Daniel Hooper

Should surveillance software vendors be regulated? In the wake of yet another round of surveillance vendor failure (this one lower profile than others, but in many ways far more serious), I am forced to revisit the question of whether surveillance vendors should be regulated entities. The issue comes down to one of regulatory relationships and disclosures. The unforgivable sin in surveillance is not getting something wrong. Humans will always make errors, even if control processes are in place. However, keeping you head down and not telling your stakeholders and the regulators in a clear and timely fashion is a far graver breach. Regulated entities have an overriding responsibility to keep their regulators informed of anything whether the regulator would expect to be told (wording varies from region to region, but the thrust of the duty remains). Software vendors, however, lack this duty. They are not compelled in the same way to be transparent, to disclose gaps, to engage with their customers and to support the customers in their duties to the regulators. Therefore, although all financial institutions find themselves dependent on software vendors to discharge their regulatory obligations, those vendors in turn, through their unregulated status, may take a different view of the required levels of transparency. On the other hand - regulators are overworked, under-resourced, and already bear responsibility for myriad entities. Would adding yet more to their plate really be the best use of their time? Software vendors already have to maintain acres of certifications, would requiring regulatory certification across the dozens of jurisdictions their products cover really add any value? Would the cost of doing so lead vendors to withdraw their products from certain jurisdictions, thus weakening competition and the overall surveillance environment? In the end, would compliance be nothing more than self-certification and the damocles sword of fines hanging over their heads? I haven't got a good answer to this. But I do know that surveillance software vendors are a genuinely critical part of our ecosystem, and we need to ensure that they meet the high standards we set for our own internal teams. #software #regulation #surveillance #compliance #fines

40

4 Comments

Your security contractor says compliance is at 98%. Your actual audit results tell a different story. I've observed this pattern repeatedly: organizations rely on vendor self-reporting for security performance metrics, only to discover significant gaps during independent assessments. The challenge isn't dishonesty - it's perspective. Contractors naturally view their performance through the lens of effort and intent. But compliance requires measurable outcomes aligned with your specific risk tolerance and contractual obligations. Independent oversight creates accountability without vendor conflict. It validates that your security investments deliver the protection you're paying for, not just the protection they think you need. When performance visibility becomes vendor-neutral, compliance becomes measurable. GreyShield Group provides intelligence-driven oversight that ensures contractual alignment. Contact us at intelligence@greyshieldgroup.com #VendorOversight #ThirdPartyRisk #SecurityOperations #ContractCompliance

3

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

Fraud is engineered. Your controls should be too. This week’s GRC Tip: "Fraud exploits trust gaps. Build controls to detect manipulation, not just mistakes." 🔷 Need to upgrade your fraud, waste or abuse defences from passive to proactive? Let’s talk. #Fraud #GRC #Audit #TuesdayTip

1

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

I have seen firms depend heavily on vendor promises without ever asking for proof. That’s a dangerous degree of trust. Regulators expect written documentation and monitored compliance. At itSynergy, we help RIAs enforce the 72-hour notification requirement. #VendorRisk #RegSP #RIACompliance

3

I’ve been having many conversations about SBOMs vs component inventories. Requirements affecting the financial sector, notably PCI-DSS and DORA, mandate an “inventory of.. 3rd party software components” (PCI) or the capability to “track the usage of… third party libraries.” (DORA). So what’s the difference? The simple way to think about it as that all *good* SBOMs are inventories or component lists, but not all component lists are SBOMs. Section 10(j) of EO 14028 defines an SBOM as a “formal record containing the details and supply chain relationships of various components used in building software.” This means that an SBOM should capture some details about the dependency structure, and it must be represented in a way that supports automation. Functionally? It’s a graph, and it’s in a widely used, machine-readable format (CycloneDX or SPDX). SBOMs are structured to support trust, provenance, and action. The trust derives from the generation process—something that’s explicitly captured in the draft CISA Minimum Elements. Being able to trace provenance can derive from a number of features, including producing a hash of the original software code, if the SBOM generator had access to it. Alternatively, an SBOM generation tool can offer real evidence that observed bits in a binary correlate to the component building blocks. Most importantly, an SBOM is designed to be used, not just as a static inventory. When properly assembled and maintained, it can feed directly into vulnerability management, incident response, license tracking, and a host of other risk management tools, as well as overall metrics on software freshness and quality. It goes beyond “what do I have” and helps answer “what am I exposed to”? By explicitly being defined as a dynamic feature (“if you update your code, update your SBOM”), SBOMs are inherently temporal, tracking specific releases and often lifecycle phases. This is why that can be so powerful for things like incident response and forensic risk management. We are also in a world where quality SBOM tools exist. SBOM tools can always produce inventories, but not vice versa. Every SBOM generator has to be a very good inventory tool. But most inventory tools aren’t prepared to make the security, provenance, and legal claims that SBOMs require. Later this week, I’ll do a deeper dive into what we’re seeing around the CRA draft around vulnerability handling, and the language around the identification of software components vs. SBOMs.

