundations of cybersecurity.”" https://lnkd.in/et95umaZ

6

🧠 Legal particularities of #Software as a #Service (#SaaS) contracts - especially #AIaaS: In the digital age, in which cloud services are becoming increasingly important, Software as a Service (SaaS) is an important facet. ⚖ AI-based SaaS solutions (AIaaS) raise specific legal issues, particularly in relation to the transparency of algorithms and the use of data. Providers of such services must be transparent about how their algorithms work and what data is used to make decisions: 1️⃣ Transparency and traceability of algorithms: AI systems, especially those based on machine learning techniques, are often referred to as "black boxes" because the decision-making processes are not always traceable. This raises questions of transparency and explainability. However, legal frameworks such as the GDPR require that decisions that have a significant impact on individuals must be transparent and understandable. Providers of AIaaS must therefore ensure that their systems are able to provide explanations for their decisions, which is often technically challenging. 2️⃣ Data quality and bias: The quality and integrity of the data used to train AI models is critical to the performance of AI. Distorted, incomplete or erroneous data can lead to incorrect or biased decisions. Providers must ensure that the data sources used are reliable and free from systematic bias in order to minimize legal risks. At the same time, the question arises as to who is liable if decisions based on incorrect data lead to damages. 3️⃣ Legal responsibility: The question of responsibility is particularly complex in scenarios involving autonomous AI systems. If an AI makes incorrect decisions, it is not always legally clear who can be held liable - the provider of the AIaaS, the developer of the algorithms or the user of the AI services. A clear allocation of responsibilities in contracts and terms of use is essential to facilitate legal clarification in the event of damage. 4️⃣ Copyright issues: The copyright assignment of AI-generated content and models is still a legal gray area. AIaaS providers must clarify in their contracts who owns the rights to the data and models generated by AI and how this data may be used. 5️⃣ Compliance with data protection regulations: AIaaS applications often process large amounts of personal data. Providers must therefore ensure that their solutions comply with data protection regulations such as the General Data Protection Regulation. 🔥 As AI services and automated decision-making processes become more widespread, the liability risks also increase. In addition, both the planned revision of the EU Product Liability Directive and the new AI Liability Directive will mean that providers of AI SaaS can be held liable for damage caused by their systems. https://lnkd.in/eAr54FJc

2

Good to know

8

Podcast recommendation🚨OMR x SoSafe In the latest episode of my favorite podcast OMR - Niklas Hellemann gives an insight into fighting at the forefront of cybersecurity awareness here at SoSafe. Super interesting to listen to and a great way to start the day!

5

So what ARE the risks of GenAI? Check out this short video below from my short and fascinating excursion to #helsinki to speak at WithSecure #sphere24 conference!

38

⚡⚡⚡breaking news - we did it again ⚡⚡⚡ #Cybersecurity is an important but complex topic for all C-levels and board members. Especially as they are liable if something is going really wrong and they did not conduct all actions to prevent a cyber attack. 👉 👉 👉 The problem: most of the literature is focused on the technical side and is not suitable for C-levels and managers. As a C-Level, manager and Board Member is not important to understand any technical detail but it is important to get the right insights in a model at a glance that you know what needs to be taken for. Also, the complex topic must be described in that way that it can be understood on a management level. 💡💡💡 So I brought up the idea last year to make a management book for this important topic with a management framework and discussed the idea with Maximilian David from Springer Gabler. They liked the idea and we started a cool journey to write a book about this important topic. Especially the timeline was a challenge. 📖📖📖 I am thrilled now that we finished the book and it is now announced already for July 2024 at Amazon. Thanks to they cybersecurity experts and my co-authors Patrick Paulsen and Paul Arndt for making this happen. Thanks to the cybersecurity champ Nico Werner for the CISO contacts and the marketing support by Sabine Kirchem. The cool thing about our book: 💡 We have all important trends in it (they probably will change quickly) 💡 We have a competence model for managers to guide you as a manager in the Cybersecurity jungle 💡 We have great interviews also in the book, e.g. with named CISOs, Lutz Jannausch from Microsoft and Olga Stepanova, LL.M. (Berkeley) as legal expert to have insights from market experts. 💡 It also comes with a additional e-learning path on top of the book. Thanks to Christian Isele to help us with the production here. I keep you posted when it is finally published this summer. You can already make a pre-ordering. Guido Happe Daniel Gehring David D. Laux Patrick Schäfer Andreas Wach Lyubomir Aleksiev Alexander Stoyanov Jennifer Alves Sebastian Letz Carsten Matlage Radoslav Bratanov Isis Steven Florian Dimmig Stefano D`Amilo https://lnkd.in/eREhxgyS

