Nabil Adam, Ph.D.

Similar to CMMC for the DoD’s Defense Industrial Base, the proposed changes to HIPAA’s Security Rule by HHS align with NIST’s security standards. At the core of both frameworks, there is a requirement to define which systems are in scope using an asset list for HIPAA and a CUI boundary diagram for CMMC. Another key aspect is the definition and documentation of controlled data flows. Most Covered Entities and Business Associates will likely require assistance to comply with these new security standards. Abacode is uniquely positioned to support healthcare industry compliance efforts with the HIPAA Security Rule. Contact us, we are here to help. #Abacode #HIPAA #SecurityRule #CoveredEntities #BusinessAssociates  https://lnkd.in/e4ujukSu

8

More on the responsibilities of AISI in the NSM (https://lnkd.in/e8TyFFfP): Coordinating with other agencies on classified evaluations: AISI will coordinate with other agencies to provide classified sector-specific evaluations of AI systems for cyber, nuclear, and radiological risks. Developing a roadmap for classified evaluations of chemical and biological threats: Within 210 days, AISI, in coordination with DOE and DHS, [..] Heavy emphasis throughout NSM on chemical and biological threats. DoD not mentioned here. Incorporating AISI guidance into agency practices: Agencies developing dual-use foundation AI models trained on biological or chemical data will incorporate AISI's biological and chemical safety guidance into their practices. I wonder what this means for academia. We develop such models (yours included) rapidly, with publication deadlines in mind. Developing best practices for publishing computational biological and chemical models: Within 180 days, AISI, in collaboration with NSF and other agencies, will convene academic research institutions and publishers to develop voluntary best practices and standards for publishing computational biological and chemical models, including those utilizing AI.10. So, the incentive will be community-enforced. I can imagine that this will change grant proposals, as well. I would not be surprised to see a new form added, where the investigators have to respond to how they will adhere to the vest practices and standards.

3

This is part of a critical effort by  the  U.S. Department of Commerce to understand the data landscape and to prepare for the future. Our thinking about public data standards needs to shift to accommodate the current and anticipated capabilities of AI systems. While LLMs can make better use of unstructured data than earlier generations of software, they also have limitations on input size and output reliability that need to be taken into account. If you have opinions on these issues, comment below-- but even more important submit them to the RFI!

12

4 Comments

NIST: USG take immediate actions including: 1) increasing pre-standardization R&D and standards participation efforts; 2) tracking and evaluating current Critical and Emerging Technology (CET) standards education grants and programs to enhance U.S. stakeholder participation in international standards activities; and 3) monitoring current technology cooperation agreements with other governments, as well as international mechanisms for standards-related communication and cooperation.

18

Organizations must start preparing for a Post Quantum Computing era..

3

Healthcare industry groups are urging the federal government to streamline and loosen a recent proposed rule outlining #cybersecurity incident reporting requirements for entities considered to be critical infrastructure. Published in early April, the Cybersecurity and Infrastructure Security Agency’s proposed rule aims to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). The proposal’s enhanced and speedier reporting requirements aim to help the government “better understand the threats we face, spot adversary campaigns earlier, and take more coordinated action with our public and private sector partners in response to cyber threats,” CISA Director Jen Easterly said in a statement upon the proposed rule’s unveiling. CISA also noted that the changes would be timely for the #healthcare sector, which “routinely” faces cyber incidents. The agency specifies that its proposed rule would cover hospitals with 100 or more beds, critical access hospitals, the manufacturers of certain “essential” medicines, moderate-to-high-risk medical device makers and a broad swath of IT entities. International Association for Healthcare Security and Safety (IAHSS) ASIS International Stefanie Drysdale Adam Lee, MBA, M.S., CEM®

3

lots of companies will need this in the future get ready

4

2 Comments

🇺🇸🆔 U.S. Department of Homeland Security (DHS) Awards Contracts to Innovate Digital Credential Privacy The DHS Science and Technology Directorate (S&T) has announced government contracts awarded to Credence ID, Hushmesh, Netis d.o.o., Procivis, SpruceID, and Ubiqu. These contracts are aimed at developing privacy-enhanced technologies for digital versions of credentials used in immigration and travel, allowing users to store their information securely in digital wallets. Anil John, Technical Director of S&T’s Silicon Valley Innovation Program (SVIP), emphasized the importance of these developments, stating that the new capabilities will ensure secure storage and proper verification of credentials while preserving individual privacy. This initiative supports the DHS’s role as a primary issuer of critical credentials such as those for cross-border travel, employment eligibility, and citizenship. Jared X. Goodwin, Acting Chief of the Program Management and Data Division at U.S. Citizenship and Immigration Services (USCIS), highlighted that digital credentials and secure digital wallets meet the public’s expectations for convenience and security in a digital age. The standards for these digital solutions, developed by the World Wide Web Consortium (W3C), ensure global interoperability, accessibility, and privacy. The awards stem from the DHS Privacy Preserving Digital Credential Wallets & Verifiers solicitation, reflecting the department's commitment to enhancing service delivery while protecting privacy. This solicitation builds on previous efforts to address the vulnerabilities of paper-based credentials. Each selected company will receive up to $1.7 million across four SVIP phases. The awarded projects and their respective innovations are as follows: - Credence ID (Oakland, CA 🇺🇸 ) received $199,140 to adapt its existing identity verification technology to support W3C standards, allowing for a simple software update to current hardware readers. - Hushmesh Inc. (Falls Church, VA 🇺🇸 ) was awarded $199,430 to incorporate cryptographic security and zero-trust principles into its Mesh technology, enhancing key management for digital wallets. - NETIS Group (Ljubljana, 🇸🇮 ) received $198,849 to enhance its MIDVA platform, supporting organizational onboarding and credential verification through a Fleet Management Platform and Mobile Verifier App. - Procivis AG (Zurich, 🇨🇭) was awarded $187,285 to improve its Procivis One platform, making it more flexible and capable of handling various types of digital credentials. - SpruceID (New York, NY 🇺🇸) received $199,960 to advance its software for creating secure, verifiable digital credentials suitable for multiple sectors. - ubiqu (Rotterdam, 🇳🇱 ) was awarded $197,961 to integrate its Remote Secure Element technology, ensuring user control and secure recovery solutions for digital credential services Link to DHS media release in first comment

