Tim Gilday

I appreciate the NIST team. I think they do an excellent job keeping up with evolving technology and risk management. The supplemental guidance is very helpful when trying to understand the intent of various controls. #compliance #ITGC #audit

3

Are you trying to get from 0 to 1 in your AI governance journey? What if you’re already doing good work but need to accelerate your maturity? Are your Safety- and Rights-Impacting use cases being handled appropriately? Is your AI inventory stuck in Excel and, well, a little chaotic? We’ve solved that. I’m extremely proud to announce the AI Governance Jumpstart by Credo AI and Booz Allen Hamilton. This offering tackles the challenges above with a simple, straightforward set of tools and practices. We’ve designed it to eliminate your “Governance Debt” and turbocharge your AI governance work to meet key OMB requirements. One thing we’ve learned over the years is that requirements that seem simple on the surface are never straightforward to implement in your organization. Read more about how we approached this problem in the article that Dave Prakash MD and I wrote about this offering and reach out if you’re interested in learning more. A big thank you to the visionaries behind this work: Sarah Curtis, the Product Manager, and Stuart Friedman, Sandra Luksic, and Jack Williamson from my team who stressed over every detail these past six months. And Ehrik Aldana and the entire Credo team for bringing their secret sauce and world-class tooling. This is our first joint offering together and we’re excited to bring it to market. https://lnkd.in/exBShWv5

40

The vast array of financial pressures facing the US #healthcare system has direct consequences on how #CISOs will have to manage their security programs: from stakeholder buy-in to tool rationalization. Let’s dig in… David Dirks gave this year’s opening Keynote at the Health-ISAC Spring Summit, entitled The Wind, The Waves, and the Wheel. While not a cybersecurity talk, it was very relevant to get a broader strategic outlook of the healthcare industry as a whole before diving into how to protect it for the rest of the week. The notes I took on the summary of the current state were not hopeful – and we have seen the spillover impacts into healthcare cyber programs that we support. For the healthcare industry as a whole: 1. Healthcare systems are in unprecedented financial trouble. 2. Staff are facing burnout. 3. Traditional financial levers are disappearing. 4. High per capita healthcare spending in the U.S. 5. Aging baby boomer population increasing demand for healthcare. Looking past the impacts, David talked about some of the root causes and solutions - AI can reduce burnout and administrative burden. - 25% of healthcare spending is administrative waste. The waste amounts to $4.5 trillion annually. The convoluted billing system is a major contributor to this waste. - Simplifying payment mechanisms can reduce costs. "If we don't fix the underlying financing and economic systems of healthcare, then nothing else is possible.” Government bailouts are not a sustainable solution. - The fundamental issue in healthcare is the financing and economic systems. - Re-platforming healthcare involves shifting the focus from hospitals to consumers, providing care before they get sick. - We need to encourage collaboration among healthcare entities to improve the system. The speaker didn’t go into any depth on the downstream impact to cybersecurity programs, but I think it is pretty clear. Cost reduction mandates will place pressure on CISOs if they aren’t articulating the business case for risk management, protecting patient data, and most importantly, avoiding disruption/diversion to healthcare facilities. Healthcare CISOs absolutely should be focusing on efficiency and doing more with less. Identifying and focusing on your most important initiatives will help eliminate unnecessary costs. Cyber tool rationalization (removing low(er) value tools and increasing use and value of the remainder) and spending more time in improving processes and getting tools to scale can also help. There is no easy solution to the challenges here, but I think recent events would affirm that we can’t treat cyber as a cost center to be reduced and hope for the best. That tactic has been tried and has failed. CISOs in healthcare should be creative to become part of the solution vs their programs getting diluted because of the problem. #SpringSummit

30

6 Comments

Continuing the Federal #Data and #AI Mission Outcomes series, today we focus on the FDA and Electronic Health Records (EHR). When the U.S. Food and Drug Administration wanted to proactively monitor electronic health records to discover potential side effects related to blood transfusions, #BoozAllen applied advanced natural language processing to clinicians’ notes within EHRs. This information helped to provide valuable information around side effects that may be deadly. To learn more about supporting the discovery of safety concerns and download a case study, click here. https://lnkd.in/gvW2Pnew

