Connect with us

Tech

CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly

Published

on

CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly


Today, the role of chief information security officer (CISO) role has transcended traditional boundaries, moving beyond managing firewalls and compliance checklists. The current landscape, marked by an upsurge in regulatory scrutiny and lawsuits against individual CISOs, demands a new approach.

To navigate this challenging environment, the CISO must become a legal sentinel, meticulously documenting decisions and establishing a verifiable defence of “due care” to protect both the enterprise and themselves from legal repercussions.

The paradox is that the more visibility CISOs have gained, the greater their legal exposure becomes. The solution lies in governance by design, a strategic approach that aligns cyber controls, risk metrics and executive communication around transparency and accountability to build trust among regulators, customers and investors. Governance by design is a proactive approach that integrates legal considerations into every aspect of cyber security strategy and decision-making, ensuring that the organisation is always prepared for legal scrutiny. In essence, cyber resilience and legal defensibility are now two sides of the same coin.

The legal landscape: Why CISOs are in the crosshairs

CISOs traditionally operated behind the scenes, focusing on threat prevention and response as technologists. Today, regulators expect CISOs to demonstrate not only technical competence but also governance maturity, ethical decision-making and transparency.  Cyber security laws, such as the SEC’s Cyber Disclosure Rules, the EU’s General Data Protection Regulation (GDPR) and state-level privacy acts like California Consumer Privacy Act (CCPA), impose explicit duties on organisations to report breaches promptly, maintain reasonable safeguards and ensure transparency in disclosures.

When organisations fail to meet these obligations, regulators and investors increasingly look to the CISO as the responsible executive. We can see this in class-action lawsuits that now routinely name CISOs as defendants, especially when plaintiffs allege that executives ignored warnings, underfunded security programmes or misled stakeholders.

The CISO’s emails, reports, and board presentations often become evidence in litigation, making documentation and communication practices critical risk factors in their own right. The CISO’s defence rests on demonstrating due diligence, proving that they provided the board with accurate risk assessments and reasonable security measures were implemented, given the company’s resources and risk profile.

Protecting the organisation: Legal foresight as a security control

To protect the enterprise, CISOs must adopt a dual-lens mindset: one focused on risk reduction through technical and operational controls, and another geared to legal defensibility. Several best practices help balance these priorities, ensuring that legal implications are considered in every security decision.

  • Embed legal awareness in cyber strategy: By integrating legal counsel into incident response, risk assessment, tabletop exercises, data protection impact assessments and vendor management discussions, security leaders can ensure that regulatory implications are understood before crises occur.
  • Build a defensible documentation trail: CISOs must document major security decisions, such as risk acceptance, budget trade-offs and vendor selections, along with the rationale, as these records become invaluable in proving due diligence if an incident leads to regulatory review or litigation.
  • Adopt a “disclosure-ready” posture: Ensuring that systems are in place for early breach detection, internal escalation and timely communication to leadership is crucial. This transparency, when clearly implemented, can mitigate reputational and legal fallout.
  • Implement continuous oversight and board reporting: Presenting regular security briefings to the board that focus on measurable risk indicators, rather than just providing technical updates, helps drive accountability and distribute liability more equitably across governance layers.

Protecting the CISO: Personal legal safety nets

As accountability grows, CISOs must treat their personal risk exposure as part of professional hygiene. The following safeguards are now essential components of an executive’s toolkit:

  • Directors and officers (D&O) insurance cover: CISOs must ensure that their comprehensive D&O insurance explicitly includes cyber security-related claims and personal indemnification clauses that specifically address the CISO role. 
  • Document and escalate material risks: If CISOs identify systemic weaknesses, such as a lack of funding, unpatched legacy systems, or noncompliance, they must formally escalate these risks to leadership and record the communication, as silence or informal discussions can later be construed as negligence.
  • Establish a personal legal relationship: In high-stakes scenarios, the company’s counsel represents the organisation, not the individual. CISOs should have access to independent legal advice when handling investigations or disclosure decisions involving personal accountability.
  • Maintain ethical and transparent communication: Misrepresentation is often the catalyst for prosecution. When briefing executives or regulators, the CISO must ensure that all statements are factual and appropriately qualified. Overpromising on security posture or mischaracterising an incident can backfire.
  • Foster a culture of shared responsibility: The CISO should advocate that cyber security is a collective enterprise responsibility, not a siloed function. Embedding security accountability across engineering, operations and business units helps dilute individual liability and strengthen overall resilience.

