The healthcare industry has always been an appealing target for cybercriminals. From high-value patient data to a low tolerance for downtime that could disrupt patient care, cybercriminals continue to find ways to take advantage of healthcare cybersecurity practices. In recent years, the healthcare industry has seen a 55% increase in cybersecurity threats, turning attacks on healthcare providers into a $13.2 billion industry and making it a gold mine for cybercriminals.

On August 27, 2021, the US House Homeland Security Committee released a draft bill that would update the Homeland Security Act of 2002. This proposed bill seeks to establish a Cyber Incident Review Office and publish an interim rule that would outline procedures for reporting cybersecurity incidents.

The escalation of cyberattacks since early 2020 is requiring many companies to strengthen their security operations. Adversaries are taking advantage of new attack vectors – like IoT devices, insecure remote access mechanisms, and the multiple personal and work devices users now move between. They’re also leveraging human vulnerabilities, impersonating trusted colleagues and third parties to infiltrate organizations.

Cloud computing has revolutionized the business and technological landscape of the last decade. More organizations are turning to cloud services to better manage massive volumes of both structured and unstructured data on a daily basis. As organizations move more and more information and applications to the cloud, there are growing concerns for data security and regulatory compliance.

Most organizations today rely on the cloud to store or manage at least some of their data and applications. If your business is considering (or already using) a cloud environment, it’s important that you know what to do if your cloud system crashes or experiences an outage. In this guide, we cover the basics of cloud computing and then outline some steps you can take in the event of a cloud crash or outage.

Compliance is a constant issue that affects businesses in multiple ways every day. Not only must your compliance program address individual acts of misconduct; the program must assure that your organization follows laws, rules, and regulations overtime — every day, day after day, in perpetuity.

The global economy is more connected than ever, generating significant benefits for companies and industries operating worldwide. Nobody, however, is exempt from threats that drive supply chain and manufacturing risk. There is no doubt that the manufacturing industry is beset by numerous risks that affect the company and its human assets.

News of ransomware attacks disrupting supply chains has increased recently. As threat actors disrupt businesses and critical infrastructure, they may appear to be working harder. However, cybercriminals treat ransomware as a business, enabling an underground industry. Ransomware-as-a-Service (RaaS) is a growing underground industry that continues to place sensitive information at risk.

Security teams are struggling to contend with the expanding third-party attack surface which is fueled by the pernicious cycle of poor vendor risk management.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a U.S. federal law meant to protect sensitive electronic protected health information (ePHI). Every healthcare organization (“covered entity”) must comply with its two fundamental rules. In 2013, the U.S. Department of Health and Human Services (HHS) passed the HIPAA Omnibus Final Rule, which expanded compliance requirements to the business associates that also handle ePHI on behalf of covered entities.

Vendor tiering is the key to a more resilient and sustainable third-party risk management strategy. But like all cybersecurity controls, it must be supported by the proper framework. To learn how to optimize your Vendor Risk Management program to greater efficiency through best vendor tiering practices, read on.

Connected devices offer healthcare providers ways to remotely monitor patient health. Additionally, hospitals use these devices for enhanced patient care, including medication delivery and vitals monitoring. However, malicious actors often use unsecured IoMT as part of their attack methodologies.

Understanding your organization’s cybersecurity posture is becoming more important every day. So how do you know how secure your IT infrastructure really is? One way to get a glimpse into your organization’s security is penetration testing: pretending (or hiring someone to pretend) to be a hacker, attempting to infiltrate your organization’s physical and cyber systems however possible.

Cyberattacks against businesses of all sizes are at all-time highs. Data from 2021 and projections for the future of cybersecurity suggest that the frequency and intensity of these attacks will only continue to grow. At the forefront of most cyberattacks in 2020 was ransomware, a type of malicious malware attack where attackers encrypt your organization’s data and demand payment in exchange for a decryption key to restore access.

A network vulnerability assessment is the reviewing and analyzing of an organization’s network infrastructure to find cybersecurity vulnerabilities and network security loopholes. The assessment can be carried out either manually or by using vulnerability analysis software — although the latter is preferred because it’s less susceptible to human error and usually delivers more accurate results.

An audit universe is a document that details all the audit activities to be carried out by the internal audit function. It consists of multiple and distinct auditable entities, processes, and activities, which can be considered “auditable units.” The number of these auditable units varies depending on the organization’s size, business complexity, and operational scale. In some cases they can run into the hundreds or even thousands.

Regulations have long existed to govern how organizations collect and use information online, as well as what cybersecurity precautions organizations should take while conducting business online. As digital transformation of business processes has accelerated in the last few years, however, that means ever more organizations — large and small — must comply with all those regulations.

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by Congress in 1996 to prevent medical fraud and to assure the security of protected health information (PHI), such as names, Social Security numbers, medical records, financial information, electronic health transactions and code sets. The law is managed by the U.S. Department of Health & Human Services (HHS).

Security compliance management is the process of monitoring and assessing systems, devices, and networks to ensure they comply with regulatory requirements, as well as industry and local cybersecurity standards. Staying on top of compliance isn’t always easy, especially for highly regulated industries and sectors. Regulations and standards change often, as do threats and vulnerabilities. Organizations often have to respond quickly to remain in compliance.

