Data-Driven Cyber Policy: From Dream to Reality
summary
Government data collection ramps up with CIRCIA incident reporting and a proposed incident form that asks for MITRE ATT&CK mapping so analysts can track TTPs at scale. BitSight finds CISA’s KEV program speeds remediation but average patch times remain months; legacy flaws like SQL injection persist and weak defaults (eg, “SolarWinds123”) recur. CISA pilots a Cyber Insurance Data Analysis Working Group to aggregate anonymized insurer incident data, while policymakers push a Bureau of Cyber Statistics to measure outcomes.
AI-written summary · about
chapters (15)
- 0:00Data-driven cyber policy intro
- 1:43US cybersecurity performance
- 8:13Empirical cybersecurity data need
- 12:31Cybersecurity measurement gaps
- 19:15Focusing on cybersecurity outcomes
- 21:26Business-driven cybersecurity changes
- 22:31Patching vulnerabilities challenges
- 27:33Market pressure and software liability
- 30:01Bureau of Cyber Statistics
- 33:14Regulatory use of cyber data
- 36:50SEC rules and liability
- 39:23Legal tools for threats
- 42:14Cyber insurance collaboration
- 46:17Local cybersecurity maturity
- 49:05Final remarks
related talks
40mCyber Risk Management Programs: Bringing Clarity to Cybersecurity
40mHow CISA Is Charting a Path Toward Defensible Infrastructure
37mMore Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19
01h 05mCritical Information Infrastructure (CII) Protection: Challenges & Opportunities
01h 05mWhat It Takes to Lead America’s Vulnerability Management Team
25mDisparate Data, Distorted Decisions: Vendor Data Bias in CTI
50mBetter Risk Assessment for Cyber Insurance: How Will We Get There?
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)