pro

Brazil Data Protection Law – Litigation in the Context of Employment

  • Employers operating in Brazil will likely see an uptick in litigation involving claims filed under the country’s Data Protection Law (LGPD).
  • The Brazilian National Data Protection Agency, the entity charged with enforcing the LGPD, recently issued new guidance on this law.

The Brazilian Data Protection Law (LGPD) in effect since 2020 is starting to show its effects in the litigation landscape.




pro

Developing a Global Data Protection Framework for Artificial Intelligence in the Workplace

  • Despite the broad range of artificial intelligence technologies and the flurry of new laws regulating them, virtually all laws regulating how these technologies process data follow the same basic framework.
  • This means employers can follow a relatively straightforward checklist around the world to work through the major data protection issues.
  • This Insight walks through the checklist and identifies significant variations between regions and countries.




pro

Proposed BIPA Penalty Reforms Advance In Ill. Legislature

Shannon Meade talks about how the Biometric Information Privacy Act (BIPA) has affected employers in Illinois and how SB 2979 would update it and tweak its liability guidelines.

Law360

View (Subscription required.) 




pro

A Comprehensive Global Guide for AI Data Protection in the Workplace

Zoe Argento, Kwabena Appenteng, Alyssa Daniels, Philip Gordon, Rajko Herrmann, Soowon Hong, Renata Neeser, Naomi Seddon, Christina Stogov and Grace Yang share a comprehensive guide for how employers can ensure data protection as they implement artificial intelligence.

Corporate Compliance Insights

View




pro

BIPA reform is ‘huge step in the right direction,’ proponents say

Orly M. Henry calls a law to amend language addressing claim accrual in BIPA litigation long overdue and “a huge step in the right direction.”

Chicago Daily Law Bulletin

View (Subscription required.)




pro

New Colorado Law Protects Consumer Biological and Neural Data

Zoe Argento talks about the new compliance requirements for employers under Colorado’s biometric privacy law.

Law Week Colorado

View (Subscription required)




pro

Labor Department’s Pro-Worker Push Imperiled in Trump’s Return

Jim Paretti says many Biden-era wage and hour and other policies are likely not long for this world under the Trump administration.

Bloomberg Law

View (Subscription required)




pro

ETSI Intelligent Transport Systems workshop outlines global projects

ETSI Intelligent Transport Systems workshop outlines global projects

Sophia Antipolis, 8 March 2019

The annual ETSI Intelligent Transport Systems (ITS) workshop ended after 2 days of intensive discussions and networking opportunities between industry, the European Commission and stakeholders involved in Cooperative ITS deployment (C-ITS) worldwide.

Read More...




pro

ETSI offers a Novel Approach to Standards Education

ETSI offers a Novel Approach to Standards Education

Sophia Antipolis, 25 March 2019

ETSI has released a new set of classroom teaching materials on ICT standardization. A comprehensive textbook, “Understanding ICT Standardization: Principles and Practice”, together with an extensive slide pack have been developed with the support of the European Commission and the EFTA Secretariat.

Read More...




pro

ETSI releases standard for cyber digital evidence bag to confirm integrity of data in legal proceedings

ETSI releases standard for cyber digital evidence bag to confirm integrity of data in legal proceedings

Sophia Antipolis, 21 April 2020

The ETSI Technical Committee CYBER has recently released a key standard for digital evidence bag (DEB). ETSI TS 103 643 covers “techniques for assurance of digital material used in legal proceedings” and provides a set of extra tools for those wanting to demonstrate the integrity of digital evidence.

Read More...




pro

ETSI launches remote Plugtests Programme for Mission Critical Services to accelerate adoption and interoperability

ETSI launches remote PlugtestsTM Programme for Mission Critical Services to accelerate adoption and interoperability

Sophia Antipolis, 28 April 2020

To accelerate Mission Critical Services (MCS) adoption and interoperability, a key enabler to MCS deployment, ETSI is running an innovative MCX PlugtestsTM Programme. Testing sessions will also benefit from the latest ETSI specification, ETSI TS 103 564, on Plugtests scenarios for Mission Critical Services.

