Week in Review: Tik Tok’s return, Noem’s CISA plans, failed startup risks
Jan 24, 2025
auto_awesome
Shaun Marion, VP and CSO at Xcel Energy, dives into critical cybersecurity topics. He discusses the national security implications of TikTok's usage, stressing the need for privacy measures without outright bans. The conversation highlights foundational cybersecurity practices and the vulnerabilities startups face. Marion also addresses the challenges security professionals encounter in conflicts, especially regarding remote access systems. Lastly, he emphasizes user control in data sharing and the role of CISOs in fostering communication with leadership.
TikTok's uncertain future in the U.S. highlights a troubling trend where users may prioritize social media access over their personal data security.
Christy Noem's proposed changes to CISA reflect an effort to enhance cybersecurity focus while balancing the need for local outreach support.
Deep dives
TikTok's Uncertain Status and User Response
The popular video platform TikTok faces a precarious future in the U.S., having been temporarily banned due to a Supreme Court ruling that upheld the constitutionality of a regulating law. Although the ban was lifted by the government, TikTok is under a 90-day period during which it may be required to find a buyer or face a partnership with an American company. Interestingly, many users identified as 'TikTok refugees' explored alternative platforms like Red Note and Lemon 8, despite them being associated with similar data security concerns. This situation highlights a growing cyber risk where users might prioritize access to social media over their personal data security, often against better judgement.
Proposed Changes to CISA's Mandate
Christy Noem, the nominee for the Department of Homeland Security, has expressed intentions to streamline the Cybersecurity and Infrastructure Security Agency (CISA) by narrowing its focus on protecting critical infrastructure. She criticized the agency for straying from its core mission, suggesting that its involvement in combating misinformation may dilute its effectiveness. While there is potential for a more focused CISA to enhance cybersecurity, concerns arose regarding potential setbacks in local outreach efforts that currently assist educational institutions. This initiative reflects a balancing act between maintaining broad national cybersecurity measures and refining specific operational objectives to improve overall effectiveness.
Risks Associated with Failed Startups
Research revealed that employees of defunct startups are at a heightened risk of data breaches due to cybercriminals purchasing their abandoned domains to gain unauthorized access to cloud accounts. A case study demonstrated how a security researcher managed to exploit a failed startup's domain to log into multiple services like ChatGPT and Slack, compromising sensitive information, including personal identification data. This scenario underscores a persistent issue in cybersecurity: the lack of account management practices that include deactivating licenses and purging email access for former employees. Organizations need to prioritize basic cybersecurity measures to prevent such vulnerabilities that are increasingly exploited by attackers.
Security Oversights in Automotive Tracking Systems
Significant vulnerabilities were uncovered in Subaru's Starlink system, allowing unauthorized access to vehicle tracking information, including precise locations of cars. A security researcher successfully demonstrated these flaws by gaining control over functions such as unlocking a vehicle and starting its ignition without appropriate safeguarding measures in place. This incident raises important questions about user consent and the ethical implications of tracking technology, as customers likely do not foresee such intrusive capabilities tied to their ownership of a vehicle. The shortcomings highlight a need for automakers to prioritize transparency and proactive security measures in their technology to protect users from potential abuses.
Do you know the status of your compliance controls right now? Like…right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs…we rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you get security questionnaires done 5 times faster with AI. Now that’s…a new way to GRC. Get started at Vanta.com/headlines.
All links and the video of this episode can be found on CISO Series.com
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode