Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

August 2023

NIS 2 Directive: Leveraging regulatory compliance and technology to reduce risk

Cyber threats pose a significant risk to organizations due to today's increasingly interconnected digital landscape. To address these challenges and ensure the security and resilience of critical infrastructure and digital services, the European Union introduced the Directive (UE) 2022/2555, commonly known as NIS 2 - which was actually approved on the same day as DORA, both being critical in how the EU is leveraging regulatory compliance and technology to reduce cyber risk.

Your HTTPS Redirection Risk Exposure

The Hypertext Transfer Protocol (HTTP) and the Hypertext Transfer Protocol Secure (HTTPS) are data communication protocols for the internet. HTTPS uses encryption algorithms for secure data transfer. Without encrypted communications, information transfer is not protected and sensitive data becomes vulnerable to attackers. This article includes a brief overview of HTTPS, as well as actions you can take to ensure that you have set up HTTPS redirection for your website.

Introducing Riscosity's New Look

Today you’ll notice our new logo and typography. We’ve introduced a minimalist approach and opened up spacing within the letters to help with legibility and visual continuity. Our mission as a company is to help teams quickly and painlessly meet data security requirements with high confidence. Our goal is to align that mission with our user's entire experience, from day one.

4 Ways To Improve Your Cloud Security Posture Management

The cloud can be cost-effective, scalable, flexible and – mostly – secure. So, it’s not surprising that 94 percent of enterprises use cloud services, 67 percent of enterprise infrastructure is cloud-based, and 92 percent of businesses have a multi-cloud strategy in place (source). But that doesn’t mean that breaches can’t happen.

The Role of Software in Vendor Risk Management Products

In recent years, vendor risk management (VRM) has become a complicated practice as businesses aim to scale and manage potentially hundreds or thousands of vendors. With more vendors, cybersecurity risk is introduced, necessitating software and other digital solutions to adequately manage these vendors. The role of software in vendor risk management products is more important than ever now and moving forward.

How to Conduct a Vulnerability Assessment

Repairing a weakness in your IT environment is always easier than dealing with the consequences of that weakness — like, say, a massive data breach — sometime later. This means your security team must be proficient at finding those weaknesses and assessing your IT environment’s vulnerabilities. Those vulnerabilities can include weak passwords, poor patch management, and lax security training.

What Role Does Procurement Play in Supply Chain Risk Management?

Thanks to globalization and rapidly developing technology, enterprise involves more connections than ever before, and more connections means more risk in the supply chain. Supply chain risk extends past those suppliers with whom you’re doing business directly. Beyond your third-party suppliers are their suppliers, and the supply chain continues branching out from there. In today's connected world, organizations must not isolate their supply chain risk management.

Top 5 Challenges and Solutions in Managing Third-Party Risks

Whenever an organization outsources part of its business process to an outside party, it introduces various risks to the primary organization. Third-party risk management refers to how organizations address and mitigate security risks across their entire library of vendors and suppliers. Unfortunately, third-party risk exposure can be difficult to manage and comes with many challenges organizations must address for an effective third-party risk management program.

Predicting the stability of security ratings over time

The concept of ratings has been the accepted standard for making investment decisions. The first commercial credit reporting agency, the Mercantile Agency, was founded in 1841. While this relied on largely subjective methods of evaluation, it wasn’t until the 1960s, when credit reporting became computerized, that the industry consolidated and took off. Since then, credit and financial ratings models have progressed to become objective and trustworthy data points that inform lending decisions.

Supply Chain Resilience: 4 Ways to Get Ahead of Third-Party Cyber Risk

Recent events, including the 2020 COVID-19 pandemic, shifts in demand, and labor shortages have shone a spotlight on supply chain resilience – or lack thereof. In response, business leaders recognize that becoming more resilient is a necessity and are looking at strategies for doing so. As a best practice, Gartner recommends that companies diversify their manufacturing networks, utilize regional or local supply chains, add buffer capacity, and more.