Summing up

The CISO operates in one of the most demanding roles in the modern economy. Their technical expertise is what builds the defensive wall, but their diligence in governance and documentation is what creates the legal fort. By integrating legal foresight into cyber strategy, documenting transparent governance and securing personal protection, CISOs can transform potential liability into institutional resilience. CISOs must consistently demonstrate a defensible standard of reasonable security and absolute transparency to lead their organisation through an age defined by digital risk and legal scrutiny. Cyber security leadership is no longer just about protecting systems, it’s about protecting the people who defend the organisation including the CISO and their team.

Aditya K Sood is vice president of security engineering and AI strategy at Aryaka.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Epstein Files Reveal Peter Thiel’s Elaborate Dietary Restrictions

Published

on

Epstein Files Reveal Peter Thiel’s Elaborate Dietary Restrictions


Peter Thiel—the billionaire venture capitalist, PayPal and Palantir cofounder, and outspoken commentator on all matters relating to the “Antichrist”—appears at least 2,200 times in the latest batch of files released by the Department of Justice related to convicted sex offender and disgraced financier Jeffrey Epstein.

The tranche of records demonstrate how Epstein managed to cultivate an extensive network of wealthy and influential figures in Silicon Valley. A number of them, including Thiel, continued to interact with Epstein even after his 2008 guilty plea for solicitation of prostitution and of procurement of minors to engage in prostitution.

The new files show that Thiel arranged to meet with Epstein several times between 2014 and 2017. “What are you up to on Friday?” Thiel wrote to Epstein on April 5, 2016. “Should we try for lunch?” The bulk of the communications between the two men in the data dump concern scheduling meals, calls, and meetings with one another. Thiel did not immediately return a request for comment from WIRED.

One piece of correspondence stands out for being particularly bizarre. On February 3, 2016, Thiel’s former chief of staff and senior executive assistant, Alisa Bekins, sent an email with the subject line “Meeting – Feb 4 – 9:30 AM – Peter Thiel dietary restrictions – CONFIDENTIAL.” The initial recipient of the email is redacted, but it was later forwarded directly to Epstein.

The contents of the message are also redacted in at least one version of the email chain uploaded by the Justice Department on Friday. However, two other files from what appears to be the same set of messages have less information redacted.

In one email, Bekins listed some two dozen approved kinds of sushi and animal protein, 14 approved vegetables, and 0 approved fruits for Thiel to eat. “Fresh herbs” and “olive oil” were permitted, however, ketchup, mayonnaise, and soy sauce should be avoided. Only one actual meal was explicitly outlined: “egg whites or greens/salad with some form of protein,” such as steak, which Bekins included “in the event they eat breakfast.” It’s unclear if the February 4 meeting ultimately occurred; other emails indicate Thiel got stuck in traffic on his way to meet Epstein that day.

According to a recording of an undated conversation between Epstein and former Israeli Prime Minister Ehud Barak that was also part of the files the DOJ released on Friday, Epstein told Barak that he was hoping to meet Thiel the following week. He added that he was familiar with Thiel’s company Palantir, but proceeded to spell it out loud for Barak as “Pallentier.” Epstein speculated that Thiel may put Barak on the board of Palantir, though there’s no evidence that ever occurred.

“I’ve never met Peter Thiel, and everybody says he sort of jumps around and acts really strange, like he’s on drugs,” Epstein said at one point in the audio recording, referring to Thiel. The former prime minister expressed agreement with Epstein’s assessment.

