LS-ISAO

Legal Services Information Sharing and Analysis Organization: a nonprofit hub sharing threat and vulnerability intel among law firms, for mutual defense

[Global Resilience Federation @GRFederation]

The Business Resilience Council will hold the 3rd Annual Virtual Summit on June 10, from 10am-4pm ET. The complimentary, multi-sector event features speakers discussing topics relevant to all-hazards threats. Sessions include:

-The Iranian War & Energy Market Impacts on US Allies

-Are We Already Behind? AI, Q-Day, and the Race for Resilience

-Mythos: Risk, Reward, and Project Glasswing’s Scope

-AI Interrupted and What to Do Next: a TTX After Action Review

More sessions to come!

Register here: https://t.co/QBuTgbMmi0

[Global Resilience Federation @GRFederation]

Now available for download is the October issue of the GRF monthly newsletter. In this issue you will find info about an upcoming webinar on incident recovery, an announcement about a new tool for GRF-affiliated members, and the incorporation of the Operational Resilience Framework into the Shared Assessments SIG, among other exciting news: https://t.co/sYpBuqkhdE

[Global Resilience Federation @GRFederation]

Thank you to the LS-ISAO Annual Gathering Sponsors and our Seat Drop Sponsor of the Summit on Security & Third-Party Risk. Without the support of these organizations this event could not exist. In-person engagement is critical for developing trust, advancing relationships, and strengthening our mutual resilience through collaboration. Attendees, be sure to stop by their booths to say hello next week! Summit homepage: https://t.co/d8mv9pxCfb

[LS-ISAO @LS_ISAO]

Join us for the LS-ISAO Annual Gathering! Paul Johnson and David White of Resiliam will present "AI Governance in Legal: Leveraging ISO 42001 for Compliance and Risk Mitigation.”

Session abstract: As law firms increasingly integrate AI into legal research, client service, and operational workflows, ISO/IEC 42001:2023 offers a structured framework for responsible AI governance. Leveraging this standard enables firms to meet evolving regulatory and contractual requirements, manage third-party AI vendor risks, and proactively address threats and vulnerabilities in AI-enabled systems. By adopting ISO 42001, legal practices can uphold ethical standards, ensure client confidentiality, and build trust in AI-powered services.

See you at the Palms in Las Vegas on November 5! Learn more and register here via the Summit on Security & Third-Party Risk, of which the LS-ISAO Annual Gathering is a part: https://t.co/hs3LqpC1LY

[LS-ISAO @LS_ISAO]

On November 17 at 2pm ET, join @LS_ISAO, @LowensteinLLP, @Holland_Knight and @ArmorText for the educational webinar “From Vendor Dependent to Crisis Ready: Joint Tabletops, OOB Comms, and Privilege that Holds Up.”

Register here: https://t.co/yBAHVErxEM

In this session, we walk through a realistic incident storyboard: a managed SOC flags malicious activity, the provider may also be compromised, and the firm’s primary channels (email/IDP/chat) can’t be trusted. What fails first, where privilege gets jeopardized, and how quickly can you pivot?

We’ll translate that scenario into a crisis playbook: counsel-directed, privilege-preserving communication patterns; minimum viable out-of-band (OOB) controls (E2EE, role scoping, immutable audit without content exposure); and clear decision rights across IT/Sec/PR/GC/ExCom.

We’ll cover the tough edge cases—secure communications when an MSP becomes adverse or is under investigation—and how to run joint tabletops (Firm–MSP–Client) that actually build muscle memory: onboarding externals fast, testing unknown-third-party joins, and measuring time-to-pivot OOB.

You’ll leave with practical templates for injects, comms decision trees, and readiness metrics you can reuse—for your organization and with your clients.

Co-led by technical and legal experts, this session prioritizes privilege, defensibility, and operational control—so you can keep working cases even when primary systems and providers are under stress.

Speakers include:

-Amy S. Mushahwar, Partner and Chair, Data Privacy, Security, Safety & Risk Management at Lowenstein Sandler

-Matthew B. Welling, Partner, Data Strategy, Security and Privacy at Holland & Knight

-Navroop Mitter, CEO of ArmorText

-Matt Calligan, Director of Growth Markets at ArmorText

*Self report an hour of CPE

*CLE credit provided by Lowenstein Sandler LLP
The firm is an accredited provider in California, New Jersey, and New York. If you are seeking credit in additional states, please indicate your jurisdiction on the Affirmation Survey that will be provided, and we will issue you a Uniform Certificate of Attendance.

[LS-ISAO @LS_ISAO]

Join us for the LS-ISAO Annual Gathering! Shankar Krishnan of @PromptArmor will present "Novel risks from AI in vendors: web-search DLP, MCP servers, indirect prompt injection and more."