Road to DORA and PS21/3 Compliance: Leveraging Technology to Reduce Risk

In today's interconnected and digital world, businesses face increasing risks, particularly in the realm of cybersecurity. To address these risks and ensure the operational resilience of financial institutions, industries and governments push for regulatory frameworks. Two prominent examples are the EU's Digital Operational Resilience Act (“DORA”) and the UK's Prudential Standard PS21/3 (“PS21/3”).

Introducing Bitsight Third-Party Vulnerability Response

Bitsight Third-Party Vulnerability Response empowers organizations to take action on high-priority incidents at a moment’s notice. Learn how to initiate vendor outreach and track responses to critical vulnerabilities through scalable templated questionnaires—with tailored exposure evidence— for more effective remediation. And grow and build trust across your ecosystem without worrying about expanded risk.

Cybersecurity's Crucial Role Amidst Escalating Financial Crime Risks

In an era of escalating financial crimes, the spotlight shines brightly on the rising concerns in the realm of cybersecurity. According to a recent survey, a staggering 68% of UK risk experts anticipate a surge in financial crime risks over the next year. These apprehensions echo globally, with 69% of executives and risk professionals worldwide foreseeing an upswing in financial crime risks, predominantly fueled by cybersecurity threats and data breaches.

The SEC's New Cybersecurity Regulations: Understanding the Impact for Companies & Their Shareholders

The increasing sophistication and frequency of cyber threats have exposed companies to significant risks, including data breaches, financial losses, and reputational damage. Investors have become deeply concerned that these risks can negatively impact their investment decisions. As we have previously discussed, companies and their shareholders must tackle the significant and constantly changing challenge of understanding cybersecurity risk.

3 Best Practices for External Attack Surface Management

Your external attack surface is growing rapidly. The adoption of cloud technologies, business growth, a remote workforce, IoT, and a growing supply chain of digital vendors creates an enormous digital footprint and increased cyber risk. External attack surface management (EASM) can help you mitigate and manage this risk—proactively and at scale.

8 Key Elements of a Third-Party Risk Management Policy

Any organization that relies on third-party vendors for critical business functions should develop and maintain an effective third-party risk management (TPRM) policy. A TPRM policy is the first document an organization should create when establishing its TPRM program. TPRM policies allow organizations to document internal roles and responsibilities, develop regulatory practices, and appropriately communicate guidelines to navigate third-party risks throughout the vendor lifecycle.

Key Steps to Developing an Effective Third-Party Risk Management Program

A Third-Party Risk Management Program (TPRM) is a systematic approach to mitigating risks associated with third parties, such as vendors, suppliers, and contractors. It includes an assessment process that identifies, evaluates, and remediates any risks affecting your organization. Implementing effective third-party risk management (TPRM) measures can safeguard organizations against potential threats and promote seamless and confident collaborations with external partners.

Choosing Automated Risk Remediation Software (in 2023)

When it comes to improving your cybersecurity posture, few strategies have as much of an impact as your cyber risk remediation program. Efficient risk remediation ensures security risks and vulnerabilities are shut down faster, reducing the potential risks of data breaches and their financial impacts. The cornerstone of an efficient remediation program is cyber risk remediation software that automates manual processes to improve the efficacy of risk mitigation efforts.

How to Build a Risk Register for Your Business

Every successful risk management program works by identifying, analyzing, prioritizing, and mitigating risks. In most enterprises this process is repeated at regular intervals, so that organizations can generate data each time about the threats to business operations, the risk those threats pose, and the steps necessary to reduce risk. That is an enormous amount of data a company must track. To do so — and to do so smartly — companies can build a risk register.

Checklist for Third-Party Risk Assessments

Amid escalating data breaches and supply chain attacks, businesses are placing an unprecedented emphasis on third-party risk management. That’s a logical and prudent idea, but achieving this level of security requires a comprehensive approach — which makes a checklist for third-party risk assessment indispensable. In this article, we’ll explore what that checklist for third-party risk assessments should contain.

