New Data Security Regulations to Watch

The proliferation of data security regulations has increased in recent years, galvanizing privacy concerns worldwide. According to industry analyst Gartner, by 2023, nearly two thirds of the world’s population will have its personal data covered under modern privacy laws.

In the United States, there is no comprehensive federal data privacy law, despite many attempts to coordinate a unified approach to data privacy. In the absence of a framework, some states have charged ahead to pass their own new comprehensive data privacy laws – inspired in part by the European General Data Protection Regulation (GDPR).

Listed below are summaries of three newer privacy regulations to watch – some of which will set the tone for forthcoming legislation in other states.

California Consumer Privacy Act

Inspired by the GDPR, the CCPA went into effect early last year and is applicable to for-profit entities that collect personal information from California residents and meet any of the following thresholds:

• at least $25 million in California-based gross annual revenue;

• receives, processes or transfers annual 50,000 data volume;

• derives more than half of its annual revenue from the sale of personal information.

The law regulates the sale, process and transfer of personal data, defending:

• data to be used to identify another;

• individuals;

• those within a household;

Personal data is protected via stiff data penalties for non-compliance, and consumers are provided with an automatic private right-of-action checklist to peruse business CCPA compliance. In 2023, the California Privacy Rights Act (CPRA) will boost consumer protection, and a distinct privacy entity will enforce its laws.

Health Insurance Portability and Accountability Act  

The U.S. Department of Health and Human Services’ Health Insurance Portability and Accountability Act regulates health insurance. It also requires ongoing protection for patients’ personally identifiable information, which is increasingly attractive for cyberattacks. HIPAA data security requires that covered entities:

• continually monitor file and perimeter activity and access to sensitive data;
• access control–re-compute/revoke permissioning on need-to-know business right;
• maintain written records–detailed activity records for all data user objects.

HIPAA’s Privacy Rule and the FTC Act, discussed next, are similar, and healthcare organizations should understand how to properly follow both for comprehensive data security.

Federal Trade Commission Safeguards Rule Updates

The Federal Trade Commission – independent of presidential control –prohibits unfair competition and has been the chief federal agency on privacy policy and enforcement since the1970s when it began enforcing one of the first federal privacy laws – the Fair Credit Reporting Act. Since then, rapid changes in technology have raised new privacy concerns, but the FTC’s overall approach has been consistent: The agency uses law enforcement, policy initiatives, and consumer and business education to protect consumers’ personal information and ensure that they have the confidence to take advantage of the many benefits of the marketplace.

The FTC’s overseeing role for financial institutions protects information from foreseeable threats to security and data integrity. The Gramm-Leach-Bliley Act requires that financial institutions share and protect customers’ private information, and the FTC’s Gramm-Leach-Bliley Act Safeguards Rule requires covered financial institutions to develop, implement and maintain a comprehensive information security program that complies with FTC requirements. Among the updates to that we can expect to see to this are:

• more-specific orders requiring that organizations implement broad, process-based data security programs
• improved third-party assessor accountability to review required data security programs
• companies presenting their governing body a written security program
• senior officers provide annual compliance.

The FTC’s Business Center has Tips & Advice demonstrating:

• a sound security plan, collect only what you need;
• free business resources, any size;
• Consumer and Business Blog Series.

Overall, most states and D.C. have laws requiring businesses to own, license or maintain personal information. This permits residents of that state to expect businesses to maintain “reasonable security procedures and practices” for personally identifiable information. (PII). New personal data security laws have doubled since 2016 — from unauthorized access, destruction, use, modification or disclosure — by PII.

At minimum twenty-five states and D.C. have laws and conditions addressing:

• data security laws applying to state agencies or governmental entities;
• governments’ vast amounts of data regarding citizens;
• state databases attracting cyber criminals;
• laws enacted within the last few years;
• recent, security/oversight statewide enactments.

A full cybersecurity latticework among states is in reach, technical background or not. In the coming years, expect to see a continued flurry of activity: new consumer privacy laws such as those that will take effect in Colorado, Virginia and California in 2023; Utah’s Cybersecurity Affirmative Defense Act, which provides organizations with a safe harbor for data breach notification in limited circumstances (also 2023); Nevada’s broadened privacy law pertaining to the sale of personal data to third parties; and more. Still, however, no comprehensive federal data privacy law is in the works.