Read More...




pro

New ETSI group to develop standardization framework for secure smartphone-based proximity tracing systems, helping to break COVID-19 transmission chains

New ETSI group to develop standardization framework for secure smartphone-based proximity tracing systems, helping to break COVID-19 transmission chains

Sophia Antipolis, 12 May 2020

In response to the global coronavirus pandemic, the new ETSI Industry Specification Group “Europe for Privacy-Preserving Pandemic Protection” (ISG E4P) has been established to provide a standardization framework that will enable developers to build interoperable mobile apps for proximity detection and anonymous identification.

Read More...




pro

ETSI’s new group on COVID-19 tracing apps interoperability moving fast: officials elected and work programme set up

ETSI’s new group on COVID-19 tracing apps interoperability moving fast: officials elected and work programme set up

Sophia Antipolis, 11 June 2020

The ETSI E4P group, “Europe for Privacy-Preserving Pandemic Protection”, launched a month ago has already held two meetings. The work of ISG E4P aims to facilitate the development of backward-compatible and interoperable proximity tracing applications to be used to combat pandemics by helping to break viral transmission chains.

Read More...




pro

ETSI publishes new work programme, keeping up the pace of ongoing activities

ETSI publishes new work programme, keeping up the pace of ongoing activities

Sophia Antipolis, 22 June 2020

ETSI is pleased to release its 2020-2021 work programme.

In ETSI we are constantly exploring new ways to make the development of standards faster and more efficient. Our FORGE platform, for example, gives developers free access to open-source code produced by our members. And as we have already seen this year, the need for effective virtual collaboration between individuals and teams has never been keener.

Read More...




pro

World Standards Day 2020: STANDARDS ARE ESSENTIAL TO PROTECT THE PLANET

World Standards Day 2020: STANDARDS ARE ESSENTIAL TO PROTECT THE PLANET

On 14 October 2020, CEN, CENELEC and ETSI, the three official European Standardization Organizations, join the international standardization community in celebrating World Standards Day. By focusing on the environment, this year’s edition aims to raise awareness on the potential of standards to help tackle the climate crisis.

Read More...




pro

ETSI releases Middlebox Security Protocols framework specification

ETSI releases Middlebox Security Protocols framework specification

Sophia Antipolis, 17 December 2020

ETSI is pleased to announce a new specification, ETSI TS 103 523-1: Part 1 of the Middlebox Security Protocol (MSP) series, which defines the security properties of a Middlebox Security Protocol.

Read More...




pro

ETSI releases Middlebox Security Protocols specification for fine-grained access control

ETSI releases Middlebox Security Protocols specification for fine-grained access control

Sophia Antipolis, 2 March 2021

ETSI is pleased to announce a new specification, ETSI TS 103 523-2: Transport Layer MSP (TLMSP), Part 2 of the Middlebox Security Protocol (MSP) series, which defines a protocol for varied (fine-grained) access control to communications traffic. This specification was developed by the ETSI Technical Committee CYBER.

Read More...




pro

ETSI publishes new Work Programme

ETSI publishes new Work Programme

Sophia Antipolis, 9 June 2021

ETSI is pleased to release its 2021-2022 Work Programme.

Read More...




pro

ETSI releases the first Group Report on Encrypted Traffic Integration, protecting end users from malicious attacks

ETSI releases the first Group Report on Encrypted Traffic Integration, protecting end users from malicious attacks

Sophia Antipolis, 1 September 2021

ETSI’s Industry Specification Group on Encrypted Traffic Integration (ISG ETI) has concluded the early part of its work, by identifying problems arising from pervasive encrypted traffic in communications networks.

Read More...




pro

World’s first non-cellular 5G technology, ETSI DECT-2020, gets ITU-R approval, setting example of new era connectivity

World’s first non-cellular 5G technology, ETSI DECT-2020, gets ITU-R approval, setting example of new era connectivity

Sophia Antipolis, 19 October 2021

ETSI DECT-2020 NR, the world’s first non-cellular 5G technology standard, has been recognized by the WP5D of the International Telecommunication Union’s Radiocommunication Sector (ITU-R) and included as part of the 5G standards in IMT-2020 technology recommendation. Dr. Günter Kleindl, Chair of the ETSI Technical Committee DECT, says: “With our traditional DECT standard we already received IMT-2000 approval by ITU-R twenty-one years ago, but the requirements for 5G were so much higher, that we had to develop a completely new, but compatible, radio standard.” Released last year, the standard sets an example of future connectivity: the infrastructure-less and autonomous, decentralized technology is designed for massive IoT networks for enterprises. It has no single points of failure and is accessible to anyone, costing only a fraction of the cellular networks both in dollars and in carbon footprint.