In 2015 and 2016, Epstein put $40 million in two funds managed by one of Thiel’s investment firms, Valar Ventures, according to The New York Times. Epstein and Thiel continued to communicate and were discussing meeting with one another as recently as January 2019, according to the files released by the DOJ. Epstein committed suicide in his prison cell in August of that year.

Below are Thiel’s dietary restrictions as outlined in the February 2016 email. (The following list has been reformatted slightly for clarity.)

APPROVED SUSHI + APPROVED PROTEIN

  • Kaki Oysters
  • Bass
  • Nigiri
  • Beef
  • Octopus
  • Catfish
  • Sashimi
  • Chicken
  • Scallops
  • Eggs
  • Sea Urchin
  • Lamb
  • Seabass
  • Perch
  • Spicy Tuna w Avocado
  • Squid
  • Turkey
  • Sweet Shrimps
  • Whitefish
  • Tobiko
  • Tuna
  • Yellowtail
  • Trout

APPROVED VEGETABLES

  • Artichoke
  • Avocado
  • Beets
  • Broccoli
  • Brussels sprouts
  • Cabbage
  • Carrots
  • Cucumber
  • Garlic
  • Olives
  • Onions
  • Peppers
  • Salad greens
  • Spinach

APPROVED NUTS

  • Anything unsalted and unroasted
  • Peanuts
  • Pecans
  • Pistachios

CONDIMENTS

  • Most fresh herbs, and olive oil

AVOID

  • Dairy
  • Fruits
  • Gluten
  • Grains
  • Ketchup
  • Mayo
  • Mushroom
  • Processed foods
  • Soy Sauce
  • Sugar
  • Tomato
  • Vinegar

MEAL SUGGESTIONS

  • Breakfast Egg whites or greens/salad with some form of protein (Steak etc)



Source link

Continue Reading

Tech

Elon Musk Is Rolling xAI Into SpaceX—Creating the World’s Most Valuable Private Company

Published

on

Elon Musk Is Rolling xAI Into SpaceX—Creating the World’s Most Valuable Private Company


Elon Musk’s rocket and satellite company SpaceX is acquiring his AI startup xAI, the centibillionaire announced on Monday. In a blog post, Musk said the acquisition was warranted because global electricity demand for AI cannot be met with “terrestrial solutions,” and Silicon Valley will soon need to build data centers in space to power its AI ambitions.

“In the long term, space-based AI is obviously the only way to scale,” Musk wrote. “The only logical solution therefore is to transport these resource-intensive efforts to a location with vast power and space. I mean, space is called ‘space’ for a reason.”

The deal, which pulls together two of Musk’s largest private ventures, values the combined entity at $1.25 trillion, making it the most valuable private company in the world, according to a report from Bloomberg.

SpaceX was in the process of preparing to go public later this year before the xAI acquisition was announced. The space firm’s plans for an initial public offering are still on, according to Bloomberg.

In December, SpaceX told employees that it would buy insider shares in a deal that would value the rocket company at $800 billion, according to The New York Times. Last month, xAI announced that it had raised $20 billion from investors, bringing the company’s valuation to roughly $230 billion.

This isn’t the first time Musk has sought to consolidate parts of his vast business empire, which is largely privately owned and includes xAI, SpaceX, the brain interface company Neuralink, and the tunnel transportation firm the Boring Company.

Last year, xAI acquired Musk’s social media platform, X, formerly known as Twitter, in a deal that valued the combined entity at more than $110 billion. Since then, xAI’s core product, Grok, has become further integrated into the social media platform. Grok is featured prominently in various X features, and Musk has claimed the app’s content-recommendation algorithm is powered by xAI’s technology.

A decade ago, Musk also used shares of his electric car company Tesla to purchase SolarCity, a renewable energy firm that was run at the time by cousin Lyndon Rive.