What are the Principles of Information Security?

Information security is the effort companies undertake to protect their enterprise data information from security breaches. Without information security, an organization is vulnerable to phishing, malware, viruses, ransomware, and other attacks that may result in the theft, tampering, or deletion of confidential information. The average cost of a single incident can run $4.45 million.

What Is Financial Crime Risk Management (FCRM)?

Financial crime risk management (FCRM) is the practice of proactively looking for financial crime, including investigating and analyzing suspicious activity, rooting out vulnerabilities and taking steps to lower an organization’s risk of becoming a victim. For organizations in every industry across the globe, an effective FCRM strategy has never been more important.

Play Your Cards Right: How to Adapt Your GRC Program to the Modern Tech Stack

With the drastic evolution of the modern tech stack over the last few years, cloud-based services and tools now power everything from fundamental infrastructure to communication to cybersecurity. GRC programs have had to keep pace and many are still playing catch up—what a gamble. 🎲 What You'll Learn We're laying all our cards on the table, exposing the risks that come with leveraging the cloud services in a modern tech stack to power your operations and showing you how to stack the odds in your favor.

Want to Reduce Your Cyber Risk? Increase Diversity!

A customer walks into a clothing store to purchase a pair of pants. The salesperson directs them toward ten racks, all filled with khaki pants. Some are slightly different colors. Others are hemmed differently. But overall, the pants are essentially identical: monotonous, repetitive and drab. The problem is, the customer wants jeans, yoga pants and navy slacks. They feel isolated, confused and like they don’t belong. They leave the store without buying anything.

Introducing Snyk's new Risk Score for risk-based prioritization

We’re happy to announce the open beta availability of Snyk’s new Risk Score! Replacing the existing Priority Score, the new Risk Score was designed to help you prioritize more effectively by providing you with an accurate and holistic understanding of the risk posed by a given security issue.

What is Cybersecurity Risk and How Can You Manage It?

In the world of risk management, risk is commonly defined as threat times vulnerability times consequence. The objective of risk management is to mitigate vulnerabilities to threats and the potential consequences, thereby reducing risk to an acceptable level. When applied to cybersecurity risk, this equation provides a great deal of insight on steps organizations can take to mitigate risk.

6 Myths About Cybersecurity Ratings (and 1 Truth)

Today, electricity is so ubiquitous that it’s difficult to perform even basic tasks without it. But when electricity was first introduced, it took decades for broad acceptance and adoption because it was misunderstood and misused. Slowly, the benefits began to outweigh the cons. As with any innovation, there are setbacks, but electricity has overwhelmingly been a force for good. The same can be said about cybersecurity risk ratings. Are they perfect? No.

New SEC cybersecurity rules: Five things every public company CISO should do now

By now you’ve heard about the new cybersecurity rules from the U.S. Securities and Exchange Commission (SEC) requiring public companies to report material cybersecurity incidents and disclose critical information related to cybersecurity risk management, expertise, and governance. Companies will be required to disclose risks in their annual reports beginning on December 15, 2023.

Positive Risk vs. Negative Risk in Enterprise Risk Management

Businesses face risk all the time – and that’s OK. Even though the word “risk” typically has negative connotations, the term can actually represent many situations, not all of them unfavorable. ISO 31000 states that risk is the “effect of uncertainty on objectives.” That actually means risk can come in two types: positive and negative.

How to Negotiate the Best Cyber Insurance Policy

Most companies will quickly accept the insurance provider's first offer when negotiating cybersecurity insurance policies. Although a relatively new component of the insurance sector, providers have still been conducting cyber assessments and offers for years and are the so-called expert. ‍ However, this way of thinking costs enterprises thousands, if not millions, of dollars a year in deductibles.