Read More...




pro

ETSI launches new education programme for the next generation of ICT standards professionals

ETSI launches new education programme for the next generation of ICT standards professionals

Sophia Antipolis, 8 February 2022

ICT standardization plays an important role for interoperability and innovation and its practice remains a topic that is not easily accessible. To try to remedy this situation and prepare the next generation of standards professionals, ETSI has developed comprehensive teaching materials on education about ICT standardization. With this programme ETSI leads ICT standardization education, bringing the expertise of its global membership from various sectors.

Read More...




pro

ETSI releases its Annual Report and Work Programme 2022-2023

ETSI releases its Annual Report and Work Programme 2022-2023

Sophia Antipolis, 20 April 2022

ETSI has just released its two activity documents, the Annual Report that looks back on 2021 achievements and the forward looking 2022-2023 Work Programme.

Read More...




pro

ENISA and ETSI joint workshop tackles challenges for European identity proofing

ENISA and ETSI joint workshop tackles challenges for European identity proofing

Sophia Antipolis, 3 May 2022

Today ENISA (the European Union Agency for Cybersecurity) and ETSI organized a workshop as part of their joint effort and collaboration to support EU requirements for identity proofing. The event was mainly addressed at EU companies and other public or academic organizations that run or prepare to launch their remote ID solution.

Read More...




pro

ETSI provides lectures to the University of Luxembourg on standardization for their Master’s course

ETSI provides lectures to the University of Luxembourg on standardization for their Master’s course

Sophia Antipolis, 1 June 2022

Continuing our role in encouraging the new generation of standards people, ETSI has recently provided online lectures to the University of Luxembourg. A series of 6 presentations for students following the MTECH Master degree project "Technopreneurship: mastering smart ICT, standardization and digital trust for enabling next generation of ICT solutions". The first post-graduates from this course will receive their degrees at the end of 2022.

Read More...




pro

ITU, UN Environment Programme and ETSI celebrate the EU Green Week

ITU, UN Environment Programme and ETSI celebrate the EU Green Week

Sophia Antipolis, 8 June 2022

On 1 June 2022, during the EU Green Week, ITU in collaboration with UN Environment Programme and ETSI organized a Workshop on “Global Digital ICT Product Passport to achieve a Circular Economy”. Luis Jorge Romero, ETSI Director-General and Malcolm Johnson​, Deputy Secretary General, ITU gave the opening remarks.

Read More...




pro

ETSI welcomes the strengthened role for NSOs in the decision-making process of European standards

ETSI welcomes the strengthened role for NSOs in the decision-making process of European standards

Sophia Antipolis, 19 October 2022

The EU member states' ambassadors today endorsed the final compromise text of the Amendment to regulation 1025/2012 with regard to the decisions of European standardization organizations concerning European standards and European standardization deliverables.

Read More...




pro

ETSI workshop: improving Quality of Emerging Services for Speech and Audio

ETSI workshop: improving Quality of Emerging Services for Speech and Audio

Sophia Antipolis, 23 November 2022

The ETSI STQ (Speech and multimedia Transmission Quality) Workshop that took place on 21-22 November 2022 in Bratislava (Slovakia) was hosted by Amazon. It focused on a user-centred perspective of the Quality of Emerging Services for Speech and Audio.

The event was attended by organizations providing a rich mix of inputs and perspectives from industry, regulators, and academia. Through presentations, discussions and professional networking, this STQ Workshop demonstrated a very high level of engagement by all participants, with stimulating interaction among all speakers and the audience.

