Featured News

The SEC's New Cybersecurity Rule: Heads' Up for CISOs

Cristin Flynn Goodwin, attorney and founder of Advancing Cyber and Advanced Cyber Law, discusses the new cybersecurity rules introduced by the U.S. Securities and Exchange Commission and their potential impact on CISOs of publicly traded companies. She emphasizes the importance of CISO advice, urging them to familiarize themselves with securities law and understand what constitutes a material incident that must be disclosed. As cyber threats and nation-state attacks continue to evolve, understanding these regulations is essential for maintaining digital security. Cristin Flynn Goodwin on the SEC Cybersecurity Rules | Nexus (nexusconnect.io)

Magazine cover titled 'How Democracies Spy on Their Citizens'.

Ronan Farrow: How Democracies Spy on Their Citizens, The New Yorker, April 25 and May 2, 2022

There is substantial evidence that Pegasus is being utilized in at least forty-five countries, with law-enforcement agencies in the United States and across Europe purchasing it and similar tools. Cristin Flynn Goodwin, a Microsoft executive who has spearheaded the company's efforts to combat spyware, noted, “The big, dirty secret is that governments are buying this stuff—not just authoritarian governments but all types of governments.” This raises important concerns regarding cybersecurity rules and the implications for digital security in the face of rising cyber threats, including nation-state attacks.

U.S. blacklists Israeli firm NSO Group over spyware concerns.

David Sanger, Nicole Perlroth: US Blacklists Israeli Firm NSO Group over Spyware, The New York Times, November 3, 2021

Cristin Goodwin, general manager of Microsoft’s digital security unit, described the new cybersecurity rules as “a strong step toward addressing the danger these actors pose, particularly in the face of rising cyber threats and nation-state attacks. We encourage other countries to adopt similar policies,” she added, emphasizing the importance of CISO advice in navigating these challenges.

SpyCast: Cyberattacks, Espionage & Ransomware – “Inside Microsoft’s Threat Intelligence Center (MSTIC)”, October 5, 2021

From your Visa card to your Outlook account, and from the gas you pump into your Ford to your Windows operating system, a cyber struggle is taking place all around us. In this episode, Andrew spoke to John Lambert, the founder of Microsoft’s threat hunting intelligence center, which tracks the world’s most dangerous cyber threats, including nation-state attacks and state-affiliated hackers. He was joined by Cristin Goodwin, the head of the Digital Security Unit, who provides essential security support to governments and collaborates closely with John’s team to share CISO advice and establish cybersecurity rules. Microsoft has billions of customers, serves millions of businesses, and works with almost every government department; to suggest that it has a significant role in information and intelligence is like saying it was a wise move to have bought shares when it first went public in 1986 (by June 2021, it was valued at 2 trillion dollars!).

Modern cybersecurity lab focused on fighting cyberweapons.

Microsoft on the Issues: Fighting Cyberweapons built by private businesses, July 15, 2021

Cristin Flynn Goodwin discusses Microsoft's groundbreaking disruption against the cyber mercenary actor Candiru, an Israeli-based company known for targeting politicians and civil society. This action highlights the importance of CISO advice in combating cyber threats and adhering to cybersecurity rules, especially against nation-state attacks. Microsoft is taking a stand against cyberweapons developed by private businesses to enhance digital security for all.

News and media

Digital text reading 'latest news' over a background of alphanumeric code.

Zelenskyy deepfake reflects new front in Ukraine conflict

March 22, 2022: Nation-state security specialists noted a significant increase in Russian intelligence gathering and research into forensic-security countermeasures during 2021. Cristin Goodwin, assistant general counsel for cybersecurity and digital trust at Microsoft, shared CISO advice in a webinar before the war, highlighting a "real concentrated effort, predominantly from Russia, to pursue interests in Ukraine.... From a nation-state attack perspective, Russia had a big year." This uptick in activity underscores the importance of adhering to cybersecurity rules to mitigate emerging cyber threats, as seen with the recent Zelenskyy deepfake, which reflects a new front in the ongoing conflict in Ukraine. | Information Age | ACS

Microsoft: Russia behind 58% of detected state-backed hacks

October 7, 2021: According to Cristin Goodwin, who leads Microsoft’s Digital Security Unit focused on nation-state actors, overall, nation-state hacking has a success rate of about 10%-20%. This highlights the importance of following cybersecurity rules and implementing CISO advice to mitigate cyber threats. Notably, Microsoft reported that Russia is responsible for 58% of detected state-backed hacks.

Nation state cyber-attacks against critical infrastructure doubled in the past 12 months

November 7, 2022: "Before the invasion of Ukraine, governments believed that to ensure digital security, data had to remain within national borders. However, following the invasion, CISO advice now emphasizes the importance of migrating data to the cloud as part of resiliency planning and effective governance. This shift is crucial in the face of increasing cyber threats, as nation-state attacks against critical infrastructure have doubled in the past 12 months," said Cristin Flynn Goodwin, associate general counsel for customer security & trust at Microsoft. - Spiceworks

Why we should care about cyberspace

On October 27, 2022, Cristin Flynn Goodwin, general manager and associate general counsel of Microsoft's Digital Security Unit, shared crucial CISO advice regarding two straightforward approaches enterprises can adopt to bolster their defenses against cyber threats.