2

Continuing the Federal #Data and #AI Mission Outcomes series, today we focus on the FDA and Electronic Health Records (EHR). When the U.S. Food and Drug Administration wanted to proactively monitor electronic health records to discover potential side effects related to blood transfusions, #BoozAllen applied advanced natural language processing to clinicians’ notes within EHRs. This information helped to provide valuable information around side effects that may be deadly. To learn more about supporting the discovery of safety concerns and download a case study, click here. https://lnkd.in/eGSkhyk8

11

H.R.8673, the EPIC Act, which would create such a foundation, was reported favorably out of the House Science, Space, and Technology Committee recently. The bill has bipartisan support in the House and has already attracted interest from the Senate. (https://lnkd.in/g4xV5xDW) I will be tracking the progress of this bill with great interest. #CHIPSandScience #AI #funding

5

As we near finalization of the 32 CFR Part 170 component of the #CMMC rules, a top priority for DoD leadership should be on the subjects of Management, Oversight, Administration, and Stakeholder Participation. I remain anxious about the overall feasibility of the CMMC program once the rules are finalized. Seemingly small “features” of the proposed 48 CFR rule, for example the obligation to report “any lapses or changes” to information systems to COs, further aggravate burdens and costs upon contractors with no better than dubious benefit to warfighters and requiring activities. Too much of a doubtful thing, IMO, is not a better thing. There is both complexity and rigidity in these regulations, as all know. But there is no corresponding or proportionate oversight and management, by DoD, and nothing, at present, that enables regular interchange between government and industry stakeholders. This is potentially hazardous to all concerned. When this regulatory complex is applied to tens of thousands of companies at the ground level, we will encounter, immediately, difficult problems in application. These will be frustrating, at least, to contractors. Such problems may disrupt supply chain continuity, for DoD requiring activities and warfighters, as some companies will exit and more will fail assessment requirements. Yet, I do not now see promised, articulated, or actuated, mechanisms within the Department to coordinate a response to the inevitable “deployment” issues. The issues are not self-correcting. These issues must be resolved and means must be fashioned to communicate within the Department, and to industry, both the problems and their resolutions. At the very least, we need something like the National Industrial Security Program Policy Advisory Committee, NISSPAC, https://lnkd.in/gBSTDnqn, which was created under an Executive Order to foster public-private communications for industrial security programs. Even more important, DoD must increase the funding, resources, and authority of entities or organizations charged with the oversight and management of the CMMC program. While the regulations were created by the Office of the DoD Chief Information Officer, contractual implementation is largely the responsibility of Office of the Under Secretary of Defense for Acquisition & Sustainment. CMMC also has obviously importance to USD/I&S, USD/R&E and USD/Policy. An immediate priority should be to create and formalize an Executive Steering Group, reporting to the Deputy Secretary of Defense (DSD), to include representatives from these and other entities with national security responsibilities (e.g., ONCD, NSC, ODNI, NSA). The role and resources of both DCMA and DCSA should be increased with a focus on CMMC implementation. The Department must have a workforce trained and capable of CMMC situational response and general guidance. If I misapprehend DoD’s planning and readiness to manage, I hope to be corrected. Personal opinion.

52

9 Comments

🔽 See DoD's input request below 🔽 Time for some of those great ideas batted around on LinkedIn to reach the right people in DoD, particularly how to reach small businesses and non-traditional defense contractors and bring them into the fold early in the design, development, and testing processes. The DoD needs DIB expansion. AI, like it or not, is the next big initiative for DoD and most Federal agencies. DoD needs help to make it happen and leveraging AI is going to be an avenue to get it done.