Read More...




pro

New ETSI Telemetry Standard Improves Automation for better End-User Quality of Experience

New ETSI Telemetry Standard Improves Automation for better End-User Quality of Experience

Sophia Antipolis, 28 November 2022

As the scale and services offered through the Optical Access Networks increase, it is crucial to maintain network good operation and performance. To achieve this, the Optical Access Network monitoring can be improved when compared to existing traditional methods via automated real-time data collection. Telemetry enables this and transmits data from the optical line terminal (OLT) - i.e., the device at the endpoint of a passive optical network - in real-time to provide information to the data collection platform.

Read More...




pro

ETSI releases World First Protection Profile for Quantum Key Distribution

Sophia Antipolis, 27 April 2023

ETSI has just released a Protection Profile (PP) for the security evaluation of quantum key distribution (QKD) modules, ETSI GS QKD 016. This Protection Profile is a first and anticipates the need for quantum safe cryptography. The ETSI specification will help manufacturers to submit pairs of QKD modules for evaluation under a security certification process.

Read More...




pro

ETSI Open Source MANO announces Release FOURTEEN providing a new scalable architecture for service assurance

Sophia Antipolis, 26 July 2023

The ETSI Open Source MANO community is proud to announce OSM Release FOURTEEN. Release FOURTEEN is a Long-Term-Support (LTS) release of ETSI OSM, providing two years of continuous support with bug fixes and security patches, and including significant improvements in many key areas.

Read More...




pro

ETSI releases standard for IT solution providers to comply with EU regulation on electronic signatures in email messages

Sophia Antipolis, 20 September 2023

ETSI has published a new standard on “Requirements for trust service providers issuing publicly trusted S/MIME certificates” (ETSI TS 119 411-6 ) helping Trust Service Providers comply with new standards for S/MIME certificates that are enforced since 1 September 2023. Secure MIME (S/MIME) certificates are used to sign, verify, encrypt, and decrypt email messages. 

Read More...




pro

ETSI Signs Pledge to Future Standardization Professionals

Sophia Antipolis, 30 November 2023

ETSI proudly announces its commitment to fostering the education and skills development of the next generation of European standardization professionals. This initiative is part of a voluntary pledge which ETSI’s Director-General Luis Jorge Romero signed today in Brussels in the presence of the Commissioner for Internal Market of the European Union, Thierry Breton. It was launched by the European Commission’s High-Level Forum on European Standardization, specifically under the workstream on Education and Skills.

Read More...




pro

ETSI Protection Profile for securing smartphones gains world-first certification from French Cybersecurity Agency

Sophia Antipolis, 12 January 2024

In a significant step highlighting the critical importance of security for mobile device users, the French National Cybersecurity Agency (ANSSI) has certified ETSI's Consumer Mobile Device Protection Profile under the Common Criteria global certification framework. This represents the first certification by a national administration of a comprehensive suite of specifications for assessing the security of smartphones.

Read More...




pro

TeraFlowSDN Release 3 Provides a Cloud-based Network Automation Platform Featuring New Optical SDN Controller and Expanded Support for Disaggregated Networks

Sophia Antipolis, 30 April 2024

The ETSI TeraFlowSDN community is proud to announce the third release of TeraFlowSDN, an innovative and robust SDN orchestrator and controller, delivering a fully featured Network Automation Platform. In this latest release, TeraFlowSDN enhances its capabilities with the integration of an Optical SDN controller, expanding device support to include gNMI and OpenConfig protocols. It also features enriched network integrations for end-to-end orchestration like IP over DWDM, L3VPN, MEC, and network topology exposure. The management of network topologies is improved with the addition of a new BGP-LS speaker able to discover the topologies, and a new Forecaster component is introduced, providing predictive insights for network management. These additions substantially augment the versatility and management capabilities of the TeraFlowSDN platform.