“We are honored to have our ZenGRC platform recognized with four G2 Fall 2021 Grid Report badges: Leader, Momentum Leader, Mid Market Leader, and Users Love Us,” said Jenny Victor, Vice President of Marketing at Reciprocity.

Companies list governance, risk, and compliance (GRC) as a top priority, but “doing GRC” isn’t easy. It takes time, effort and a strategy – and starting is usually the hardest part. So, in the first of our Back to Basics blogs, we’re going to focus on where every compliance and risk practitioner should start when building a GRC program: selecting the compliance frameworks which will form the foundation of your GRC program…

Every day, organizations around the world use due diligence questionnaires (DDQs) to evaluate potential business partnerships and gain a better understanding of the way various third-party vendors conduct day-to-day operations. These questionnaires help organizations investigate potential business ventures or partnerships to confirm they are making a good investment before entering into an agreement with a third-party.

No organization is impervious to cyberattacks. But what separates resilient businesses from data breach victims is superior risk management. Resilience is achieved through the meticulous calculation of all potential risks and the application of necessary control measures to mitigate them. In this post, we present a 4-step framework for a reliable risk management plan.

Given the countless cyber threats facing organizations these days, security has become one of the most pressing issues on the executive mind. Yet when we talk about cybersecurity, we rarely focus on security vulnerabilities and how patching those vulnerabilities is crucial for a cybersecurity program. So what is vulnerability patching, exactly? A vulnerability is a flaw that cybercriminals can exploit to gain unauthorized access or to perform unauthorized actions on a computer system.

Cybersecurity threats have proliferated for years, and that shows no sign of stopping. One estimate, for example, is that damages due to cybercrime will hit $10.5 trillion by 2025. One especially pernicious threat gaining new popularity: fileless malware. Fileless malware attacks are particularly dangerous because, unlike traditional malware, they involve no files to scan — and therefore are harder to detect by conventional endpoint protection tools.

Third parties are a necessary part of your enterprise. They are your vendors, your suppliers, your contractors, and your partners. Without them, you can’t do business. Third parties provide cloud services, store sensitive data, and provide other important services. Unfortunately, third parties are also a major source of cyber risk. Cybercriminals often target third-party providers to target their clients’ data and networks, such as the notorious SolarWinds breach at the end of 2020.

Banking has changed. In the past, financial institutions outsourced their technology. They had large consulting firms creating, managing, and maintaining their back-end systems. Although banks would have knowledge of the systems in place, they wouldn’t be running them on a day-to-day basis. That was the consultants’ responsibility. Recent years have seen a significant shift in the financial sector.

As cyber threats and data breaches proliferate, organizations need a better way to protect their sensitive data. One specific need: effective and efficient data security models. A security model includes procedures to validate security policies and to implement vital business processes and workflows in your security program. A security model also specifies the data structures and techniques required to enforce security policies.

As your company grows, outsourcing certain tasks will likely become necessary. Whether procuring materials from outside manufacturers or contracting freelancers to help your marketing efforts, third- and even fourth-party vendors have become critical relationships in any developing business. Opening your organization to third parties has many benefits. It also exposes your company to new risks you may not have considered.

Operational risk is any risk stemming from your company’s business processes that could result in loss. This loss is not always financial; things like reputational risk also fall under this category. Operational risk management (ORM) is the art of protecting your company from these potential risks and minimizing any losses that may occur. ORM began in financial institutions and became streamlined and codified over the years via the Basel Committee on Banking Supervision (BCBS).

Organizations today live in a dynamic environment. Risks to your business activities are everywhere, including among the relationships you have with other parties. From choosing supply chains to engaging in new partnerships, third-party risks have always been part of the risk assessments that organizations perform (or should perform, at least). Unfortunately, with the advent of cloud services and automation, third-party risks are now one of the most common threats that the modern enterprise faces.

In 2016, an article in the Harvard Business Review called out organizations that focused on external cybersecurity threats while ignoring the threats originating from within — and rightly so. Today, about 66 percent of organizations believe that malicious insider attacks are more likely than external attacks. This points to a growing (and welcome) awareness of internal cybersecurity threats.

Creating a cyber-resilient organization means understanding your security risks and how to mitigate them. However, the cybersecurity risk’s continuously shifting nature makes it challenging for organizations to choose the right risk assessment strategy. By understanding the types of risk assessments and how to use them, you can make better-informed decisions.

Utility companies are increasingly being targeted by cybercriminals. Although the highest profile utility cyber attack in recent memory was the May 7 ransomware attack on Colonial Pipeline that caused gas shortages on the East Coast, power companies of all kinds are popular with criminals for a reason: they can’t afford a shutdown and they have the money to pay a ransom.

Many different types of IT security risks can affect a business. It is essential to know about the implications, how cyber risks can be identified and what you need to protect against them. In this connected world, cyber attacks are a common occurrence. As long as the internet exists, there will be information security risks and malicious attacks that come with it. Ranging from minor nuisances to devastating consequences, hackers never seem to stop attacking your data!

Modern technology allows the easy collection and distribution of personally identifiable information — and concerns about the unintended distribution of that personal data have led to a wave of data privacy laws around the world. The U.S. Health Insurance Portability and Accountability Act (HIPAA) is one such law, and imposes strict rules on how hospitals, healthcare businesses, and other “covered entities” handle personal health information (PHI).