46

2 Comments

🚀 Exciting News for Defense Contractors! 🚀 The Department of Defense (DoD) has introduced the Cybersecurity Maturity Model Certification (CMMC) to bolster the safeguarding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This initiative is a transformative step for the Defense Industrial Base (DIB), requiring all contractors and subcontractors to adhere to rigorous cybersecurity standards prior to being awarded contracts. 🔍 Why is CMMC Important? 💪 Strengthened Security: By implementing CMMC, organizations can better defend against cyber threats and protect Controlled Unclassified Information (CUI). ✈ Competitive Advantage: Certification can enhance an organization’s credibility and open new business opportunities within the defense sector. 🤝 Collaboration & Compliance: CMMC encourages a culture of security across the supply chain, fostering collaboration between defense contractors and the DoD. If you have question connect with me #cmmc #NIST800-171 #icttariq

33

Enhanced Visibility & Hardening Guidance for Communications Infrastructure CISA has released actionable guidance to help organizations bolster the security and resilience of critical communications infrastructure. * Enhanced Network Visibility: Tools and strategies to monitor and detect potential vulnerabilities. * Hardening Measures: Practical steps to fortify systems against evolving threats. * Proactive Defense: Best practices for mitigating risks to critical infrastructure. Secure your communications systems today and stay ahead of potential threats. Explore the full guidance here: https://lnkd.in/gADKtUPf #Cybersecurity #InfrastructureSecurity #CISA #Resilience

30

My latest on proposed AI export controls. Currently pending before congress is the bipartisan Enforce Act, a bill designed to empower the department of Commerce to enforce controls on not just AI hardware, but software as well. Unfortunately, the act as written would encourage needless cyber risks by limiting the export of cybersecurity services needed to maintain, secure and patch systems as well as automated vulnerability discovery systems. Fundamentally, cyber risks left unresolved abroad by export burdens could compromise our highly integrated domestic systems. Currently, the bill treats security as zero-sum when in reality a rising cyber-tide lifts all boats. The ability to quickly identify and solve cyber issues abroad is essential to domestic security and must be enabled. #ArtificialIntelligence #Aigovernance #cybersecurity https://lnkd.in/eYU6ckmB

11

The U.S. Department of Commerce, through NIST's AI Safety Institute (AISI), just released a strategic vision for their work. There are three goals identified: (1) Making the vision possible; (2) Making the vision actionable; (3) Making the vision sustainable. The strategy was release in conjunction with the start of the AI Seoul Summit. One particular item caught my eye under Goal 1: "Conduct pre-deployment TEVV (Testing, Evaluation, Verification, and Validation) of advanced models, systems, and agents to assess potential and emerging risks." This testing will be conducted by NIST labs, other government agencies, international partners and "a diverse set of AI stakeholders." Although the goals of these test efforts do not seem to overlap much with those in the health AI space, I have to wonder at both the complementary overlap as well as the conflicts that will arise over time, as government tries to drive various TEVV / assurance lab efforts in different use areas.

49

1 Comment

I recently attended the module "Dual-Use Technologies: Know Your Research – Know Your Partners - Assess the Risk," which offered valuable insights into the complexities and responsibilities associated with dual-use technologies. Dual-use technologies, capable of serving civilian and military purposes, present unique challenges in ethical considerations, compliance, and international regulations. Key takeaways included: Understanding Dual-Use Technologies: It is crucial to recognize the potential for dual-use and the regulatory frameworks governing their use. This includes international treaties, export controls, and mitigating risk compliance requirements. Risk Assessment: Conducting comprehensive risk assessments to evaluate the potential for misuse and consider broader implications. Due Diligence on Partners: Ensuring thorough background checks and understanding of the intentions and capabilities of research partners. Canada's emphasis on this training stems from a commitment to national and international security, promoting responsible innovation, and maintaining leadership in global research standards. By ensuring that researchers and institutions know these responsibilities, Canada aims to prevent the misuse of technologies and foster collaborations that uphold ethical standards. #DualUseTechnologies #Research #RiskAssessment #ResponsibleInnovation #Security #CanadaResearch

8

Affordable NDR for the Rest of Us. NDR is just one of several Detect & Respond security solutions companies can choose. But, Many of these solutions are expensive. Finally NDR is being made affordable. https://lnkd.in/geZP9Qr4 Check out this analysis of NDR and how it relates to other Detect and Respond solutions for small - Midsized companies.

2

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

The Intelligence and National Security Alliance is excited to announce the establishment of our new subcommittee on Artificial Intelligence. The AI Subcommittee will be a part of our long-standing Technology and Innovation Council and will be chaired by Chitra Sivanandam. The group will focus on four priority areas: - safely implementing AI within the Intelligence Community, - evaluating mission-related opportunities and risks, - preparing an "AI-ready" workforce, and - considering future needs for models, data, and infrastructure. We're excited to continue to serve as a convener of dialogue between public and private sector leaders and SMEs on this topic critical to our nation's security and global competitiveness. Read more about the subcommittee and get involved here: https://lnkd.in/dn2quv7t

71

6 Comments