Read More...




pro

Are we doing it right? Promoting the human rights of children with disabilities

Starts: Thu, 28 Nov 2024 18:30:00 -0500
11/28/2024 05:30:00PM
Location: Montreal, Canada




pro

Vancouver: Professional Networking

Starts: Thu, 12 Dec 2024 09:30:00 -0500
12/12/2024 08:00:00AM
Location: Vancouver, Canada




pro

African American Protest Poetry

New essay by Trudier Harris, "African American Protest Poetry," added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center.




pro

Racial Uplift Ideology in the Era of the Negro Problem

New essay by Kevin K. Gaines, "Racial Uplift Ideology in the Era of the Negro Problem," added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center.




pro

Summary of Comments to CSA/CIRO Staff Notice 23-331 Request for Feedback on December 2022 SEC Market Structure Proposals and Potential Impact on Canadian Capital Markets

This document is only available in PDF format.




pro

Notice of Ministerial Approval of Amendments to OSC Rule 91-507 Trade Repositories and Derivatives Data Reporting and Consequential Amendments to OSC Rule 13-502 Fees

The Minister of Finance has approved amendments to Ontario Securities Commission (OSC) Rule 91-507 Trade Repositories and Derivatives Data Reporting and consequential amendments to OSC Rule 13-502 Fees (collectively, the Amendments) pursuant to




pro

OSC Staff Notice 81-736 - Summary Report for Investment Fund and Structured Product Issuers

This document is only available in PDF format.




pro

CSA Staff Notice 51-365 Continuous Disclosure Review Program Activities for the Fiscal Years Ended March 31, 2024 and March 31, 2023

This document is only available in PDF format.




pro

Proposal Coordinator

Job Summary: The Director General’s Office (DGO) of the International Food Policy Research Institute (IFPRI) seeks a highly motivated Proposal Coordinator   to join its team. The ideal candidate will be innovative, self-motivated and goal-oriented, with experience creating and executing fundraising strategies and developing successful proposals to secure restricted and unrestricted funding from foundations and government and multilateral agencies.  The incumbent will be responsible for supporting senior staff and research leads with strategic resource mobilization, proposal development, and coordination efforts across the institute. This locally recruited position is a one year, renewable appointment and is located at IFPRI’s headquarters in Washington, DC.    Essential Duties: Specific duties include but are not limited to: Fundraising Assist in advising staff on the development and implementation of fundraising strategies Perform competitive intelligence gathering through research and analytics to identify new donors and funding prospects, including private industry, foundations, high-net worth individuals, multilateral agencies, and government Advise staff on strategies for approaching donor prospects and draft outreach & communication materials Manage cultivation and stewardship for select foundations and individual donors   Proposal Development & Coordination Proactively liaise with research units and corporate services to facilitate proposal development efforts, streamline the process, strengthen the output, and track progress and staff input throughout the proposal process Work closely with and support research units from project concept to full proposal development, incorporating input from multi-disciplinary staff Provide high quality review for key proposals to ensure output complies with proposal requirements, and facilitate professional service support (grant writer, editor, etc.), in collaboration with research units and finance Continually assess and propose improvements for practices/procedures/systems involving IFPRI’s proposal pipeline and funder/funding intelligence Other duties: Assist with partnership-related activities and event coordination as needed.     Required Qualifications: Bachelor’s degree plus 10 years of relevant work experience or master’s degree or equivalent certification plus 8 years of experience, preferably 4 years of experience in a business development team supporting international development clients, including USAID and US government contracting. At least 2 years of management experience. Experience developing and/or implementing fundraising strategies for nonprofit organizations, including prospect research; outreach to funding sources; and donor cultivation and stewardship Experience developing successful proposals/grants targeting various funding sources (government, private industry, foundation and individuals), preferably in agriculture, nutrition and/or relevant fields Highly effective and versatile communication skills—both written and oral. Ability to effectively synthesize scientific/programmatic content for multiple audiences High level of professionalism, including the ability to diplomatically coordinate individuals with various disciplines to accomplish common objections Self-motivated, with proven ability to work independently and multi-task to accomplish key goals and complete projects Strong analytical skills Comfortable in a global team, including working well with team members and collaborators located in multiple time zones and countries Willingness and ability to travel as needed   Preferred Qualifications: Master’s degree Proficiency in a second language of the U.N. system International experience, especially in Africa, Asia and Latin America Working knowledge of Microsoft Office and donor databases Background, or interest in, international development   Physical Demand & Work environment: Employee will sit in an upright position for a long period of time Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading   Salary Range: The expected salary range for this job requisition is between $85,600- $104,900. In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




pro

SpotOn London 2013 – draft programme: Tools track

This year, Digital Science are sponsoring the Tools track and we’re grateful to them for




pro

How does agricultural productivity growth affect agrifood system transformation goals?




pro

How To Protect Your Cloud Environments and Prevent Data Breaches

As organizations create and store more data in the cloud, security teams must ensure the data is protected from cyberthreats. Learn more about what causes data breaches and about the best practices you can adopt to secure data stored in the cloud.

