Explore

Rapid ReadRapid Read
Peace Corps Information Security Program Deemed Ineffective by Inspector General

Peace Corps Information Security Program Deemed Ineffective by Inspector General

The Peace Corps Office of Inspector General (OIG) has reported that the agency's information security program remained ineffective in fiscal year (FY) 2026. The review, conducted under the Federal Information Security Modernization Act (FISMA), identified weaknesses in nine out of ten security domains. The program maintained an overall Level 2 maturity rating, with Level 4 signifying an effective program, according to the Office of Management and Budget. The OIG's report emphasized the need for additional efforts to strengthen IT controls, address vulnerabilities, and improve cybersecurity breach response. The Peace Corps' global operations involve 3,400 volunteers and trainees across 56 posts in 60 countries, managing sensitive medical and personal information, as well as mission-critical data. Six recommendations from previous years remain open, and the OIG issued eight new recommendations for FY2026 deficiencies. Despite these issues, the Peace Corps achieved Level 4 for the first time in the Security T...
Rapid ReadRapid Read
South Korea Updates Personal Data Security Guidance to Include Passkeys Amid Rising Cyber Threats

South Korea Updates Personal Data Security Guidance to Include Passkeys Amid Rising Cyber Threats

South Korea's privacy regulator, the Personal Information Protection Commission (PIPC), has updated its official guidance for protecting personal information. This revision now includes passkeys as a recognized option for passwordless authentication, expanding the number of approved authentication methods from seven to twelve. Other additions to the guidance include QR codes and mobile applications. The updated directives also mandate that public sector systems undergo annual vulnerability assessments and penetration testing, with prompt remediation of any identified weaknesses. Furthermore, the PIPC has issued warnings against storing encryption keys in plaintext within application source code or configuration files and has addressed API security, delayed software updates, and preparations for post-quantum cryptography. These changes are a direct response to growing cybersecurity concerns, as South Korean government systems recorded 1.57 billion suspected attack alerts between January and July of the curr...
Rapid ReadRapid Read
Nevada Appoints Casey Quinn as First Chief Privacy Officer to Lead Statewide Data Protection

Nevada Appoints Casey Quinn as First Chief Privacy Officer to Lead Statewide Data Protection

The Nevada Governor’s Technology Office (GTO) has announced the appointment of Casey Quinn as the state’s first chief privacy officer. In this new role, Quinn will be responsible for leading statewide privacy governance and data protection efforts across all executive branch agencies. Additionally, he will serve as the GTO’s general counsel, supporting the office’s legal functions and advising leadership on matters such as procurement, contracting, rulemaking, legislative issues, and emerging technology policy. Prior to this appointment, Quinn served as a land agent with the Nevada Division of State Lands and was a partner at BG Law, as well as a senior deputy attorney general within the Complex Litigation Division of the Nevada Attorney General Office. The GTO also announced other leadership changes, including Megan Franklin as communications and policy officer and Jared Wilkin as chief IT manager of the Client Services Division.
TrendlineTrendline
Law Firms Face Significant Cyber Extortion Threats Despite High Security Spending

Law Firms Face Significant Cyber Extortion Threats Despite High Security Spending

Law Firms Face Significant Cyber Extortion Threats Despite High Security Spending
TrendlineTrendline
TSMC Investigates Unauthorized Exposure of Employee Personal Information, Citing Cloud Provider Vulnerability

TSMC Investigates Unauthorized Exposure of Employee Personal Information, Citing Cloud Provider Vulnerability

TSMC Investigates Unauthorized Exposure of Employee Personal Information, Citing Cloud Provider Vulnerability
TrendlineTrendline
Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar

Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar

Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar
Rapid ReadRapid Read
CISA Enhances Cyber Incident Reporting Form Amidst Pending CIRCIA Mandate