Guest blogger Barry McPhee is a freelance writer based in Vermont. 

Cybersecurity Tech Skills, Public & Private

Why your Organization’s Cybersecurity Skills Should Deploy on Two or More Levels[BM1] 

First, scale your cybersecurity culture through collaborative, cybersecurity checks among each workforce. Keep your information technology (IT) support through a fully managed service-provider, while in low to mid-range shops, reputable operations can monitor all operation domains among cybersecurity.

High-Tech Cybersecurity Skills & Training

In 2021 at least 38 states are tackling cyberthreats directed at governments and private sectors. The U.S. Department of Labor projects strong tech demand to grow 13 percent, from 2016 to 2026. This adds roughly 600 thousand new jobs.

Cybersecurity skills on corporate boards’ agendas and investments are, despite, slowing cybersecurity budget growth. Among state agencies, supporting programs are incenting cybersecurity training and education. These are establishing or increasing appropriations for cyber skills. In 2019 the U.S. included $15 billion for cybersecurity, increasing $583 million over 2018.

Continuous opportunities prosper for new workforce entrants. The National Cyber Strategy needs[BM2]  techie bodies to strengthen critical cybersecurity federal networks and infrastructure.

Among shortages of cybersecurity talent and capability, techie and non-techie confront a shortage of cybersecurity. Over the last eight years–currently to grow by 350 percent–a full-on war for cyber talent continues.

Low-Tech Cybersecurity Skills

Your low-tech cybersecurity—a “simple operation”—is you and colleagues defending computers, servers, mobile devices, electronic systems and networks and data.

Several websites say a cybersecurity career can be a moderate learning curve, adaptable for your non-tech background. A computer science degree is seldom required. Non-techies can blend with cyber policy analysts and technical writers. Coding or development skills can be in-house.

Low-Tech, Public Sector

A small tech-oriented organization should establish an encircling cybersecurity culture, underpinning[BM3] :

·   conversing regularly, frequently, about cybersecurity;

·   strong password management;

·   teach employees to recognize phishing attempts;

·   reporting cybersecurity incidents.

While avoiding data breaches[BM4] , 50 percent of Small And Midsize Business (SMBs) have this year suffered a security breach. Small businesses are attacked more often than larger businesses, but the attacker finds fewer networks to exploit.

Low-Tech, Private Sector:

Your small tech outfit’s productivity is a central core of your life. IT support, if on the back burner, can or will make or break the livelihood of the business. An IT investment, sooner or later, will be your partner. 

Being up-to-date with security measures should be a major priority. Through solutions for computer software, hardware, and recent innovations like VoIP phone systems and cloud storage.

However…

The demand of IT savvy, analysts estimate that by 2021, over 4 million cybersecurity jobs will be unfilled. This profession bears an extremely overloaded work-load.

 

-- 30 --

---

 [BM1]I’ve linked blog

Employee Cyber Security Training   

to our Cybersecurity Tech Skills here.

----------------------

Perhaps connect with blog Cybersecurity Governance Matters to Your Organization?

 

 [BM2]Re-look this; not quite right . .

 [BM3]AISN Blog link:

https://aisn.net/employee-cyber-security-training/

·          [BM4]  An AISN link to While avoiding data breaches

·           https://aisn.net/avoiding-data-breaches/

 Seeing/Managing Net Zero Montpelier as a Series of Projects

The work we’re undertaking over the next fifteen ‘Net Zero Montpelier‘ (NZM) years is to a great extent a series of projects – a series of temporary efforts building on predecessor efforts (i.e. projects) – undertaken to create a unique NZM product, service or result.  The Strategic Planning committee has identified several such series such as: measuring current/electric/thermal/transportation energy use; fuel switching; installing smart meter infrastructure. 

Managing these NZM projects will require ongoing, high standards, without confusion, waste, duplication of effort, and failure will occur.  We’ll be able to organize each project, from its initiating through its closing steps, in a common set of processes and templates which you’ll see in the following documents in this folder.  These will walk NZM project teams through core project work areas such as:

n  Agreed-upon project scope (what’s in, what’s out)

n  What work is required

n  Who does what work

n  When does the work happen (first, next, et al)

n  What resources are required to do the work

n  Surfacing project problems up front

n  Communicating on-going project details to all project stakeholders

Through this common approach, we’ll also be able to say “here’s what this project is, who’s doing what, where we’re at, what risks/issues we’re having, how we’re addressing them, when we anticipate completing this project” to MEAC, the City Council, funders and anyone else.  Project teams will also be able to hand off its work seamlessly to new project team leaders and members – crucial in a volunteer-heavy resource base.