83

14 Kommentare

📢 Attention Swiss Financial Institutions! 🚨 In the ever-evolving cyber landscape, FINMA's latest guidance is clear: Red Teaming and Tabletop Exercises are paramount, and outsourcing is still a significant risk driver. With over 50% of cyber attacks involving outsourced services, the stakes have never been higher. Here’s where wizlynx group steps in with Red Teaming: https://lnkd.in/dDwDvHWE Why us? 🔍 🔴 Real-World Attack Simulations: Our experts have been mimicking malicious hackers for 35 years—think of us as your friendly neighbourhood cyber ninjas, uncovering vulnerabilities before they become threats. 🔴 Compliance with FINMA: Ensure your institution meets FINMA's stringent requirements with our thorough, scenario-based exercises. Because no one wants a stern call from FINMA! 🔴 Peace of Mind: Outsourcing doesn’t have to mean vulnerability. Let us fortify your defences and keep your data safe, so you can sleep easy knowing we’re on the cyber case. Want to calculate ROI of Red Teaming for your Team? Easy-peasy, drop me a message. #CyberSecurity #RedTeaming #FINMA #SwissFinance #wizlynx #DataProtection #CyberRiskManagement #Outsourcing

11

1 Kommentar

That campaign about "Germany's worst passwords" is a great example for "Germany's worst password awareness campaigns". To be fair, they got a point that ridiculously bad passwords like "schalke04" are less secure than the obfuscated derivation "schAlke_04-steigt_auf". The conclusion to use these obfuscated passwords is surprisingly unqualified considering the size and professionalism of Deutsche Telekom. Before having a short deep-dive why this recommendation is a bad one, let's just take a step back and talk about a good solution: As a most important recommendation, you should use multi-factor authentication where possible! Please choose unique and fully random passwords with a length of at least 12 (rather 16 or more) characters. They are hard to remember (that's a feature, not a bug!) and you will need a password manager to handle them. Then, you just remember one strong password to unlock all those unique passwords. By copy&paste you can insert them when and where you need them. Even if someone can "spy" your password from the password manager, he/she must gain access to your password database (when stored offline) and additionally make you confirming the multi-factor authentication requests. But what is wrong with Telekom's recommendation? - Following the recommendation will not incentivize you to use a password manager. If you disagree with that statement, why would you need to remember your password at all with a password manager? - Your level of security will remain the same for certain important attack vectors: Keyloggers, physical theft (including shoulder surfing), and phishing attacks remain as dangerous as before - Online brute-forcing* is not a real thing anymore. By implementing some basic requirements that are state-of-the-art for many years now, brute force attacks will be discovered and/or accounts will be locked out after a reasonable number of login attempts - Offline brute-forcing** might still work after a data theft. In that case, the attacker will have a hard(er) time to brute-force your password. But then my first assumption becomes important again: By not using a password manager, an attacker might use your leaked credentials for multiple logins. When a data leak happens, I would rely on my "unique-password-policy" and MFA and sooner or later the information by the host that a breach happened. * Online brute-forcing describes the technique to iterate through all possible passwords ("a", "b", "c", ... "aa", "ab", "ac"...) against the login interface (e.g. website) of a service ** Offline brute-forcing describes the technique to iterate through all possible passwords against a leaked password database where the passwords' hashes are stored to reconstruct the originally used password

4

1 Kommentar

Universitätsklinikum Hamburg Eppendorf and other hospitals for the Zivilschutz und Katastrophenschutz (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (BBK), there are volunteers to assist in German Federal Agency for Technical Relief (THW) and Hi-org ( Deutsche Rote Kreuz, Workers' Samaritan Federation (ASB), DLRG, Malteser International and Johanniter GmbH ...) , on top of the ambulance professionals. But for Police work in Germany and Hospitals, there is none. Same as the Feuerwehr Hamburg works daily and the FreiwilligeFeuerwehr only from time to time, same as the Sanitäter has shorter training than RS and NS. On my praktikum for the RS/EMT I spend time at the hospital. There are tasks that a healthy person can do to help the professionals. Why not have a 40 or 80 hours FN ( Freiwillige/Volunteer-Nurse ) training and create an NGO to have a pool of volunteers to call when overwhelmed ? I was able, at the hospital, to measure the vital parameters and walk to take the blood sample for examination, among other tasks. That frees up capacity to do more skilled required work from the professionals. I am not talking about taking important decisions or operating people from watching Grey's anatomy. But even after corona/covid , it is about time to work on a concept. More natural disasters are coming, maybe more viruses ... Hospitals in Germany had equipment enough, but not enough workers. I volunteered at a elders-home without any training ( back in 2022, when staff itself was infected) , because it would help the trained staff if I would deliver food, run to check when someone wanted attention, etc. The army ( Bundeswehr Wir. Dienen. Deutschland. ) already got around a shorter training version for civilians to join their reserve. The health system needs to copy the concepts from volunteers to stay functional in emergencies, without "burning" all their professionals, who will leave the industry. Freie und Hansestadt Hamburg ; Handelskammer Hamburg ; any actions in this regard? And Polizei Hamburg maybe watch this Doku: Hausfrau, Mutter & Gendarme | Frankreichs Reservisten | Real Stories Deutschland The government will not solve all our problems, I am a believer that people have good hearts and want to help other people, the health industry has to build the structure and environment, to enable that. #volunteer #NGO #hospitals