96

5 Comments

Stop calling it "Compliance-as-a-Service." 👇 Because it creates this compounding problem for your vCISO program. You immediately attract the wrong clients... And repel the right ones. When you lead with “compliance,” you disqualify a huge chunk of your total addressable market (in their own mind). They say "oh I don't need that." So they don’t raise their hand. Even though what they actually need is strategic risk leadership. And yes, compliance is a sub-function of that... But it’s not the whole play. Lead with compliance, and you end up with one of two paths: 1. Three meetings. Confused buyer. Ghosted. ("Wait - we have to do something too?") 2. They sign anyway... And turn delivery into a disaster. ("We're paying you for this; handle it.") Either way, you lose. Here’s the fix: ✅ Position this as a business function ✅ Qualify for alignment, and not just need ✅ Show how it ties to revenue, resilience, and reputation In the PowerGRYD, we teach consultants how to reposition this service and stop selling vCISO like a compliance checklist. That’s how you find premium clients who get it. If you’re done getting ghosted and want to scale your vCISO program with clients who actually show up... Drop me a DM with “Teamwork” and I’ll show you how we build it inside the GRYD. Or head here next: https://lnkd.in/gaJ7Chm2

41

19 Comments

⚠️ DraftKings says recent targeted account intrusions weren’t caused by an internal breach — but by credential reuse: attackers reused passwords from other leaks to get in. Read now: https://lnkd.in/g2wKxQTK #CyberSecurity #CredentialReuse #InfoSec

1

When every component of PCI is managed in isolation, it becomes harder to scale security with the business. Most organizations rely on a fragmented approach to PCI DSS: 1. A GRC or homegrown system for tracking controls 2. A certified QSAC for the audit 3. An ASV for external vulnerability scans 4. A separate firm for PCI Level 1 penetration testing This model creates handoffs, complexity, and risk—slowing down teams and inflating costs, just as compliance expectations continue to rise. At Thoropass, we believe there’s a better way. We’re proud to announce that Thoropass is now a certified PCI Approved Scanning Vendor (ASV)—joining fewer than 100 organizations globally with this designation. This means you can now manage the full scope of PCI—from audit to scanning to pen testing—through a single, integrated platform: ✅ PCI ASV scans ✅ PCI audits via our in-house QSAC ✅ PCI Level 1 penetration testing ✅ Continuous compliance automation One partner. One platform. End-to-end visibility. No vendor sprawl. No manual exports. No fire drills. Just a trusted partner helping you reduce risk, accelerate outcomes, and align security with growth. Because strong security programs aren’t built in silos. They’re built through integration, accountability, and execution. Huge credit to the Thoropass team for pushing through a 4,348-page submission to make this possible—unlocking another level of value for our customers!

