In this episode of Nine to Thrive HR, host Cindi Koetzle interviews Dr. Mohamed Lazzouni, Chief Technology Officer at Aware, about the integration of biometric technology in HR practices. Dr. Lazzouni provides an accessible breakdown of biometrics, addressing both its applications and ethical considerations, such as consent and privacy. He discusses how biometric data like facial and voice recognition can enhance security and streamline processes like identity verification, onboarding, and credentialing in remote work environments. Emphasizing the technology’s accessibility and affordability, Dr. Lazzouni highlights the potential for companies, even smaller or evolving HR departments, to adopt these tools for operational efficiency and to foster employee trust and data security. The conversation wraps up with practical insights on how companies can implement these biometric solutions with ease, thus enhancing security, operational speed, and employee retention. 

Nine To Thrive HR

Enhancing Trust and Security in HR: The Role of Biometrics

Google's Gemini chatbot has recently been equipped with a memory feature that allows it to remember user preferences, similar to the memory features introduced by OpenAI's ChatGPT and Microsoft's Copilot. This feature enables Gemini to deliver more tailored responses by recalling user interests and preferences, potentially creating a more personalized experience. While Google assures users that their "memories" will not be used for training, security concerns remain, as demonstrated by the recent discovery that ChatGPT's memory function can be manipulated to plant false memories and potentially steal user data. This highlights the need for robust security measures and ethical guidelines as AI technologies continue to evolve.

Gemini Memory

On November 8, the California Privacy Protection Agency (CPPA) voted 5-0 to approve new regulations to implement the DELETE Act of 2023. The most noteworthy development was the agency’s adoption of a new definition of ​“direct relationship,” a core term within the statutory definition of a ​“data broker.” The new definition could require a host of new businesses to register as data brokers if they collect personal data about their customers from other sources and sell that data to third parties, including in an ad tech context.

https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/california-privacy-protection-agency-expands-the-definition-of-data-broker

Alysa Hutnik
ahutnik@kelleydrye.com
(202) 342-8603
www.kelleydrye.com/people/alysa-z-hutnik

Aaron Burstein
aburstein@kelleydrye.com
(202) 342-8671
www.kelleydrye.com/people/aaron-j-burstein

Chris Tarbell
ctarbell@kelleydrye.com
(202) 342-8813
https://www.kelleydrye.com/people/christopher-s-tarbell

Alex Schneider
aschneider@kelleydrye.com
(202) 342-8634
www.kelleydrye.com/people/alexander-i-schneider

Hosted by Simone Roach

Subscribe to the Ad Law Access blog - www.kelleydrye.com/subscribe

Subscribe to the Ad Law News Newsletter - www.kelleydrye.com/subscribe

View the Advertising and Privacy Law Resource Center - www.kelleydrye.com/advertising-and-privacy-law

Find all of our links here linktr.ee/KelleyDryeAdLaw

California Privacy Protection Agency Expands The Definition Of "Data Broker"

The Kiteworks 2025 Forecast for Managing Private Content Exposure Risk Report offers a comprehensive analysis of emerging cybersecurity and compliance trends shaping the year ahead. The report identifies 12 pivotal trends affecting how organizations manage private content exposure risk, highlighting critical areas like data privacy regulations, software supply chain security, AI governance, and quantum computing threats. With 75% of the world's population expected to have their personal data protected under privacy laws by 2025, organizations must implement robust strategies to mitigate risks and ensure compliance.

Software Supply Chain Security Remains Critical

During the Kitecast episode, cybersecurity experts Alexandre Blanc and Evgeniy Kharam discussed the alarming rise in software supply chain attacks. These attacks are projected to spiral and the associated cost. The experts emphasized that while compliance frameworks like SOC 2 and ISO 27000 standards provide baseline guidance, organizations must move beyond mere checkbox security compliance. "Alexandre explained, “Organizations often view SOC 2 or ISO certification as the end goal, but that's just the starting point. What matters is building a comprehensive security program that actually addresses real risks and maintains security posture over time."

CMMC 2.0: A Wake-up Call for Defense Contractors

The discussion delved deep into CMMC 2.0 compliance challenges facing defense contractors. While surveys indicate most organizations believe they're prepared for certification, the reality is starkly different: the actual number of organizations ready to pass certification requirements is quite low. Evgeniy noted, "Don't wait to start your CMMC preparation. This isn't just about checking boxes. Organizations need to understand their environment, document their processes, and implement required controls - all of which takes significant time and resources."