If you’re reading this document, you may be a “Project Lead” for an NZM project.  The next document, 2. Kicking off an NZM Project.doc, will take you through your project’s first few steps.

--Barry McPhee, PMP®

Managing Net Zero Montpelier as a Series of Projects

 Seeing/Managing Net Zero Montpelier as a Series of Projects

The work we’re undertaking over the next fifteen ‘Net Zero Montpelier‘ (NZM) years is to a great extent a series of projects – a series of temporary efforts building on predecessor efforts (i.e. projects) – undertaken to create a unique NZM product, service or result.  The Strategic Planning committee has identified several such series such as: measuring current/electric/thermal/transportation energy use; fuel switching; installing smart meter infrastructure. 

Managing these NZM projects will require ongoing, high standards, without confusion, waste, duplication of effort, and failure will occur.  We’ll be able to organize each project, from its initiating through its closing steps, in a common set of processes and templates which you’ll see in the following documents in this folder.  These will walk NZM project teams through core project work areas such as:

n  Agreed-upon project scope (what’s in, what’s out)

n  What work is required

n  Who does what work

n  When does the work happen (first, next, et al)

n  What resources are required to do the work

n  Surfacing project problems up front

n  Communicating on-going project details to all project stakeholders

Through this common approach, we’ll also be able to say “here’s what this project is, who’s doing what, where we’re at, what risks/issues we’re having, how we’re addressing them, when we anticipate completing this project” to MEAC, the City Council, funders and anyone else.  Project teams will also be able to hand off its work seamlessly to new project team leaders and members – crucial in a volunteer-heavy resource base.

If you’re reading this document, you may be a “Project Lead” for an NZM project.  The next document, 2. Kicking off an NZM Project.doc, will take you through your project’s first few steps.

--Barry McPhee, PMP®

How to Bridge the Cybersecurity Skills Gaps, to Advance Cybersecurity Training and Skills

 In an Industry Faced with a Talent Shortage

 Your Skills Gap Decade

Year  2021 left you a skills gap decade with no one reason behind it. Globally, cybercriminals have instigated lost billions through state-sponsored hacking groups.

In 2010, the Center of Strategic and International Studies (CSIS) deemed the U.S. lacks cybersecurity experts. Across society, business and government. 

By 2016, researchers agreed on a worldwide gap. In a 2020’s Coronavirus environment, remote work is extending beyond 2021.

Year 2022’s global cybersecurity workforces—industry labor pools—need 1.8 million hi-tech professionals to operate and support deployed systems.

 

Cybersecurity talent crunch has created 3.5 million unfilled Jobs globally by 2021. In this decade, how will you cope in a public-private, cross-sector, cybersecurity organization?

 

Managing Maturity Security Levels

Private-sector security regulations determine business’ security-level adjustments. While public regulatory agencies mediate security, to amend information.

Both sectors should maintain state-of-the-art malware status monitoring, to span current skills gaps across government, industry and academia.

In those situations a Chief Information Security Officer (CISO) can act as a business enabler. To amplify security in the evolving situation; get to its roots.

The Roots of Cybersecurity Skills Gaps

Increasing demand for skills is outpacing supply growth 

The above sectors’ demand for skills triples IT jobs. Each sector needs more workforce practitioners; competition between public and private sectors is inadequate. Demand and supply of candidates are seldom in parallel pipeline-supply.

We’re allowing untapped pools of skilled candidates 

Available women comprise 43% of full-time labor, approximating 20% of all cybersecurity work. Ten million returning armed-forces, often pre-security-cleared, is a next robust resource. Geographic “tech hubs,” normally bachelor-degree level—as with “mid-tech” or “new collar” jobs outside traditional coastal hubs.

Complex employer requirements entail 50% unqualified applicants 

Top certifications comprise five years’ experience: engineers; scientists; developers; operators; defenders. Hybrid trades, seldom posted, work among unclear roles.  