Cybersecurity in the Entertainment Industry: Risks and Solutions

Book publishers, movie distributors, TV producers, game developers, and newspaper publishers are just a few of the many businesses in the media and entertainment industry increasing their use of online services. Streaming services and the production of digital assets are the norm for media companies around the globe.

What is a Whaling Attack and How to Prevent It

A whaling attack is a type of phishing attack that targets senior executives. The act of whaling is usually perpetrated via email and involves deceiving victims into initiating actions that put the organization and its assets at risk. In this blog, we explore how a whaling attack works, why executives are targeted, examples of successful whaling attacks, and steps you can take to prevent them.

7 Third-Party Risk Management Trends to be Aware of in 2024

Whether your organization is prepared or not, the risks associated with third-party partnerships will continue to increase. In 2022, approximately 1,802 data breaches exposed the information of more than 422 million individuals in the United States alone. While those numbers are enough to frighten any organization, many reports expect them to continue to rise throughout 2024.

Choosing Automated Vendor Risk Remediation Software (in 2023)

Vendor Risk Management is critical for reducing the impact of security risks associated with third-party vendors. But often included with this cybersecurity practice is a bloat of administrative processes that disrupt workflows and impact VRM efficacy, defeating the purpose of even having a VRM program. To establish a scalable Vendor Risk Management program, cybersecurity teams should take advantage of every opportunity to replace manual processes with automation technology.

What is Cyber Insurance? (And Is It Worth the Costs?)

Cyber attacks have grown significantly over the last few years, and their cost to victim organizations marches ceaselessly upward as well. Now many of those victim organizations are learning the hard way that business insurance policies often won’t cover the regulatory fines from security incidents that are considered “preventable.” Hence the need for extra protections from “cyber insurance” to fill any coverage gaps you might have.

Spot risks with our new IP view

Customers often tell us of instances where someone in their team spins up a new machine that isn’t using an approved geolocation, or that they see an unexpected spike in hosting from a particular country. These anomalies can put an organization at risk, especially since they are difficult to spot in an automated way.

NIST Cyber Risk Scoring

As companies continue to face new and increasing cybersecurity risks, the National Institute of Standards and Technology (NIST) has developed a cyber risk scoring methodology that helps organizations to assess, quantify, and manage their cybersecurity posture effectively. The NIST Cyber Risk Scoring solution improves NIST’s security and privacy assessment processes by providing real-time contextual risk data, enhancing awareness, and prioritizing necessary security actions.

An Easy Guide to Understanding Risk Management and Quantification, Part 1

When it comes to securing your enterprise and keeping it safe, your success depends on effective communication. How can you explain cyber risks to the board in a way that's easy to understand, yet still packs a punch? Cyber Risk Quantification (CRQ) is a methodological approach that allows security teams to measure and quantify cyber risks in financial terms.

What Data Breaches Tell Us: An Analysis of 17,000 U.S. Data Breaches

Data breach attacks are serious problems for companies, organizations and institutions all over the world. For example, in the US one data breach costs on average 9.4 Million USD, which is the highest worldwide. To handle—or ideally, prevent—these attacks, we need to understand first the “why” and “how” of an attack. With this objective in mind, Bitsight analyzed more than 17,000 data breach events from the last seven years affecting 23 sectors in the US.

Safeguard Your Business From the Risks of Social Media

In recent years, social media platforms have become invaluable tools for businesses to engage with their customers, reach a wider audience and enhance their brand visibility. From TikTok’s viral challenges to Instagram’s visually appealing content — and the ever-present Twitter and Facebook — these platforms offer unparalleled opportunities for organizations to connect with their target market. However, with great opportunities come great risks.

CIS Critical Security Controls: What Are They and How Can You Meet These Standards?

s cyber threats evolve and business models change, maintaining a mature cybersecurity program can be challenging. You need to be confident that your organization’s current security tools and techniques are effective. A single error or postponement in resolving a software problem can create weaknesses in your IT infrastructure, increasing the likelihood of cyber attacks.