4

1 Kommentar

What kind of security do we really need? I learn less is more every day. How should a security strategy and method look like?

1

#WeAreDevelopers #WWC24 – Part 2   The Power of Purpose: Unlocking Potential and Innovation our panel talk with Sue, Hadi, Steffen and me. What is the potential, “purpose” can unlock in a workforce/for a company? Interesting that at the current survey of Kienbaum showed that 60% of employees don´t know the company’s purpose and our quick check in the audience showed only 50%. Especially in the increasing complexity around us the purpose give orientation and helps to do the right things. The second dimension of purpose is your purpose in life. Unfortunately, this is even lower. Just 1% in the audience has a purpose of life. If you don´t know your purpose you are living the purpose of someone else. This is o.k. if it feels right to you, but you should take some time to find it and check if this is in line with your company´s purpose. Your full potential can flow if this is the case. Let´s find your purpose of life now!   It´s might be good to listen in our first podcast about “purpose” and how this trend will stay. We had Dominic in our session. https://lnkd.in/e23sqmdB   Again, I am glad to be part of the #WWC24. Many thanks to Sead, Rudi, Thomas and Lena.   #WeAreDevelopers #WWC24 #weilmachenkrasserist #DigitalPacemaker #IT4good

17

Ich kann es fast nicht glauben ! Glückwunsch an SoSafe und seine Mitarbeiter. Unter den Top 20 Weltweit im Bereich der Cybersicherheit. Niklas Hellemann Christian Reinhardt ( Stellvertretend ) und SoSafe I was looking through a post I wrote for Security Boulevard back in 2021: Top 20 Fastest Growing Cybersecurity Companies in Q1 2021. That was a year before we began work on the IT-Harvest Dashboard so I was still tracking headcount data in a giant Google Sheet. That inspired me to take a look at the fastest growing cybersecurity companies so far this year. First I used the Dashboard to find the 318 vendors that had grown more that 25% since the end of December. Then I sorted on size. This way I eliminated the vendors that had grown from 2 to 8 people (300% growth!) Looking at this list highlights some amazing company performance. 1 Password and Wiz are already at the size of what would have been IPO ready companies just a few years ago. And they are adding people at an astounding rate.

135

8 Kommentare

Bundesamt für Sicherheit in der Informationstechnik (BSI)'s 20th German IT Security Congress kicked off today, highlighting the growing issue of cyberattacks. According to the IBM X-Force Threat Intelligence Index 2024, hacks via stolen or compromised credentials have surged by 71% year-over-year. The manufacturing industry, at 28%, bears the brunt of attacks in Europe. To gain an edge in the cat-and-mouse game against hackers, cybersecurity experts increasingly leverage #blockchain for its immutability and tamper-proofing features. Other #CyberSecurityTrends2024 gaining traction include #ZeroTrust frameworks, the Secure Access Service Edge (#SASE), and proactive AI risk mitigation. Additionally, alliances form to foster resilient IT infrastructures. And who better to speak on #IndustrialSecurity strategies than the renowned K5 chief detective inspector Daniel Lorch? Mark your calendar for 23 May 2024, when the expert will share insider knowledge at our "SPS Technology Talk". Register for free (German only): sps.digital.mesago.com #SPS_live #BringingAutomationToLife

4

It‘s good to see when #cybersecurity issues are made public as early as possible! If, as in this particular case, the threat exists for 20 years, still quick action is necessary as soon possible: As a significant number of our customers are using #congaconnect additionally for remote maintenance (early on, we already stated that remote maintenance and digital connectivity must not be mixed - hence this is an optional, clearly separated feature), we immediately took action: The issue has been addressed and a fix is currently rolled out with priority to all customers using conga-connect - a congatec aReady solution as a #VPN gateway. Kudos to Leviathan Security Group!

5