Login Form

ISC2 East Bay Chapter

Some Reading Ideas

Talk-2-Me

Risk Management Framework - RMF SP 800-37

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (nist.gov)

Prepare Essential activities to prepare the organization to manage security and privacy risks.

Implement the controls and document how controls are deployed.

Categorize the system and information processed, stored, and transmitted based on impact analysis. 

Assess to determine if the controls are in place, operating as intended, and producing the desired results. 

Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)

Authorize: Senior official makes a risk-based decision to authorize the system (to operate).

Monitor: Continuously monitor control implementation and risks to the system. 
Table 1: RMF Steps Including Resources for Implementers and Supporting NIST Publications *Read More at Risk Management Framework (RMF) Overview - Risk Management | CSRC

Cybersecurity Framework

Cybersecurity Framework (CSF) Framework Core (nist.gov)

Identify –   Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Framework. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include Asset Management; Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.

Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events. Examples of outcome Categories within this Function include Anomalies and Events; Security Continuous Monitoring; and Detection Processes. 

Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include Response Planning; Communications; Analysis; Mitigation; and Improvements.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact of a cybersecurity incident. Examples of outcome Categories within this Function include Recovery Planning; Improvements; and Communications. 

Read more about NIST Cybersecurity Framework CSF

Disinformation - Risk Management

Disinformation in Medicine and Voting - Speaking with Cybersecurity Sherri Douville CEO Medigram and Jennifer Cohn Election Integrity Advocate

Details
Written by: Robin Basham
Parent Category: GRC Blog
Category: Disinformation and Risk Management

An evening with ISC2 East Bay discussing Voter system integrity

Topics that shouldn't be political, like system integrity and fact-based medical information

7 PM Sherri Douville, How to Be an Ambassador of Trust: Putting Risk Management to Work Combating the Threat of Misinformation, 8 PM Jennifer Cohn – Election Integrity 

How to Be an Ambassador of Trust: Putting Risk Management to Work Combating the Threat of Misinformation, followed by, Presented by Sherri Douville, CEO, Medigram, Inc.

  • The Integrity of Information and Our Role in the “Information Supply Chain”
  • The Hard Road Traveled: Why trust is important to you, your career, and your teams, even your families.
  • How to think of the role that bias plays in misinformation
  • Methods of fact checking
  • Compassion & Leadership for the human vulnerabilities that lead to susceptibility to misinformation.
  • Evidence based techniques to combat misinformation while preserving relationships
  • How the Mobile Medicine Book, the #1 new release in medical technology and medical informatics on Amazon can help you to combat technology misinformation. Amazon Mobile Medicine
Sherri Douville, CEO Medigram
Sherri Douville is CEO & Board Member at Medigram, Inc.
Editor & Coauthor, Best Seller, New Releases in Medical Technology
Mobile Medicine: Overcoming People, Culture, & Governance 
Routledge, Taylor & Francis Group

Sherri Douville Biography

Sherri Douville is CEO & Board Member at Medigram and is a sought-after speaker and author in mobile medical technology, other healthcare-related industries, leadership, risk management, mobile security, and governance. Ms. Douville is honored to strategically build, grow, and lead multi-disciplinary, multi-industry teams at Medigram and in the market to solve the leading cause of preventable death –a delay in information. Ms. Douville is co-chair of the technical trust and identity standard subgroup for the healthcare industry for clinical IoT through an IEEE and UL joint venture and has been published and quoted in both mainstream and industry media such as CIO.com, the San Jose Mercury News, NBC, Becker’s Hospital Review, ThisWeekinHealthIT, and HITInfrastructure.com. Other industry leadership has included serving on the board of the NorCal HIMSS and teaching continuing education credit in mobile security for CISSP, the information security certification. She is the co-author for a number of technical articles and papers, a forthcoming Springer book chapter on Trust in Clinical IoT and is the lead author and editor for Mobile Medicine: Overcoming People, Culture, and Governance (Taylor & Francis). Ms. Douville led the development of this industry guide to mobile computing in medicine and built the international, multi-industry, multi-disciplinary team behind it. Prior to her current work in the mobile medicine, privacy, security, health IT, and AI industries, Sherri worked in the medical device space consulting in the areas of physician acceptance and economic feasibility for medical devices. Previously, she worked for over a decade with products addressing over a dozen disease states at Johnson & Johnson and was recognized for industry thought leadership thereby McGraw-Hill, and won a number of awards. Ms. Douville has a Bachelor of Combined Science degree from Santa Clara University and has completed certificates in electrical engineering, computer science, AI, and ML through MIT. She advises and serves startups, boards, and organizations including as a member of the Board of Fellows for Santa Clara University and an advisor to the Santa Clara University Leavey School of Business Corporate Board Education initiatives, the Black Corporate Board Readiness, and Women’s Corporate Board Readiness programs.

You don't have a pdf plugin, but you can download the pdf file.

Session-Two: Election System Integrity, JENNIFER COHN, JOURNALIST AND ELECTION INTEGRITY ADVOCATE

Ms. Cohn’s talk will provide an overview of election system vulnerabilities, the impact of the Big Lie on election-security advocacy, and suggestions for improving the system in 2022.

Jennifer Cohn is an election integrity advocate, writer, and journalist. She graduated from the University of California, Los Angeles in 1989 and Hastings College of the Law in 1993. Since the 2016 election, she has focused her professional efforts exclusively on investigating and exposing our country’s insecure computerized elections. She was a law partner at Nielsen Haley & Abbott in Marin County for many years, where she specialized in insurance coverage and civil appeals. Before that, she specialized in criminal appellate law.

Hand Marked Paper Ballots
HANDMARKEDPAPERBALLOTS

We can view her published work in @WhoWhatWhy @nybooks @Salon #HandMarkedPaperBallots#RobustManualAudits#BackupPaperPollBooks link.medium.com/qxbJDJMZ8db

Jennifer Cohn is a compelling genius people may recognize from her extremely successful Twitter and media presence.

Jennifer Cohn

Some Published content by the speaker:

Hits: 519
Main Menu

NIST Reading

Whether you're preparing for Cybersecurity certification, working with government standards, or simply starting your career in compliance, these are the NIST Federal Information Processing Standards (FIPS), Special Publication (SP), and Interagency Report (IR) topics you need to know. (The Perils of Mount Must Read™ Confessions of a Cliff Note Junky) These resources go onto the "Mountain of Must Read". If you don't recognize the standard reference, you've missed critical understanding. As of 2022, this is the minimum NIST alphabet. All of these documents are found at https://csrc.nist.gov/publications/ Be very careful about static content. Look at links before you launch them. Never use alternate sites for the Computer Security Resource Center. Get the full list here <NIST Reading Extended>

FIPS Publication 140-2 Security Requirements for Cryptographic Modules [FIPS 140-2]
FIPS Publication 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS 199]
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems [FIPS 200]
FIPS Publication 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS 201-1]		 NISTIR 8212 ISCMA: An Information Security Continuous Monitoring Program Assessment
NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems [SP 800-18]
NIST SP 800-30 Risk Management Guide for Information Technology Systems [NIST SP 800-30]
NIST SP 800-34 Contingency Planning Guide for Federal Information Systems [SP 800-34]

US Cert CISA Tweets