4

Tune in for the ATARC Optimizing Operations: Gen AI in Federal Agencies webinar on July 18, 2024 from 1:30 to 2:30 PM ET! Generative AI is transforming the federal government by enhancing efficiency, decision-making, and service delivery. This webinar explores its #applications, such as automating tasks, analyzing large datasets, improving #cybersecurity, and developing predictive models. Follow along as experts discuss strategic implementation, addressing challenges like #data privacy, security, and system integration to create a more agile and responsive #government. Join here - https://ow.ly/plaL50SyLQp

1

In the spirt of the Federalist Papers, take a look at the Digitalist Papers, focusing on how AI will and is influencing democracy. https://lnkd.in/gK5uUBGS

12

⚠️ NIST releases first encryption tools to resist quantum computing The U.S. National Institute of Standards and Technology (NIST) has released the first three encryption standards designed to resist future cyberattacks based on quantum computing technology. The agency encourages system administrators to start the transition to the new algorithms as soon as possible, since timely adoption is paramount for protecting sensitive information from attackers with a retrospective decryption strategy, also referred to as "harvest now, decrypt later." Read more: https://lnkd.in/emUWTgEX #CyberSecurity #InfoSec #encryption #QuantumComputing #QuantumAI #decryption #NIST #ThreatManagement #riskmanagement CISO360 Ascend International Advisory FZCO

5

If you are a technology or a data leader in a state or a local government organization, and would like to unlock value from Tbs of #unstructured #semistructured data, this webinar is for you https://lnkd.in/eaT4TUh9 If you are a #CX #customerexperience #VOC leader and think #generativeAI #genAI #LLM can solve all your data / #analytics challenges, then please join Aaron Katz Colleen Fazio and yours truly https://lnkd.in/eZgjBKux Forrester

21

2 Comments

A strong appetite for AI & machine learning was among the key themes in this year’s #GovConClarity report. Find out what else your #GovCon peers are planning for 2024 & beyond during our webinar on 5/7. https://lnkd.in/gmDvt7Uv

7

Dive into the transformative power of quantum technologies with Garland Garris, Quantum Lead at Accenture Federal Services. Emphasizing the need for federal agencies to fortify their defenses against cryptographic threats, Garris advocates for a strategic embrace of quantum advancements. He suggests using the recent OMB memorandum as a roadmap to integrate Zero Trust principles into technology ecosystems. Learn more about the next generation of quantum adoption in his latest article: https://accntu.re/466NiWM. #QuantumComputing #Cybersecurity #FederalAgencies #TechInnovation

71

2 Comments

Thomas Woodside's latest blog post delves into the contentious debate surrounding the "emergent capabilities" of large language models (LLMs). Despite widespread discussions, there remains significant confusion about what emergence in LLMs truly entails and its implications for policy. This explainer explores: ♦️ How the concept of emergence, from complex systems theory, relates to deep learning and how the term has been applied to LLMs specifically. ♦️ Real-world examples and potential risks associated with these emergent capabilities, such as unexpectedly effective autonomous hacking. ♦️ The academic and practical responses to emergence, including efforts to develop metrics that predict LLM behavior more accurately. Thomas emphasizes the need for more robust methods to anticipate and mitigate the risks posed by new AI capabilities, particularly those that might arise unexpectedly as LLMs scale. Dive deeper into this critical exploration of AI's unpredictable frontier, and discover why both skepticism and rigorous research are crucial as we advance:

7

2 Comments

In the quest to design a blueprint for open, free, and trustworthy digital economies, policymakers face the dual challenge of scaling technologies while addressing fragmentation across tech and economic systems. Balancing freedom and security to secure national interests and economic growth is necessary. Key building blocks include: 1. Infrastructure: Ensuring secure, interoperable digital infrastructure while managing decentralization. 2. Data: Protecting privacy, managing data ownership, and combating data manipulation. 3. Identity: Establishing secure, interoperable digital identity systems to build trust and prevent fraud. Policymakers must create a cohesive strategy that aligns infrastructure, data, and identity policies to maintain an open, secure, and innovative digital economy. #digitaleconomy #cybersecurity #policy #dataprivacy

16

2 Comments