"First, it's essential to discuss cybersecurity rules such as security basics, security hygiene, multi-factor authentication, and patching, because these aspects matter significantly. They represent the low hanging fruit that all cybercriminals and nation-state attacks exploit. Why invest in an elaborate, high-tech Mission Impossible style attack when you can simply exploit an unlocked back door?"

Hackers of SolarWinds stole data on US sanctions policy, intelligence probes

October 8, 2021: In an annual threat-review paper released on Thursday, Microsoft highlighted ongoing cyber threats, revealing that Russian spies were primarily seeking government material related to sanctions and other Russia-related policies, as well as U.S. methods for catching Russian hackers, which aligns with essential CISO advice for enhancing digital security against nation-state attacks.

Cristin Goodwin, general manager of Microsoft’s Digital Security Unit, explained that the company based its conclusions on the types of customers and accounts targeted by these cyber attackers. In these situations, she told Reuters, “You can infer the operational aims from that.” Hackers of SolarWinds stole data on U.S. sanctions policy, emphasizing the need for robust cybersecurity rules to protect sensitive information.

Microsoft exposes tactics of European mercenary spyware broker

July 27, 2022: "The NSO Group is the canonical example, but there are other companies included on the US Department of Commerce Entities List and a myriad of others that are selling these services that are not yet included on the List," Microsoft's Cristin Flynn Goodwin said in written testimony to the hearing. She also emphasized the importance of CISO advice in navigating the complex landscape of cyber threats and adhering to evolving cybersecurity rules. This is particularly relevant as organizations face increasing risks from nation-state attacks and must prioritize digital security measures to protect against such threats. Microsoft exposes tactics of European mercenary spyware brokers | SC Media (scmagazine.com)

Nation-state cyberattacks aren't going away. here's how to defend against them

January 12, 2022: "While the tools and techniques may evolve, the goals of nation-state actors remain unchanged: collecting as much intelligence as possible from governments, think tanks, NGOs, policy firms, and other relevant entities to benefit the government attackers," said Cristin Goodwin, Microsoft’s associate general counsel and general manager of the digital security unit. "This reflects more traditional nation-state activity, as these actors target areas where they can gain critical information. These operations are fundamentally intelligence-driven, highlighting the ongoing cyber threats posed by nation-state attacks. As CISO advice suggests, developing effective cybersecurity rules is essential for defending against these persistent threats."

Report: NSO Group's spyware is everywhere

April 18, 2022: 'The big, dirty secret is that governments are purchasing this technology — not just authoritarian governments but all types of governments,' Microsoft executive Cristin Flynn Goodwin tells Farrow. As highlighted in the report on NSO Group's spyware, this raises significant concerns for CISOs as they navigate cybersecurity rules amidst increasing cyber threats and nation-state attacks that pose risks to digital security.

Microsoft Windows security warning as multiple 0Days used in attacks on business users

July 28, 2022: Microsoft has confirmed the serious nature of this 0Day vulnerability, especially in the face of increasing cyber threats. Cristin Goodwin, the general manager at Microsoft's Digital Security Unit, stated, "We observed attacks targeting law firms, banks, and strategic consultancies in countries such as Austria, the United Kingdom, and Panama." This situation underscores the importance of following cybersecurity rules and seeking CISO advice to protect against potential nation-state attacks.

Pardon the "intrusion": Advancing the dialogue on export controls and intrusion software

September 20, 2016: Cristin's blog discusses the influence of intrusion software on cybersecurity rules in Europe. This topic is crucial for CISOs as they navigate the complexities of digital security and address growing cyber threats and nation-state attacks. Pardon the 'intrusion': advancing the dialogue on export controls and 'intrusion software' - EU Policy Blog (microsoft.com)

Export control and cybersecurity

July 24, 2015: CSIS Panel on the Wassenaar Arrangement's cybersecurity rules regarding intrusion software controls, which impact security responders and researchers. This event also discusses CISO advice for navigating the complexities of digital security in the face of evolving cyber threats and nation-state attacks. Decoding the BIS Proposed Rule for Intrusion Software Platforms | CSIS Events

Video

Secret Squirrels and Flashlights: Legal Risks and Threat Intelligence - Keynote SANS CTI Summit

As threat intelligence matures into a more traditional security discipline and companies seek to better protect customers through threat intel products and services, there are growing pains. Often, those pains come when the freedom of the analyst intersects with the law, corporate promises, or contracts. In this talk, we’ll explore those boundaries, and discuss strategies to help threat intelligence analysts identify and manage legal risks while hunting, investigating, and responding. We'll think about the role of lawyers on your threat intelligence team. We will also consider legal consequences in information sharing, incident response, working with third parties, government engagements, and technology choices.