Session abstract: Law firms are rapidly adopting AI vendors. But the gap between rapid innovation and risk reduction remains — how quickly can we identify the real new risks from new AI vendors and features? Learn more about the novel risks AI-enabled vendors carry - from the depths of indirect prompt injection to the various ways they can train on customer data. After this session, you will be able to confidently explain these risks in understandable terms to the rest of the business. You will be able to filter out which risks to care about, and which risks are overinflated. And you will understand how to use a comprehensive framework to evaluate vendors for novel AI risks. AI vendors carry many risks - across cybersecurity, data & privacy, legal, ethics, and more - and it is our goal to teach you how to stay up to date with the constantly evolving risk landscape.

See you at the Palms in Las Vegas on November 5! Learn more and register here via the Summit on Security & Third-Party Risk, of which the LS-ISAO Annual Gathering is a part: https://t.co/hs3LqpC1LY

[LS-ISAO @LS_ISAO]

Join LS-ISAO and Streaming Defense on October 8 for the webinar "Collective Defense in Action: How LS-ISAO Can Leverage Streaming Defense for Threat Sharing."

The Streaming Defense (SD) platform empowers ISAC communities to detect, analyze and respond to threats in real-time. SD enables continuous intelligence sharing, automated correlation of member data and coordinated response across the sector. Members will not just share information but will act on it, together with SD as the backbone, and raise the bar for collective defense.

Register here: https://t.co/1ziZkQYkrl

[LS-ISAO @LS_ISAO]

Join us for the LS-ISAO Annual Gathering! Register to attend the Gathering and the GRF Summit below!

[Global Resilience Federation @GRFederation]

One week left to book a room in the Summit block! This is the surest way to get the best price and assure you're in the conference hotel!

Learn more, register and book a room here: https://t.co/uMIF0D35cW

#cybersecurity #ai #riskmanagement #thirdpartyrisk

[Global Resilience Federation @GRFederation]

Join us for the 8th Annual Summit on Security & Third-Party Risk! Nick Panos of @googlecloud will present "Winning the Resilience Race: Outpacing Risk in the Age of AI and Automation."

Session abstract: The modern digital risk landscape is not just evolving—it is accelerating. Fueled by AI-powered threats, sophisticated supply chain attack techniques, and significant geopolitical volatility, the critical questions now revolve around when, and how often, major disruptions will occur. Traditional approaches to business continuity and cybersecurity are not enough to keep pace. The new imperative is cyber resilience: the ability to anticipate, withstand, recover from, and adapt to adverse conditions. This session moves beyond the buzzwords and delivers an actionable framework for building and accelerating digital resilience within your organization. We will discuss the key pillars of a modern resilience strategy, from proactive threat anticipation and defensible architecture to rapid response and adaptive recovery. Drawing on real-world case studies, you will learn how to shift your organization's mindset from reactive defense to proactive readiness, ensuring your critical business functions remain fortified against the next major disruption.

We hope to see you at the Palms in Las Vegas, November 3-5. Learn more and register here https://t.co/d8mv9pxCfb

[LS-ISAO @LS_ISAO]

The hotel room block closes in three weeks! LS-ISAO members, join your peers on November 5! The LS-ISAO Annual Gathering will take place on the last day of the GRF Summit on Security & Third-Party Risk, after other sessions conclude, so that members can fully attend both events. Contact Raquel Santiago with questions or register for both events by signing up for the summit here: https://t.co/3XaSTEBoC8. Book soon to stay on site.

[Global Resilience Federation @GRFederation]

Listen to Jim Routh, a former CSO/CISO at multiple Fortune 500 companies, discuss the benefits of attending the annual Summit on Security & Third-Party Risk.

Learn more and join us in Las Vegas from November 3-5, 2025: https://t.co/uMIF0D35cW

https://t.co/ByDwTcoBiu

[Global Resilience Federation @GRFederation]

Summit on Security & Third-Party Risk
Nov. 3-5  |  Las Vegas

Why Now: Tighten third-party risk, resilience, and compliance before 2026 audits and board meetings

Outcome: Peer-tested TPRM workflows and improvements & cybersecurity insights

CPEs: Attendees self-report 10+ hours of education

Who Attends: CISOs, CSOs, directors of cybersecurity and TPRM, compliance teams, risk managers, security analysts

Urgency: Four weeks until the room block closes and you have to stay offsite

Register: https://t.co/eeSAl0nDmS

[LS-ISAO @LS_ISAO]

In or around the Boston area? Join LS-ISAO and @CyberhavenInc for dinner at Smith & Wollensky at 6pm on Thursday, September 18th.

Space is limited! Those who register after the maximum capacity has been reached will be placed on a waitlist.

Register here: https://t.co/321qV6Fdrm

*Law firm attendees only. If you register and are unable to attend, please be sure to email [email protected].

[LS-ISAO @LS_ISAO]

LS-ISAO members, join your peers on November 5! The LS-ISAO Annual Gathering will take place on the last day of the GRF Summit on Security & Third-Party Risk, after other sessions conclude, so that members can fully attend both events. Contact Raquel Santiago with questions or register for both events by signing up for the summit here: https://t.co/3XaSTEBWrG

[Global Resilience Federation @GRFederation]

Agenda posted! Join Global Resilience Federation for the 8th Annual Summit on Security & Third-Party Risk at the Palms in Las Vegas, from November 3-5, 2025.