CISA Enhances Cyber Incident Reporting Form Amidst Pending CIRCIA Mandate

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched an updated cyber incident reporting form, featuring more detailed questions about incident types and utilizing MITRE ATT&CK terms for observed activity. This enhancement, announced on November 9, aims to improve data quality, enabling CISA to identify broader threat trends from seemingly separate incidents. The revised form includes questions on malware, social engineering, hacking techniques, and insider threats. Currently, only federal civilian agencies are mandated to report incidents to CISA, but the agency encourages voluntary reporting from other organizations, with submitted information protected under the Protected Critical Infrastructure Information (PCII) Program. This update comes as the final rule for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) awaits approval from the White House, having been under review since October 1.
Rapid ReadRapid Read
Physicians Urged to Prioritize Cybersecurity for Connected Medical Devices in Primary Care Settings

Physicians Urged to Prioritize Cybersecurity for Connected Medical Devices in Primary Care Settings

Primary care physicians and General Practitioners (GPs) are being advised to prioritize cybersecurity for connected medical devices within their offices. The IEEE highlights that any connected device, whether a diagnostic tool, imaging equipment, or even a smart television in a waiting area, is part of the practice's security environment. Physicians should ask critical questions before integrating new devices, such as whether they receive security updates, who is responsible for installation, the duration of manufacturer support, and how information is transmitted. Even devices that continue to function clinically after manufacturer support ends can pose operational risks due to unsupported software or firmware. The IEEE Medical Device Cybersecurity Certification Program offers a standards-based resource to evaluate the cybersecurity practices of connected medical devices, helping practices make informed decisions when selecting and deploying these systems.
TrendlineTrendline
Trucking Industry Faces Growing Cybersecurity Risks from Connected Devices

Trucking Industry Faces Growing Cybersecurity Risks from Connected Devices

Trucking Industry Faces Growing Cybersecurity Risks from Connected Devices
TrendlineTrendline
Blocking AI Chatbots Increases Shadow AI Risk for Small and Midsize Businesses

Blocking AI Chatbots Increases Shadow AI Risk for Small and Midsize Businesses

Blocking AI Chatbots Increases Shadow AI Risk for Small and Midsize Businesses
Rapid ReadRapid Read
U.S. PIRG Advocate Warns Against Sharing Sensitive Information with AI Chatbots

U.S. PIRG Advocate Warns Against Sharing Sensitive Information with AI Chatbots

R.J. Cross, a data privacy advocate with U.S. PIRG, has issued a warning regarding the privacy risks associated with using AI chatbots. According to Cross, information typed into AI chatbots can be stored by the companies operating them and, depending on the service and user settings, may also be used to train AI models. This raises concerns that personal data shared with chatbots could potentially be exposed or surfaced in other people's searches. Cross highlighted instances where information shared in chatbot conversations appeared elsewhere online, emphasizing that while private chats don't automatically become public, the storage and potential exposure of data are significant risks. Chatbot companies sometimes disclose that user data will be used for training, but often do not explicitly state that this data will also be stored on their servers, making it vulnerable to hacks or unintended exposure.
Rapid ReadRapid Read
CISA Updates Cyber Incident Reporting Form with Granular Data Requirements

CISA Updates Cyber Incident Reporting Form with Granular Data Requirements

The Cybersecurity and Infrastructure Security Agency (CISA) has launched a revamped cyber incident reporting form designed to collect more detailed information about security breaches. Announced on November 9, the updated web-based questionnaire includes granular questions on specific incident types such as malware, social engineering, and insider threats. A key enhancement is the integration of the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework, which enables organizations to describe adversary behavior using standardized terminology. This improved data quality is intended to help CISA correlate related threat activity into broader trends, facilitating faster and more thorough threat analysis. While currently mandatory only for federal civilian agencies, CISA encourages voluntary reporting from other sectors, offering protections under the Protected Critical Infrastructure Information Program. This initiative precedes the final rule for the Cyber Incident Reporting for Criti...