Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

January 2024

Practitioner's Corner: Turning Regulatory Compliance into Strategic Opportunity

Cyber risk regulations like NIS2 and DORA in the EU, or PS21/3 in the UK, signal a seismic shift toward strengthening cyber resilience and enforcing accountability. Championing regulations is not just a matter of checking compliance boxes: it’s an opportunity to become a business leader. To enable growth and protect revenue.

What is a Cyber Security Audit vs. Assessment (And Which One You Need)

In this article: If you're a security leader being asked to facilitate a cybersecurity audit, or if you are a member of the board requesting one, you must understand the difference between a cybersecurity audit and a cybersecurity assessment. Despite sounding the same, both provide you with different types of information - and that might have a significant impact on your organization’s security posture. In this blog, we provide a quick introduction to a cybersecurity audit vs.

How to Detect Shadow IT and Hidden Risk in Your Organization

In today's fast-paced business environment, the ever-evolving landscape of technology empowers employees with unprecedented flexibility and agility. While this fosters innovation and productivity, it also presents a lurking challenge—Shadow IT. This term encapsulates the use of unauthorized software, applications, or devices within an organization, posing substantial cybersecurity risks and operational hurdles.

Cybersecurity and Proxy Season: What Business Executives and Risk Leaders Need to Know

If you’re a business executive or a risk leader, you’re likely familiar with “proxy season,” the time of year when public companies hold their annual general meetings. During these meetings, investors have the opportunity to vote on important issues such as the election of board members and executive compensation.

Addressing Third-Party Risk in 2024: Insights Inspired by Bitsight-Google Study

Third-party risk is everywhere and the cybersecurity posture of those third parties is more important now than ever before. With organizations using 130 SaaS solutions on average, onboarding the “wrong” vendor — one that doesn’t share the same cyber practices or hygiene as you do, or that sharing sensitive data with would be cause for concern — could land an organization in hot water.

Building a Shadow IT Policy: What CEOs, CTOs, and CISOs Need to Know

The problem with shadow IT isn’t really the need for new tools, it’s the fact that people use them without IT security teams knowing. This usually happens because they perceive security policies as restrictive and antagonistic toward their productivity. In this way, Shadow IT is a process issue—not a software issue. Hidden risk is increasingly challenging cybersecurity leaders as digital supply chains grow and more apps are added to the network.

Cyber Exposure Management Meets the New SEC Reporting Requirements

The recent SEC breach disclosure rules place enormous pressure on CISOs. The new SEC disclosure requirements for public companies require companies to report annually on their cybersecurity risk management and governance efforts and publicly announce cybersecurity incidents that prove "material." Determining materiality may be one of organizations' most prominent challenges with the new rules. What exactly is a material cybersecurity incident?

7 Cybersecurity Frameworks That Help Reduce Cyber Risk (List & Resources)

While security ratings are a great way to demonstrate that you’re paying attention to the standard cyber health of the organization, you also need to show that you’re adhering to industry and regulatory best practices for IT security and making informed decisions for the long-term. A cybersecurity framework can help.

Identifying Blind Spots Through External Attack Surface Management

Did you know that 69% of organizations have experienced some type of cyber attack in which the attack itself started through the exploit of an unknown, unmanaged, or poorly managed internet-facing asset? Understanding the scope of your organization’s external attack surface is essential. You need to continuously manage your digital footprint to know where risks exist and how to prioritize vulnerable areas. Gain visibility into what an attacker sees and take informed action to reduce exposure and empower your organization’s growth and success.

Optimizing Returns from Your Cyber Risk Program

In today’s economic environment, nearly every department in every organization across the globe is being challenged to do more with less. Meanwhile, digital footprints continue to grow and sprawl and cyber attackers look to take advantage of vulnerable infrastructure. Organizations need to assess how they can be more resourceful as they look to maintain a best-in-class cyber risk program and continue to meet business expectations.

Unlock the Power of Attack Surface Management with Insights from a KuppingerCole Analyst

Join Vanessa Jankowski, SVP of Third Party Risk Management, and Greg Keshian, SVP of Security Performance Management, as they explore key findings from the 2023 KuppingerCole Leadership Compass Report for Attack Surface Management with John Tolbert, Director of Cybersecurity at KuppingerCole Analysts. In today's interconnected digital landscape, managing your exposure strategy for your infrastructure and your supply chain is paramount. They discuss strategies to fortify cybersecurity defenses and minimize risks.