Attendees will gain an understanding of how organizations from different sectors are managing risk and leave the conference better armed to defend their company, regardless of its size or the maturity of its programs.

View the list of speakers and sessions here: https://t.co/eeSAl0nDmS

[Global Resilience Federation @GRFederation]

Join us for the 8th Annual Summit on Security & Third-Party Risk! Bill Nelson, former CEO of @FSISAC and founder of GRF, will present “25 Years of Information Sharing: Past, Present, and the Future of Collective Resilience.���

Session abstract: Bill played an instrumental leadership role in the growth of the information sharing and analysis center (ISAC) movement. As CEO of Financial Services ISAC, and later Global Resilience Federation, he was a pioneer in the development of collective defense, cross-sector sharing, and advancements in industry resilience. In this presentation he’ll discuss some of the key milestones in today’s security environment, from the advent of email threat lists, and the inception of the Traffic Light Protocol, to the launch of secure sharing portals and the movement into automated threat exchange. Reflecting on his long history in the threat information sharing industry, he will pose to the audience what he expects to be the greatest future threats and the ways in which we can work together to overcome them.

We hope to see you at the Palms in Las Vegas, November 3-5. Learn more and register here https://t.co/d8mv9pxCfb

*Note that registering for the summit covers a pass to see all presentations, as well food and drink from the evening of November 3 through the close of the summit on November 5.

[Global Resilience Federation @GRFederation]

Join us for the 8th Annual Summit on Security & Third-Party Risk! @stripe's Morgan Binder, Head of Third Party Risk, and Gary Donoghue, Business Resilience Manager, will present “Building Resilient Foundations: Establishing TPRM Excellence.”

Session abstract: Join us as we explore the essential foundations of a successful Third-Party Risk Management (TPRM) program. Discover best practices to build steadfast relationships with stakeholders and ensure clear communication throughout your TPRM initiatives. We'll share real-world examples that highlight organizations successfully managing third-party risks. Engage in an interactive Q&A to exchange ideas and solutions with fellow professionals in the industry. Whether you're embarking on a new TPRM journey or fine-tuning your existing program, this session will equip you with the confidence to manage complex third-party relationships and mitigate potential risks.

We hope to see you at the Palms in Las Vegas, November 3-5. Learn more and register here https://t.co/d8mv9pxCfb

*Note that registering for the summit covers a pass to see all presentations, as well food and drink from the evening of November 3 through the close of the summit on November 5.

[LS-ISAO @LS_ISAO]

Attend the Summit to hear them, and many others, and then stick around for the LS-ISAO Annual Gathering!

[Global Resilience Federation @GRFederation]

Join us for the 8th Annual Summit on Security & Third-Party Risk! Brenda Albeno of @Loeb_LoebLLP, Raenesia Jones of @DWTLaw, Ken Fishken of @LowensteinLLP, and Patrick Fennessey of Manatt, Phelps and Phillips, will present “Embedding an Effective Security Awareness Program into Your Organization's Culture.”

Session abstract: Most employees feel that security awareness training is boring and a waste of their time. Usually, employees are forced to listen to a canned video once a year and answer a few questions to make sure that they were paying attention. While this does meet most compliance requirements, this form of training is not enough to educate employees about the latest threats to their organization. Since security awareness training is a critical component to protecting an organization from potential financial and reputational damage, a taskforce known as the PHISH (Pretexting, Hacking, Impersonating and Scamming Humans) Committee, has been developed to provide a multifaceted approach to continuous training, for a better user experience. Join us for a lively panel discussion, where you will learn about various tools, tactics and techniques on how to make security awareness training more impactful, personal and entertaining.

We hope to see you at the Palms in Las Vegas, November 3-5. Learn more and register here https://t.co/d8mv9pxCfb

*Note that registering for the summit covers a pass to see all presentations, as well food and drink from the evening of November 3 through the close of the summit on November 5.

[Global Resilience Federation @GRFederation]

GRF analysts recently completed the semiannual ransomware report covering the first half of 2025. The report series tracks attacks based on public sources and conversations of threat actors in closed forums. Analysts compiled data on 2,940 successful attacks. Some key findings:

•Manufacturing was again the most targeted industry with 531 victims, a 69% increase from H2 2024. The next most targeted sector was Commercial Facilities with 459, a 50% increase from the last report.

•This is the seventh report in a row in which Manufacturing has been the most targeted industry.

•Cl0p was the most prolific actor with 415 successful attacks, followed by Akira with 261.

•Roughly matching the previous report, the United States was targeted by 62% of all ransomware attacks tracked by GRF analysts, with 18% directed at companies within the EU and UK.

•Re-extortion is becoming more common, Initial Access Brokers have become an integral part of actors’ process, and Endpoint Detection Killers are gaining popularity.

Read the full report: https://t.co/UZ3TYzvfkp