BlueHat 2023: Stronger Together: Celebrating the Researcher Community

Stephanie Calabrese, Principal PM Manager, MSRC moderated the Stronger Together: Celebrating the Research Community panel with Microsoft leaders David Westin (VP, Enterprise and OS Security), Dr. Andre Alfred (Partner Director of PM, Azure Security), Cristin Goodwin (Associate General Counsel), and Dr. Abhilasha Bhargav-Spantzel (Partner Security Architect). The panel focused on Microsoft’s partnership with the security research community, along with topics on legal and regulatory oversight in incident response, the role of diversity and inclusion in security, confidential computing, and the importance of disruption and new ways of thinking to build secure systems.

Microsoft Ignite: Understanding Nation State Threats

The last 12 months have been marked by historic geopolitical events and challenges that have changed the way organizations approach their daily operations. During this time, nation state actors have created new tactics and techniques to evade detection and increase the scale of their attacks. In this session Cristin Goodwin, Associate General Counsel and head of Microsoft’s Digital Security Unit, explains the nation state threat landscape and provides context for security leaders and practitioners who are looking to better understand the relevancy of these new threats.

Decoding Nobelium: Episode 3 - Countermeasures

Learn what it took to respond to the most advanced nation-state attack in history. Hear directly from the Microsoft defenders who helped customers repel NOBELIUM—and gain actionable insights for your organization’s cybersecurity strategy.

Decoding Nobelium - Episode 4 - After action report

Now that the investigation has concluded, receive a full report on NOBELIUM’s unprecedented attack strategy and novel techniques from the threat experts who were there. Find out how NOBELIUM is part of a trend that’s changing cybersecurity forever and learn how to prepare your organization for the next wave of nation-state attacks.

Rights Con: Fireside Chat on Crisis Points and Paths Forward

Join Michael Hull, Cristin Flynn Goodwin and Anastasiya Zhyrmont in conversation with facilitator Richard Gaines for a fireside chat on strengthening private sector partnerships with civil society in response to authoritarian transitions, military takeovers, and political instability. Speakers will discuss the importance of corporate policies that offer transparency into how platforms manage requests from government authorities that lack legitimacy or perpetrate severe human rights abuses, and the need for channels and mechanisms to connect activists with companies during moments of crisis, when crucial decisions around blocking or restricting access to services are being made. Speakers: Cristin Flynn Goodwin, General Manager, Digital Security Unit, Microsoft Anastasiya Zhyrmont, Campaigner, Eastern Europe & Central Asia, Access Now Michael Hull, President, Psiphon Hosted by: Richard Gaines, Senior Human Rights Advocacy Manager, Wikimedia Foundation

Middle East Institute Cyber Conference

Cristin's closing keynote on nation state threats at the Middle East Institute Cyber Conference.

Pacific Forum's United States-Singapore Cyber & Tech Security Virtual Series

The first public session of Pacific Forum's United States-Singapore Cyber & Tech Security Virtual Series, held with support from the US Embassy Singapore on November 17,2020 (USA)/November 18, 2020 (Asia) Featuring: Benjamin Ang, Senior Fellow, RSIS Cristin Goodwin, Assistant General Counsel, Microsoft

RSA Conference 2020: Nation State actors v. Your Legal Team

Moderator: Steve Black, Professor of Law, Texas Tech University School of Law Panelists: Cristin Goodwin, Assistant General Counsel, Microsoft Brian Levine, Managing Director, Transactions Cyber Group, Ernst & Young Fighting nation-states and advanced actors requires a bigger toolbox, with lawyers and tech teams working together. Panelists Cristin Goodwin, Microsoft’s assistant general counsel for cybersecurity, and Brian Levine, DOJ’s former lead cyber-prosecutor, will discuss inside and outside threats, private vs. government action, and how legal teams can enable clients to defend against advanced actors.

RSA Conference 2020: Am I allowed to subvert machine learning for fun?

Moderator: Ram Shankar Siva Kumar, Data Cowboy, Microsoft/Harvard Panelists: Nicholas Carlini, Research Scientist, Google Brain Betsy Cooper, Director, Aspen Tech Policy Hub, Aspen Institute Cristin Goodwin, Assistant General Counsel, Microsoft When your machine learning (ML) system is attacked, what legal remedies can you seek? Has your terms of service even been updated to account for such attacks? If you’re an attacker, what risks are you assuming? This panel’s goal will be to convey the definitional challenges that attacks on ML systems pose in cybercrime, copyright and product liability law, and their impact on organizations and society.Pre-Requisites: The panel is aimed at policy and legal professionals with little to no understanding of Machine learning. All the pre-reqs are self contained. At the beginning of each section, we go through the attack - and then dissect it.