AI Adoption Increases Cybersecurity Risk Exposure

The Kitecast conversation highlighted growing concerns about employees inadvertently exposing sensitive data through public large language models (LLMs) and other AI tools. Rather than focusing solely on technical controls, the experts emphasized the need for comprehensive governance frameworks that include clear policies, regular training, and approved platforms for business use. You cannot just block ChatGPT and think you've solved the problem. New AI tools emerge constantly. Organizations need to educate employees about the risks and provide secure alternatives for legitimate business needs.

Data Classification and Zero Trust Architecture

A significant portion of the discussion focused on the challenge of managing unstructured data across organizations. Few organizations have tagged and classified all their unstructured data. This creates significant compliance risk exposure and makes it nearly impossible to properly protect sensitive information. The experts emphasized that implementing zero trust principles can save organizations millions of dollars during a data breach, highlighting the importance of continuous validation and comprehensive monitoring in reducing cyber risk exposure.

2025 Forecast Report
https://www.kiteworks.com/forecast-report/ 

LinkedIn Profile for Evgeniy Kharam
https://www.linkedin.com/in/ekharam/

LinkedIn Profile for Alexandre Blanc
https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/ 

Kiteworks 2025 Exposure Risk Report: 12 Predictions

With the new year just around the corner and eight new privacy laws coming online next year, December is an excellent time for companies to assess their data collection and processing practices, and take stock of any changes needed to meet additional legal requirements. We break down what you need to know as we head into 2025.

https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/new-privacy-laws-in-2025-what-you-need-to-know

Alysa Hutnik
ahutnik@kelleydrye.com
(202) 342-8603
www.kelleydrye.com/people/alysa-z-hutnik

Aaron Burstein
aburstein@kelleydrye.com
(202) 342-8671
www.kelleydrye.com/people/aaron-j-burstein

Meaghan Donahue 
mdonahue@kelleydrye.com
(202) 945-6622
https://www.kelleydrye.com/people/meaghan-m-donahue

Hosted by Simone Roach

Subscribe to the Ad Law Access blog - www.kelleydrye.com/subscribe

Subscribe to the Ad Law News Newsletter - www.kelleydrye.com/subscribe

View the Advertising and Privacy Law Resource Center - www.kelleydrye.com/advertising-and-privacy-law

Find all of our links here linktr.ee/KelleyDryeAdLaw

New Privacy Laws In 2025- What You Need To Know

Welcome to the Identity Theft Resource Center's Weekly Breach Breakdown for January 17th, 2025. I'm Timothy Walden. Thanks to SentiLink for their support of the ITRC and this podcast.  Each week on this podcast, we look at the most recent events and trends related to data security and privacy. Today, we'll discuss a company I’m sure many of you have heard about or interacted with: T-Mobile. 

In a significant legal move, Washington State has filed a lawsuit against T-Mobile, alleging the telecommunications giant failed to secure the sensitive personal information of more than two million residents following a major data breach in 2021. This case highlights data security, consumer protection, and corporate accountability in an increasingly digital world.

Follow on LinkedIn: www.linkedin.com/company/idtheftcenter/
Follow on Twitter: twitter.com/IDTheftCenter

The Weekly Breach Breakdown Podcast by ITRC - T-Mobile in Trouble - S6E2

Hello everyone! Welcome back to another episode of AI Tech News Today. I’m Aurora, joined by my co-host Isabelle. Today, we’re diving into some riveting news about the latest developments in the world of Artificial Intelligence as of January thirty-first, two thousand twenty-five. So, buckle up!

DeepSeek’s meteoric rise. DeepSeek has just shattered records by climbing straight to the top of the App Store. OpenAI Chief Executive Officer Sam Altman has called their model "impressive" and "invigorating." This fierce competition between tech giants is stirring up excitement in the industry. Meanwhile, Microsoft is launching an investigation into whether DeepSeek violated any terms while using OpenAI’s Application Program Interface, or API, in training its model. 

Also, cloud security firm Wiz has pointed out that DeepSeek has exposed a critical database, compromising over one million records. This raises significant concerns regarding data security in AI development. On Wall Street, Nvidia's market cap took a hit this week, shedding a staggering five hundred ninety-three billion dollars amid investor fears about dwindling demand for AI chips. But do not fret, Nvidia managed to recover most of those losses by the end of the week.