The xAI acquisition demonstrates how Musk can use his expansive network of companies to help power his own often grandiose visions of the future. Elon Musk said in the blog post that SpaceX will immediately focus on launching satellites into space to power AI development on Earth, but eventually, the space-based data centers he envisions building could power civilizations on other planets, such as Mars.

“This marks not just the next chapter, but the next book in SpaceX and xAI’s mission: scaling to make a sentient sun to understand the Universe and extend the light of consciousness to the stars,” Musk said in the blog post.



Source link

Continue Reading

Tech

HHS Is Using AI Tools From Palantir to Target ‘DEI’ and ‘Gender Ideology’ in Grants

Published

on

HHS Is Using AI Tools From Palantir to Target ‘DEI’ and ‘Gender Ideology’ in Grants


Since last March, the Department of Health and Human Services has been using AI tools from Palantir to screen and audit grants, grant applications, and job descriptions for noncompliance with President Donald Trump’s executive orders targeting “gender ideology” and anything related to diversity, equity, and inclusion (DEI), according to a recently published inventory of all use cases HHS had for AI in 2025.

Neither Palantir nor HHS has publicly announced that the company’s software was being used for these purposes. During the first year of Trump’s second term, Palantir earned more than $35 million in payments and obligations from HHS alone. None of the descriptions for these transactions mention this work targeting DEI or “gender ideology.”

The audits have been taking place within HHS’s Administration for Children and Families (ACF), which funds family and child welfare and oversees the foster and adoption systems. Palantir is the sole contractor charged with making a list of “position descriptions that may need to be adjusted for alignment with recent executive orders.”

In addition to Palantir, the startup Credal AI—which was founded by two Palantir alumni—helped ACF audit “existing grants and new grant applications.” The “AI-based” grant review process, the inventory says, “reviews application submission files and generates initial flags and priorities for discussion.” All relevant information is then routed to the ACF Program Office for final review.

ACF staffers ultimately review any job descriptions, grants, and grant applications that are flagged by AI during a “final review” stage, according to the inventory. It also says that these particular AI use cases are currently “deployed” within ACF, meaning that they are actively being used at the agency.

Last year, ACF paid Credal AI about $750,000 to provide the company’s “Tech Enterprise Generative Artificial Intelligence (GenAI) Platform,” but the payment descriptions in the Federal Register do not mention DEI or “gender ideology.”

HHS, ACF, Palantir, and Credal AI did not return WIRED’s requests for comment.

The executive orders—Executive Order 14151, “Ending Radical and Wasteful Government DEI Programs and Preferencing,” and Executive Order 14168, “Defending Women From Gender Ideology Extremism and Restoring Biological Truth to the Federal Government”—were both issued on Trump’s first day in office last year.

The first of these orders demands an end to any policies, programs, contracts, grants that mention or concern DEIA, DEI, “equity,” or “environmental justice,” and charges the Office of Management and Budget, the Office of Personnel Management, and the attorney general with leading these efforts.

The second order demands that all “interpretation of and application” of federal laws and policies define “sex” as an “immutable biological classification” and define the only genders as “male” and “female.” It deems “gender ideology” and “gender identity” to be “false” and “disconnected from biological reality.” It also says that no federal funds can be used “to promote gender ideology.”

“Each agency shall assess grant conditions and grantee preferences and ensure grant funds do not promote gender ideology,” it reads.

The consequences of Executive Order 14151, targeting DEI, and Executive Order 14168, targeting “gender ideology,” have been felt deeply throughout the country over the past year.

Early last year, the National Science Foundation started to flag any research that contained terms associated with DEI—including relatively general terms, like “female,” “inclusion,” “systemic,” or “underrepresented”—and place it under official review. The Centers for Disease Control and Prevention began retracting or pausing research that mentioned terms like “LGBT,” “transsexual,” or “nonbinary,” and stopped processing any data related to transgender people. Last July, the Substance Abuse and Mental Health Services Administration removed an LGBTQ youth service line offered by the 988 Suicide & Crisis Lifeline.



Source link

Continue Reading

Trending