Privacy Rules over Cybersecurity, as NIST provides new guidance

Go too long without talking security, and the stories pile up.   Let’s get into it.

The National Institute of Standards and Technology (NIST) has released draft guidance for protecting controlled unclassified information (CUI), outlining revised cybersecurity requirements for federal agencies and government contractors. The updates include security requirements and assessment procedures for evaluating threats to CUI. The public comment period for the draft publications will be open until January 12, 2024, and the final rule is expected to be published in early 2024. The release of the revised guidance follows public feedback on a previous draft version. NIST aims to develop universal standards and guidelines that organizations can tailor to meet their specific needs.

According to a report by the National Cybersecurity Alliance (NCA), there is a lack of interest in cybersecurity among Gen Z and other generations. The NCA found that only 69% of Gen Z respondents considered online security a priority, compared to 82% of millennials and 91% of baby boomers. To address this issue, IT professionals should seek creative ways to promote safe online habits and personalize information security.

US data brokers are selling sensitive private data about active-duty military members and veterans, including their names, addresses, geolocation, net worth, religion, and information about their children and health conditions. A study conducted by researchers from Duke University found that many data brokers offered to sell this data with minimal vetting and were willing to deal with buyers using email domains based in the US and Asia. The study highlights the privacy and national security risks created by data brokers and calls for industry regulation.

According to Cisco’s 2023 Consumer Privacy Survey, younger consumers take privacy seriously, governmental action and privacy laws are seen as positive, AI using personal information is a concern, and companies need to earn trust in AI. The survey also found that users have increased exercising their data subject access rights, and while there is enthusiasm about AI, there are concerns over its deployment.

That controlled unclassified information guidance can easily be adapted for commercial use, and I wanted to inform providers of it.

Interestingly, there’s interest in privacy but not in cybersecurity.   Important safety tip.   The value of privacy should not be dismissed – and let’s note that the passage of a US privacy law would be good for cybersecurity in this context, too.