With the explosion of data being generated and stored in the cloud, hackers are creating new and innovative attack techniques to gain access to cloud environments and steal data. A review of recent major data breaches shows us that data thieves are using social engineering, hunting for exposed credentials, looking for unpatched vulnerabilities and misconfigurations and employing other sophisticated techniques to breach cloud environments.

A look at recent cloud data-breach trends

Here are some takeaways from major data breaches that have occurred this year:

  • Managing the risk from your third-parties – partners, service providers, vendors – has always been critical. It’s even more so when these trusted organizations have access to your cloud environment and cloud data. You must make sure that your third-parties are using proper cloud-security protections to safeguard their access to your cloud data and to your cloud environment.
  • Secure your identities. We’ve seen major data breaches this year tracked down to simple missteps like failing to protect highly-privileged admin accounts and services with multi-factor authentication (MFA). 
  • Adopt best practices to prevent ransomware attacks, and to mitigate them if you get hit by one. Ransomware gangs know that a surefire way to pressure victims into paying ransoms is to hijack their systems and threaten to expose their sensitive data. 

So, how can you strengthen your data security posture against these types of attacks?

  1. Implement a "zero trust" security framework that requires all users, whether inside or outside the organization, to be authenticated, authorized and continuously validated before being granted or maintaining access to data. This framework should allow only time-limited access and be based on the principle of least privilege, which limits access and usage to the minimum amount of data required to perform the job.
  2. Use a cloud data security posture management (DSPM) solution to enforce the security framework through continuous monitoring, automation, prioritization and visibility. DSPM solutions can help organizations identify and prioritize data security risks based on their severity, allowing them to focus their resources on the most critical issues.
  3. Regularly conduct risk assessments to detect and remediate security risks before they can be exploited by hackers. This can help prevent data breaches and minimize the impact of any security incidents that do occur.
  4. Train employees on security best practices, including how to create strong passwords, how to identify risks and how to report suspicious activity.

By following these recommendations, organizations can significantly reduce their risk of a data breach and improve handling sensitive data belonging to their organization. As more and more data moves to the cloud and hackers become more sophisticated, it's essential to prioritize security and take proactive measures to protect against data risks. 

Learn more




pro

FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure

The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.

Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.

While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:

The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resource

The FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.

Tenable offers fastest, broadest coverage of CISA’s KEV catalog

At Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.

Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.

FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measure

The FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.

How Tenable’s library of compliance audits can help with Enhanced Logging

Tenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.

FY 2024 NOFO continues to require applicants to address program objectives in their applications

As with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:

  • Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
  • Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
  • Objective 3: Implement security protections commensurate with risk.
  • Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

How Tenable can help agencies meet Objective 2 of the program

Tenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).

Sub-objectiveHow Tenable helps
2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities
2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.

Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.

Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.

Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.

2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.

Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:

  • Services
  • User-agents
  • Application traffic
2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.

Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.

This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. 

Source: Tenable, October 2024

Tenable One deployment options offer flexibility for SLT agencies

Tenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

  • Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
  • Multi-entity projects
  • Decentralized deployments of Tenable One managed by individual municipalities,
  • Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

Whole-of-state approach enables state-wide collaboration and cooperation

A “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practices

As in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.

How Tenable One can help agencies meet the CISA CPGs

The CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.

Learn more




pro

Social Media for Science Outreach – A Case Study: The Beagle Project, Galapagos Live & ISS Wave

Selected responses categorized into 'helped', 'helped and harmed' and 'harmed'.




pro

Social Media for Science Outreach – A Case Study: National Science Foundation-funded IGERT project team

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




pro

OSC consults on improving retail investor access to long-term asset investments

TORONTO – The Ontario Securities Commission (OSC) today