General populations unaware of cybersecurity opportunity 

Outreach is scant due to scattered populations, while wide-open cyber career spheres await.

However…Several diversity-focused organizations and students have emerged. Like CyberSeek‘s interactive talent maps showing graphically supply and demand. You drill through private, public and other sectors’ data, across all states and metro areas:

These roots also need security fundamentals to further aid skills-gap needs.

 Mastering Cybersecurity Fundamentals

Employers see graduates lacking cybersecurity foundations—concerning specific knowledge sets and skills essential to employees.

These arenas are vital technical work roles:

·  understanding computer architecture, data, cryptography, networking, secure coding principles and operating system internals;

·  proficiency with Linux-based systems;

·  fluency in low-level programming languages;

·  know common exploitation methods and mitigation techniques;

providing shared baseline skill sets, building specific knowledge necessary to meet employer workforce necessities.

This means you’ve got to build relationships with local educators. Hire cybersecurity applicants with nontraditional backgrounds. Organizations should consider establishing internal retraining programs, to draw from existing talent pools

These platforms undergird all sectors.

 The Greatest Needs

As an emerging professional you need deep technical training, to scrutinize these four fundamental cores:

·     secure system design — developing infrastructure;

·     incident response — managing an IT aftermath;

·     tool development — implement secure configurations;

·     penetration testing — simulated cyber-attacks;

to embody an organization’s cybersecurity system.

This short-list and best-practices can link to public and private sectors, catalyzing high-skilled technical training programs. As of 2020, security education offered few programs.

Fortunately, several programs are building robust pipelines for cyber capacity. 

Productive/Successful Programs

Most-Robust Pipelines

The annual U.S. Homeland Security Cyber Challenge (USCC) fulfills its ranks seeking the best 10 thousand U.S. networks.

Its two complementary initiatives are the Cyber Quests online challenge series, and week-long Cyber Camp programs for aspiring cyber professionals.

·      NICCS Partners

The National Initiative for Cybersecurity Careers Studies, in NICCS’ NICE Framework , leads cybersecurity training and workforce development. This cybersecurity career path can be elusive; its groups and specialty areas:

·   high-level grouping of common cybersecurity functions;

·   distinct areas of cybersecurity work;

·   detailed groupings of cybersecurity work comprised of specific knowledge, skills and abilities;

and a backlog to come from audiences listed in NICCS.

The National Centers of Academic Excellence in Cybersecurity (NCAE-C) needs further cybersecurity education, to protect critical infrastructure. This workforce needs support through these essential skills.

The Workforce Framework for Cybersecurity (NICE Framework) is Cyber Operations (CAE-CO) via inter-disciplinary computer science, computer engineering, and/or electrical engineering disciplines. NICE should gather educators, employers and cybersecurity competition providers.

Major sponsors are: CIS; CISQ; MacAfee; Google; Verizon; Deloitte; Dell-Technologies; GDIT; Trustwave; Microsoft and others.

·      The National Institute of Standards and Technology (NIST)

Apprenticeships in cybersecurity for various stakeholders (government, employers, intermediaries, educational partners) to build and sustain cybersecurity:

·   apprenticeships in cybersecurity-related occupations;

·   analysis of work-enhanced learning models;

·   return on investment;

·   apprenticeship in ecosystem integration & scaling;

with more approaches to create cybersecurity professionals.

New standards emphasize instruction for computing fundamentals, engaging hands-on learning. You and colleagues can adopt or adapt programs. 

For NIST Managers 

NIST’s small-owner resources should convey the business value of strong cybersecurity. As with:

·   communicating about cybersecurity;

·   making a board-level business-case for effective guidelines in cybersecurity matters;

·   reviewing the workforce management guidebook “Cybersecurity is Everyone’s Job;”

·   the NICE working group workforce management subgroup.

NSA, DHS and the National Centers of Academic Excellence in Cyber Defense (CAE-CD) program is focusing on infrastructure vulnerability. They’re pushing standards to emphasize computing fundamentals, through a two-year education in relationships with local educators. 

NIST’s cybersecurity competition providers work towards standardizing performance measurements.

At the same time NIST is providing K-12 resources.