The Security Performance Management Evolution: Interview with Bitsight's Greg Kesen & Dark Reading

In this Dark Reading News Desk segment, Bitsight's Gregory Keshian discusses external attack surface management and security performance management. Greg reviews how the emerging discipline of security performance management (SPM) can better secure a company's attack surface. He offers guidance for how to mitigate problems and enumerates the major catalysts affecting attack surfaces, and how governance frameworks can be incorporated to ensure organizational compliance with state and federal laws.

Shadow IT: Managing Hidden Risk Across Your Expanding Attack Surface

One study found that 65% of SaaS applications in use are unsanctioned. And 59% of IT professionals find SaaS sprawl challenging to manage. In other words, shadow IT risks are growing—but that’s just the tip of the iceberg when it comes to hidden risks across today’s expanding attack surface. Missed software patches, outdated certificates, and stealth malware are some examples. Many security teams still struggle to keep their networks safe from ever-growing digital supply chains.

ShadowIT, Hidden Risk, and the insights that drive action to reduce exposure

The annual doctor wellness check always interests me. It’s generally the same routine every year: The doctor and I exchange pleasantries. She asks about any noticeable health changes while looking in my ears with that cool little penlight. If I’m lucky, she uses the mini-hammer to see how high my leg kicks after a gentle knee tap (I just love that for some reason). But it’s all a bit of a show, isn’t it?

Shadow IT, Hidden Risk, and the insights that drive action to reduce exposure

The annual doctor wellness check always interests me. It’s generally the same routine every year: The doctor and I exchange pleasantries. She asks about any noticeable health changes while looking in my ears with that cool little penlight. If I’m lucky, she uses the mini-hammer to see how high my leg kicks after a gentle knee tap (I just love that for some reason). But it’s all a bit of a show, isn’t it?

Vendor Discovery: Automating identification of third party relationships

As organizations increasingly rely on external vendors and enterprise buying patterns continue to decentralize, the challenge of managing risk associated with third parties becomes critical. Unfortunately, even uncovering vendor relationships within an organization can be a struggle, with over 80% of workers admitting to using non-approved SaaS applications. This ‘Shadow IT’ is not only frustrating; it introduces tremendous risk.

Data Insights on AgentTesla and OriginLogger Victims

AgentTesla is a Windows malware written in.NET, designed to steal sensitive information from the victim's system. It’s considered commodity malware given its accessibility and relatively low cost. Commodity malware poses a significant threat as it enables less sophisticated cybercriminals to conduct various types of cyberattacks without requiring extensive technical knowledge. AgentTesla has been a persistent and widespread threat since its emergence in 2014.

Bitsight Delivers Enhanced Analytics on IT Infrastructure Service Providers

As third party outsourcing and cloud services become commonplace for enterprise organizations, security leaders need to understand and assess the cybersecurity risks of businesses that they partner with for “technology infrastructure services.” Security leaders want accurate, up-to-date information about their infrastructure provider’s security policies, procedures, and program performance so they can better understand risks to their own organizations.

5 Compliance and Governance Happenings That Will Drive Exposure Management in 2024

When it comes to cybersecurity governance, 2023 stood out as one of the most eventful in a very long time. With everything from the enactment of stronger new cybersecurity regulations around incident disclosure from the Securities and Exchange Commission (SEC) to significant changes afoot for financial and cloud services providers operating within the European Union, many companies worldwide will be called to adjust to a new normal in 2024.

Analyzing the Biggest Cybersecurity Exposure and Threat Events from 2023

The last 12 months have been awash with incidents that led to significant data breaches, government regulatory and legal sanctions, and loss of business services availability. In 2023 we saw the most private personally identifiable information exposed, business services shut down, and CISOs fired—and even charged for legal violations by the federal government.

3 Steps Government Policymakers Can Take to Reduce Critical Infrastructure Cyber Attacks

Recent research identifying nearly 100,000 exposed industrial control systems (ICS) around the world should serve as a critical wake-up call to national government policymakers responsible for ensuring national security, public health, and safety within their borders. These systems, fundamental to our critical infrastructure, underpin essential services that sustain modern society… and they should not be publicly exposed on the Internet!

Domain (in)security: the state of DMARC

As people have grown comfortable with e-commerce and email correspondence, the techniques of scammers have become increasingly sophisticated and hard to detect. Many of us have heard of phishing attacks, in which bad actors coerce people into handing over sensitive information. These are usually carried out by impersonating a trusted third party – and overwhelmingly through email (Deloitte, 2020).