88

3 Comments

ℹ️ Most boards approve technology budgets. Few boards understand what they approve. That’s not a criticism. It’s a structural issue that has existed for years. But with technology accelerating fast, it has become a real risk. and a potential liability. Boards approve technology budgets, AI strategies, and cybersecurity frameworks. But approval without understanding is not governance. It is hope dressed up as oversight. ℹ️ A board does not need to write code. But it must be able to challenge the risk model. ⚠️ If you cannot challenge the risk model, you cannot govern it. Research continues to highlight a capability gap at board level in cyber oversight. Now add AI. Many boards approve AI deployments without being able to assess risk, bias, controls, and liability in business terms. What I see repeatedly in boardrooms: 🔹One “tech-savvy” director carries the entire technology and AI agenda alone. That is not oversight. 🔹AI, cybersecurity, data governance, and data protection are treated as separate topics. They are not. An AI system is only as secure as the data, access, and controls behind it. 🔹Risk is approved without being understood. Regulation is raising the bar (e.g., NIS2, the EU AI Act, FINMA expectations). Technology governance is becoming more explicit — and the downside is real. 💡 Here is what concerns me most: At board events, many board member and executives agree this gap exists. Back at the office, not much changes. The reasons are familiar: “other priorities”, “we are too small”, “it takes too much time”, “it’s too expensive”. 👉 In the short term, that can work, with a bit of luck. In the long term, it becomes governance debt. And governance debt always comes due. ❓ What is your experience; does your board have genuine technology oversight, or is it performed oversight? ✴️ I help and support organisations and boards in building effective technology governance, so cyber and AI risk is translated into decisions the board can actually understand, challenge, and own. #BoardGovernance #TechnologyGovernance #CyberRisk #AIGovernance #RiskManagement #DataGovernance

7

PCI DSS has a fundamental design flaw. Enforcement is outsourced to acquiring banks, who have every commercial reason not to irritate their merchant customers. They don’t want to build or fund large teams of PCI specialists capable of accurately assessing the compliance of millions of merchants, so they push the burden downstream. Merchants are told to self‑assess, which means the people least equipped to understand PCI DSS end up determining their own compliance status. The results are predictable. The downstream ecosystem has repeatedly shown it cannot be trusted to secure cardholder data. If an ecosystem consistently fails to meet the minimum bar, the logical conclusion is that it shouldn’t be allowed anywhere near sensitive payment data in the first place. What makes this even more absurd is that banks absolutely could design a tamper‑proof, foolproof, merchant‑proof payment system. The technology exists. The cryptography exists. The outsourcing options exist. What doesn’t exist is the incentive. The current model is profitable and low‑liability. Fraud losses, compliance costs, breach penalties and operational burdens are all pushed onto merchants. A truly secure system would flip that responsibility back onto the banks and card brands, but they have no interest in owning that liability. On top of that, a foolproof system would wipe out the entire PCI compliance industry, which has become a revenue stream in its own right. So we’re left with a system built on 1970s architecture, protected by a standard that relies on self‑attestation, enforced by organisations with no incentive to enforce it, and surrounded by an ecosystem that has proven it cannot secure the data it handles. If the industry genuinely wants secure payments, it needs to stop pretending PCI DSS is a security standard and start treating it for what it is: a liability‑shifting mechanism. Real security will only arrive when the organisations with the power to fix the system are also the ones who bear the consequences when it fails. #payments #security #pcidss #compliance #fintech #cybersecurity #riskmanagement #dataprotection #infosec #governance #standards #paymentsindustry #merchantservices #regulation #technology

21

15 Comments

Compliance is calling. Can you prove who had access 9 months ago? Most IAMs can't. Imagine an auditor asks for access logs from nine months ago for financial systems. If that request sends a chill down your spine because your IAM only retains 90 days of logs, you're not alone. Compliance is no longer just about current access; it's about verifiable historical data. 1️⃣ Beyond 90 Days: Regulations like SOX (7 years), HIPAA (6 years), and GDPR (flexible, but indefinite) demand far longer retention than typical IAM log policies. 2️⃣ Granularity is Key: Basic snapshots miss critical changes between intervals, leaving gaps in your audit trail when precise point-in-time data is needed. 3️⃣ Forensic Gaps: Without the ability to compare historical states or investigate changes over time, proving compliance and conducting thorough incident response becomes nearly impossible. Acsense's unique database-driven architecture captures every change to your identity environment, enabling precise point-in-time recovery and tenant investigation. This "Time Machine" capability allows you to prove who had access when, satisfying stringent regulatory demands and simplifying audits. Learn how to future-proof your IAM for rigorous compliance and investigation needs. Identity Data Retention for Compliance | Acsense https://lnkd.in/dzVe5k4X How confident are you in providing auditors with a precise historical view of your IAM access? Share your thoughts. ⬇️ #Acsense#Compliance #IAM #DataRetention #Cybersecurity

1