Compliance Stuff

What is it with universities in "M" states these days? Last week, it was the University of Michigan.  Now, it’s the University of Mississippi. A federal judge in Mississippi  ruled recently  that a race discrimination lawsuit filed by a former employee of Ole Miss will go to trial. The only surprise here is that the University even thought it had a shot at summary judgment. (My guess is that this was a "desperation" motion.) Here’s what happened. The school was hiring an intervention specialist for a student substance abuse program. Apparently most of those served by the program were white, fratty kids. Solo cup abuse? Our plaintiff (we’ll call her Dolores), a Black female, was one of three candidates for the intervention specialist position. She alleged that during her job interview, her future boss (we’ll call her Natalie) told Dolores that she really hoped to have a white male in the position. Natalie, who like Dolores is a Black female, denies having said this, ...

On November 13, AI company Anthropic reported that its Threat Intelligence team had disrupted a state‑sponsored Chinese threat actor conducting what is believed to be the first largely autonomous AI‑orchestrated cyber espionage campaign. The threat actor used Claude Code with autonomous agentic orchestration to execute the majority of the intrusion life cycle— reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration—across multiple global sectors . Claude Code is a developer-focused variant of the Claude large language model created by Anthropic , designed to function as an advanced, agentic coding assistant that automates complex software development. The key technical aspects of the campaign reveal that the AI agent autonomously carried out approximately 80 percent to 90 percent of all operational tasks . Human operators were responsible for selecting targets and giving strategic approvals, while the AI handled the majority of the tactical action...

  A new report published by the software company Egress this month,   Phishing Threat Trends Report ,  is a must-read. It outlines the proliferation of phishing toolkits on the dark web (that basically allows any Tom, Dick, and Harry Hacker) to launch successful phishing campaigns, how “commodity phishing attacks are overwhelming security teams,” the anatomy of advanced persistent threats, the most prolific phishing tactic in 2024, and how AI-assisted attacks are becoming more challenging to detect. Presently, I would like to focus on one piece of the Egress report that is near and dear to me:, the latest phishing tactics. Phishing continues to be one of the most prevalent c auses of security incidents and data breaches . There are some fascinating statistics in the report for all of us to process and internalize. First, the “most phished day of the year so far” was June 10th, 2024, and the most common time to receive a phishing email is at 12:37 p.m. This means that we ...

When a company’s board of directors is faced with the decision to respond publicly to or support a political situation or issue, in most cases the answer should be easy: “No comment.” The bottom line is that a board should avoid controversy that could adversely affect its business. However, there has been increasing pressure on boards to respond to political issues, especially coming from employees and customers. If faced with such circumstances, a board must first consider how important or marginal the pressure to speak is, and who is it coming from. In addition, there are several guidelines a board should follow if they feel like they “must” respond to a controversial political issue: You cannot “wing it.” Ad hoc decisions lead the board, and therefore the company, to look confused. You must carefully plan what you will say. Advance planning what you will say, and also to whom and how, is absolutely necessary. Some considerations are: Who will be the company spokesperson? What is the...