Alibaba flexes with Qwen2.5-Max. It’s not just DeepSeek making headlines; Alibaba has launched Qwen2.5-Max. This model is reportedly outperforming others in benchmarks, including OpenAI's GPT-4 and Claude 3.5 Sonnet. With its efficient mixture-of-experts architecture, Qwen2.5-Max can achieve top-tier performance while using significantly less computational power. This is great news for businesses as it's optimized for corporate use, excelling particularly in code generation and advanced reasoning tasks.

Oumi bets on fully open-source AI. In other news, Oumi—a newly launched open-source platform founded by former engineers from Google and Apple—aims to tackle the roadblocks faced by researchers. It offers transparent models alongside open weights and training data, allowing researchers to train on personal laptops before scaling their models up. This could potentially lead to significant breakthroughs in the field.

To wrap things up, it’s clear that the AI landscape is ever-evolving, with new players swiftly changing the game. Will these innovations lead to a paradigm shift in how we view AI? We want to hear your thoughts! Stay tuned for more updates and exciting developments in the world of Artificial Intelligence. Thanks for listening and see you next time!

DeepSeek Soars to App Store Fame Amid Data Security Concerns, Alibaba Unveils Game-Changing Qwen2.5-Max Model

Arun DeSouza, the Managing Director at Profortis Solutions, brings over two decades of experience as a CISO, having developed and implemented award-winning programs in identity lifecycle management and IoT security. His impressive career includes induction into the CISO Hall of Fame by the Global Cyber Startup Observatory and recognition as a top CISO by Cyber Defense Magazine. Arun’s expertise, combined with his academic background—a Ph.D. in Chemical Engineering from Vanderbilt—offers listeners a unique perspective on navigating today’s complex cybersecurity landscape.

From Chemical Engineering to Cybersecurity Leadership

Arun’s journey into cybersecurity is as unconventional as it is inspiring. Initially trained as a chemical engineer, he transitioned to cybersecurity through hands-on experience and a fearless approach to problem-solving. Faced with the challenge of managing global security for a French company, Arun built a strategic plan that not only upgraded systems but also delivered significant savings. His approach, which he calls the “power of federation,” involved collaborating with partners for discounted pricing and consolidating resources.

Navigating Cybersecurity Threats: IoT, Ransomware, and AI

Arun sheds light on the evolving cybersecurity threat landscape, particularly the rapid proliferation of IoT devices. With an estimated 75 billion IoT devices by 2025, the risks associated with insecure software, vulnerable cloud communications, and expanded attack surfaces are more significant than ever. He highlights specific challenges in manufacturing and OT security, where ransomware and supply chain attacks can cripple operations. Arun also warns of the impending threat of AI-powered supply chain attacks, which could amplify the scale and sophistication of breaches. His insights reinforce the need for robust data governance and the adoption of Zero Trust security models to mitigate these risks effectively.

Critical Role of Identity Management and Leadership

Central to Arun’s security philosophy is the concept of identity access management (IAM) as a strategic cornerstone. He introduces the idea of the “identity coin,” which blends physical security (person, device, location) with logical security (attributes, behavior, context). Arun emphasizes that security is not just about technology but also about strong leadership and communication. He advises CISOs to build relationships with senior leaders, use storytelling to convey risks, and align security initiatives with business objectives. His analogy of the CISO as the “captain of the good ship cyber” encapsulates his forward-thinking approach to navigating cybersecurity challenges.

Technical Acumen and Strategic Vision

Arun’s expertise and leadership offer actionable insights for anyone looking to strengthen their cybersecurity strategy. His forward-thinking approach to risk management, identity governance, and embracing change provides a valuable blueprint for both cybersecurity professionals and business leaders. By applying Arun’s principles of strategic planning, collaboration, and Zero Trust security, organizations can navigate today’s complex threat landscape with confidence. 

LinkedIn: https://www.linkedin.com/in/arundesouza/

Profotis Solutions: https://profortissolutions.com/ 


Arun DeSouza: Becoming a Transformational CISO

This UVA Speaks podcast features Philip Potter, Professor of Politics in the Department of Politics, founding Director of the Frank Batten School of Leadership and Public Policy’s National Security Policy Center, and founding Director of the National Security Data and Policy Institute at the University of Virginia. Potter explains that the National Security Data and Policy Institute, a collaboration between the University of Virginia and the Office of the Director of National Intelligence, seeks to bridge the gap between government and academia to address the country’s most pressing national security issues. The Institute researches the challenges of data proliferation and emerging technologies like Artificial Intelligence and biotechnology. 