---

Think-Tank Perspectives

Gartner’s 2021 research on security and risk management centers on cybersecurity in organizations:

·   urgency to treat cybersecurity as a business decision;

·   while cybersecurity growth spend is slowing;

·   projecting to decline to only 7% by 2023;

this perspective tells once there was a single cybersecurity career. While now more than 900 different cyber career profiles.

Aspen’s principles propose pipelines, to expand and sustain the U.S. cybersecurity labor force. Through emerging technologies, as with the Internet of Things (IoT).

These simplified models, with transparency, can leverage the NICE Cybersecurity Workforce Framework:

·   adjacent technical professional skills for hiring and training;

·   launching apprenticeship programs to train candidate pipelines at scale;

·   maximizing your impact by partnering focus on scale;

as a major boon in training. 

IBM’s CEO Ginni Rometty sees skill-gaps through widening spaces, to extend corresponding new collars:

·   community colleges;

·   bootcamps;

·   on-the-job learning;

·   apprenticeships;

particularly in reducing four-year degrees. New diverse teams can tidy-up complex challenges. 

 Cybersecurity Training and Skills Growth

Cybersecurity Training

In large organizations, cybersecurity training typically involves a Board of Trustees to invest in cybersecurity training. Growth in 2021 is in strong demand, escalating 13% from 2016 to 2026 – roughly 600 thousand new jobs.

Current circumstances can put you in a professional or non-technical background, without a cybersecurity or computer science degree. Often virtual training online is free, as with Cybrary and CISA resources.

Pre-med, psychology, auto-mechanics, artists and stay-at-home moms are in cybersecurity. Surrounding cybersecurity skills are also needed: privacy; security awareness; training; governance; security communications; cyber law, ethics and others.

If you’re in an organization, you can put together cyber security training tips, as with AISN’s  risk management and managed services.

Cybersecurity Skills

In a small organization you may be techie or not. If not a techie, you can guesstimate steps such as: Detection and Identification; Containment; Remediation; Recovery; Assessment. Your colleagues can assess which of the five while you keep a “security first” mindset.

The ultimate skills-gap resolution is that of the global cybersecurity skills shortage. Our U.S. scope here is regional and national. The national big-picture remains an inadequate pool of skilled candidates, untapped; remaining gaps exist in the nation’s current cybersecurity education and training landscape.

Widening Cybersecurity Skills Pipelines

In 2021, over 4 million cybersecurity jobs will be unfilled globally, analysts estimate.

To tighten ongoing gaps, several ‘new collar’ roles are lengthening and widening cybersecurity pipelines:

·   require a four-year degree and/or completed high school;

·   associate’s degrees;

·   Cyber Challenge (USCC);

·  more diverse and inclusive candidates;

·  don’t require a four-year degree;

·  completed high school;

·   participants age 25+, completed high school, no college;

·   require some level of knowledge or skill;

·   73 million potential candidates able to apply to cybersecurity jobs;

Progressively, more pipelines have the opportunity to proliferate.

Here we’re seeing the tendrils of a cybersecurity workforce, attaining industrial levels.

The Future Cybersecurity Workforce

While keeping to the four fundamental cores:

·   secure system design;

·   incident response;

·   tool development;

·   penetration testing.

Automation, the next frontier in cybersecurity: “the only way to deal with cybersecurity skills shortage.” For all workflows, eliminating uncertainty at all steps “100% confidence in the tools.”

And the promise of future machine-speed security.

 

The Takeaway

·      Your Skills Gap Decade: You’ll need to cope in a public-private, cross-sector, cybersecurity organization

·      Managing Maturity Security Levels: In Private-sector security regulations, you may need a Chief Information Security Officer (CISO).

·      The Roots of Cybersecurity Skills Gaps: Increasing demand for skills is outpacing supply growth.

·      Mastering Cybersecurity Fundamentals: You’ve got to build relationships with local and regional educators.

·      The Greatest Needs: More programs are building robust pipelines.

·      Productive Programs: Via NICCS Partners and the National Institute of Standards and Technology (NIST); an early pipeline.

·      For NIST Managers: NIST’s cybersecurity competition providers work towards standardizing.

·      Think-Tank Perspectives: Gartner’s early research on security and risk management;  Aspen pushing early for pipelines; IBM urging most re: new collars.

·      Cybersecurity Training and Skills Growth: remaining gaps exist in the nation’s current cybersecurity education and training landscape.