{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs","description":"Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers. &amp;nbsp; Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience. &amp;nbsp;Youtube VOD Link: https:\/\/youtube.com\/live\/tFaAB9an47g &amp;nbsp;Questions and topics: Usable security: is it an oxymoron? What determines if the security is \u2018usable\u2019 or no? We sacrifice security for a better UX, what can be done to alleviate that? Or is it some sort of sliding scale in \u201cpoor UX, amazing security or awesome UX, poor security\u201d Examples of poor UX for \u2018people\u2019: MFA, and password managers. SEC updates and \u2018material events\u2019 and how that would affect security, IR, and other company reporting functions.&amp;nbsp; &amp;nbsp; Also, additional documentation (Regulation S-K Item 106)  https:\/\/www.linkedin.com\/posts\/nicole-sundin-5225a1149_sec-adopts-rules-on-cybersecurity-risk-management-activity-7090065804083290112-ISD8 Are companies ready to talk about their cybersecurity? Can the SEC say \u201cyou\u2019re not doing enough?\u201d &amp;nbsp;What is \u2018enough\u2019? Are we heading toward yet another audit needed for public companies, similar to SOX? When does an 8-K get publicly disclosed? Materiality is based on a \u201creasonable investor\u201d? So, you don\u2019t need to announce that until you\u2019re certain, and it\u2019s based on what you can collect? Cyber Risk Management and some good examples of how to set up a proper cyber risk organization Additional Links:  https:\/\/csrc.nist.gov\/CSRC\/media\/Projects\/usable-cybersecurity\/images-media\/Is%20Usable%20Security%20an%20Oxymoron.pdf  http:\/\/web.mit.edu\/Saltzer\/www\/publications\/protection\/Basic.html https:\/\/www.sec.gov\/news\/press-release\/2023-139  https:\/\/www.sec.gov\/news\/statement\/munter-statement-assessing-materiality-030922  https:\/\/www.pwc.com\/us\/en\/services\/consulting\/cybersecurity-risk-regulatory\/sec-final-cybersecurity-disclosure-rules.html  https:\/\/www.nasa.gov\/centers\/ames\/research\/technology-onepagers\/hc-computing.html &amp;nbsp;https:\/\/securityscorecard.com\/blog\/what-is-cyber-security-performance-management\/ &amp;nbsp; ","author_name":"BrakeSec Education Podcast","author_url":"https:\/\/www.youtube.com\/c\/BDSPodcast","html":"<iframe title=\"Libsyn Player\" style=\"border: none\" src=\"\/\/html5-player.libsyn.com\/embed\/episode\/id\/28119962\/height\/90\/theme\/custom\/thumbnail\/yes\/direction\/forward\/render-playlist\/no\/custom-color\/88AA3C\/\" height=\"90\" width=\"600\" scrolling=\"no\"  allowfullscreen webkitallowfullscreen mozallowfullscreen oallowfullscreen msallowfullscreen><\/iframe>","thumbnail_url":"https:\/\/assets.libsyn.com\/secure\/content\/161834636"}