Transcripts of the audio broadcast can be found here. https://www.rev.com/transcript-editor/shared/adEVxlrt1V_7LlRLjT3PgKaTjPBBA2Yo4XlubqQZa4uaM4wndK5zl8Mztdct0S5nom-gITiKW6B0lZKOk6UeeTWDxWk?loadFrom=SharedLink

Philip Potter is a Professor of Politics from the Department of Politics at the College and Graduate School of Arts & Sciences and the founding Director of the National Security Policy Center at the Frank Batten School of Leadership and Public Policy and the National Security Data Policy Institute at the University of Virginia. Professor Potter’s research focuses on US foreign policy, military affairs, and international security. He has published dozens of articles, policy papers, and government reports on these topics as well as two books. He also serves as a university expert for the Intelligence Community and a senior advisor in the Department of Defense.

UVA’s National Security Data and Policy Institute

Welcome to the Identity Theft Resource Center's (ITRC’s) Weekly Breach Breakdown for March 14, 2025. I'm Timothy Walden. Thanks to SentiLink for their support of the ITRC and this podcast. 

Each week on this podcast, we look at the most recent events and trends related to data security and privacy. Today, we’ll discuss some of the most notable data breach exposures from February 2025, focusing on a breach that impacted millions of individuals and a couple of others worth noting. 

Follow on LinkedIn: www.linkedin.com/company/idtheftcenter/
Follow on Twitter: twitter.com/IDTheftCenter

The Weekly Breach Breakdown Podcast by ITRC - February 2025 Notable Breaches - S6E8

Welcome to the Identity Theft Resource Center's (ITRC) Weekly Breach Breakdown for April 11, 2025. I'm Timothy Walden. Thanks to SentiLink for their support of the ITRC and this podcast. Each week, we bring you the latest developments in data security and privacy. Today, we’re going to discuss something that is gaining more traction in the digital world: Chat GPT. More specifically, OpenAI’s new image generator, which is part of the ChatGPT family. 

If you haven’t heard, this tool can create everything from art in the style of the famous Japanese anime maker Studio Ghibli to images promoting Bitcoin investments. While the tool has gone viral for its creativity, it’s also raising some serious concerns about its potential for misuse, particularly in the hands of scammers.

Follow on LinkedIn: www.linkedin.com/company/idtheftcenter/
Follow on Twitter: twitter.com/IDTheftCenter

The Weekly Breach Breakdown Podcast by ITRC - Fake It Til You Make It - S6E11

Welcome to the Identity Theft Resource Center's (ITRC) Weekly Breach Breakdown for April 18, 2025. I'm Alex Achten, Senior Director of Communications & Media Relations of the ITRC. Thanks to Sentilink for supporting the ITRC and this podcast. Each week, we look at the most recent events and trends related to data security and privacy. Today, we look at our Q1 2025 data breach findings.

Follow on LinkedIn: www.linkedin.com/company/idtheftcenter/
Follow on X: twitter.com/IDTheftCenter

The Weekly Breach Breakdown Podcast by ITRC - Once More Unto The Breach - S6E12

Welcome to the Identity Theft Resource Center's (ITRC’s) Weekly Breach Breakdown for May 16, 2025. I'm Alex Achten, Senior Director of Communications & Media Relations of the ITRC. Thanks to Sentilink for supporting the ITRC and this podcast. 

Each week, we look at the most recent events and trends related to data security and privacy. Today, we will analyze the newly formed data privacy consortium. 

Follow on LinkedIn: www.linkedin.com/company/idtheftcenter/
Follow on Twitter: twitter.com/IDTheftCenter

The Weekly Breach Breakdown Podcast by ITRC - Moving Forward Together - S6E15

In this first episode of Privacy Perspectives, a new Ad Law Access podcast mini-series, Alex Schneider talks with Celine Guillou about how businesses can put their best foot forward when engaging with enforcement agencies and regulators in privacy and security investigations.

Celine recently joined Kelley Drye as Special Counsel after serving in the Enforcement Division of the California Privacy Protection Agency (CPPA). She shares insights from her time at the CPPA, including common areas of regulatory focus and practical guidance for responding to enforcement requests.

Alex and Celine also discuss the broader landscape of state privacy laws, emerging enforcement trends, and steps companies can take to strengthen compliance programs before an investigation ever starts.

ABOUT THE SPEAKERS
Celine Guillou
Special Counsel, Advertising and Privacy Group
Former Enforcement Attorney, California Privacy Protection Agency
cguillou@kelleydrye.com
(213) 547-4946
www.kelleydrye.com/people/celine-m-guillou

Alex Schneider
Special Counsel, Advertising and Privacy Group
aschneider@kelleydrye.com
(202) 342-8634
www.kelleydrye.com/people/alexander-i-schneider

RESOURCES
Subscribe to the Ad Law Access blog:
www.kelleydrye.com/subscribe
Subscribe to the Ad Law News newsletter:
www.kelleydrye.com/subscribe
Visit the Advertising and Privacy Law Resource Center:
www.kelleydrye.com/advertising-and-privacy-law
Find all of our links here:
linktr.ee/KelleyDryeAdLaw

Privacy Perspectives: Preparing for Privacy Enforcement Inquiries

A seismic shift is hitting the digital certificate landscape. Google has announced strict enforcement of Extended Key Usage (EKU) policies for all certificates in the Chrome Root Store, effective June 15, 2026. This means the days of using a single TLS certificate for multiple purposes, like client authentication, internal microservices, or code signing, are numbered. In this episode of Encryption Edge, we explore how this update, paired with the new 47-day maximum certificate lifespan, is forcing enterprises to rethink everything from certificate architecture to lifecycle management. 
 
Key Takeaways:
What Google's EKU enforcement means for your infrastructure
How shorter certificate lifespans demand automation
Real-world risks of non-compliance, including outages and distrust
Why internal PKI, CLM automation, and CA agility are now must-haves
Immediate actions security and DevOps teams should take

Inside Google’s Certificate Reform: Shorter Lifespans, Stricter Rules

The European Union has released a detailed roadmap to guide its transition to post-quantum cryptography, and it's set to impact organizations worldwide. In this episode of The Encryption Edge, Wyatt Hackathorne unpacks what the roadmap means, the urgent timelines it sets, and the concrete actions organizations should take today. From understanding the "store now, decrypt later" threat to preparing your supply chain and internal systems for cryptographic agility, this episode is your essential guide to navigating one of the most important shifts in cybersecurity.

Decrypting the EU’s Post-Quantum Cryptography Roadmap

In this episode, host Wyatt Hackathorne breaks down the new bipartisan National Quantum Cybersecurity Migration Strategy Act introduced in late July 2025. The bill, a critical follow-up to the June Executive Orders, mandates a coordinated national strategy for transitioning federal systems to quantum-safe encryption. Learn how this combined effort provides the U.S. with a clear roadmap to proactively secure its data against the looming threat of quantum computers.

U.S. Quantum Readiness Takes a Leap

The clock is ticking on quantum computing, but how prepared is the web for the new era of encryption? In this episode of The Encryption Edge, host Wyatt Hackathorne explores the current state of PQC adoption. We reveal surprising disconnects between what's needed and what's being done, from lagging industries to unprepared browsers. Learn why the "harvest now, decrypt later" threat is a real danger, why some of the most popular websites are the least secure, and what organizations must do now to future-proof their data before it's too late.

The Quantum Countdown: Is Your Website at Risk?

Kitecast features interviews with security, IT, compliance, and risk management leaders and influencers, highlighting best practices, trends, and strategic analysis and insights. Kitecast is cohosted by Tim Freestone and Patrick Spencer who have more than four decades of combined experience in technology and cybersecurity senior leadership roles.

The Encryption Edge – Your go-to podcast for all things encryption, cybersecurity, and data protection. Whether you're an industry expert or just getting started, we break down complex topics like cryptography, PKI, post-quantum security, and cloud encryption in a way that's easy to understand. Stay ahead of emerging threats, compliance requirements, and the latest security trends with expert insights and practical advice from Encryption Consulting.

The University of Virginia Lifetime Learning program enriches the intellectual life of UVA’s alumni, friends, and families through faculty lectures and online resources.

Looking for fresh content to solve your human capital issues but don't have a full hour? Subscribe to the HCI podcast series to gain access to leading HR practitioners from Fortune 1000 companies, as well thought-leaders, authors, and academics. These experts cover everything from talent acquisition and analytics to engagement, retention, and development.

The Ad Law Access podcast, now available daily, is powered by Kelley Drye’s Advertising and Privacy / Data Security teams. 

Hosted by Simone Roach, the daily podcast complements the award-winning Ad Law Access blog, and provides updates and analysis on advertising, marketing, and privacy / data security law.

Please visit the Advertising and Privacy Law Resource Center at https://www.kelleydrye.com/Advertising-and-Privacy-Law-Resource-Center and our award winning blog at https://adlawaccess.com.

New tracks tagged #data security