Top 5 Security Vulnerabilities of 2023

2023 is a year of “digital forest fires.” The MOVEit and the Barracuda Networks’ email supply chain attacks underscore the massive butterfly effect a single software flaw can have on the threat landscape. Supply chain attacks spread like a forest fire. Once cybercriminals compromise widely used software, attackers gain access to potentially all organizations that use that software.

The Importance of Security Risk Assessments and How to Conduct Them

IT risk assessments are vital for cybersecurity and information security risk management in every organization today. By identifying threats to your IT systems, data and other resources and understanding their potential business impacts, you can prioritize your mitigation efforts to avoid costly business disruptions, data breaches, compliance penalties and other damage.

What Is Risk Communication?

Risk management is a team sport. So whether we are assessing health risks during a pandemic, understanding the effect of natural disasters, or trying to block a cybersecurity attack, risk communication serves a vital purpose. Risk communication aims to inform and educate individuals so they can make informed decisions and take appropriate actions in the face of uncertainty.

Why Independent Benchmarking Data is a Critical Part of SEC Cybersecurity Disclosure Strategy

On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) voted to adopt new cybersecurity requirements for publicly traded companies. These regulations create new obligations for reporting material cybersecurity incidents and disclosing critical information related to cybersecurity risk management, expertise, and governance. Companies will be required to disclose risks in their annual reports beginning on December 15, 2023.

Choosing a Financial Services Cyber Risk Remediation Product

In 2022, the finance industry suffered the second-highest number of data breaches. Besides implementing an attack surface management solution, the finance sector must also ensure its remediation product can quickly and efficiently address cybersecurity risks. If you’re in the market for a cyber risk remediation product, this post outlines the key features to look for to maximize the ROI of your new IT security tool. Learn how UpGuard protects financial services from data breaches >

Choosing a Tech Cyber Risk Remediation Product (Key Features)

Cyber risk remediation, the process of actively identifying, remediating, and mitigating cybersecurity risks, is particularly critical for the technology industry. With its characteristic enthusiasm towards adopting the latest trends in innovation, without a cyber threat remediation product, tech companies are unknowingly increasing their risk to a swatch of data breach risks.

3 Tips for Improving your Cybersecurity Intelligence

Cybersecurity intelligence is a powerful weapon against risk. It enables you to discover, proactively respond, and mitigate emerging threats—internally and across your supply chain. But how can you improve your cybersecurity intelligence without overburdening busy teams? Here are three ways you can combine technology, processes, and people to effectively acquire, analyze, and disseminate intelligence to improve your organization’s security posture.

Security Misconfigurations: Definition, Causes, and Avoidance Strategies

Misconfigured security settings can be disastrous for a company’s cybersecurity. In 2019, for example, a researcher discovered a security misconfiguration in the popular project management tool Atlassian JIRA that allowed him to access a vast amount of confidential data from companies that used JIRA. Unfortunately, Atlassian’s error is all too common.

New SEC Cyber Requirements Unite Security Leaders and Business Stakeholders

It all started with a statement from the US Securities and Exchange Commission’s (SEC) Jaime Lizárraga. The commissioner revealed that a staggering 83% of companies suffered from multiple data breaches last year, with an average expense of $9.44 million in the United States— a dramatic increase of 600% over the past ten years.

Why cyber insurance should be part of any comprehensive risk management strategy

The recent rise of ransomware, attacks on supply chains and increasing costliness of privacy regulations has made cyber insurance an important topic of discussion. But it can be tricky to keep up with cyber insurance requirements. One of the most robust ways to meet those requirements is with multi-factor authentication (MFA).

What is the SSL Not Available Risk?

So you've received a critical risk finding for SSL not available, which means your domain does not have an SSL certificate installed on the server. To resolve this finding, you can generate and supply an up-to-date SSL/TLS certificate on your site. SSL, which stands for secure sockets layer, and its successor TLS, or transport layer security, are internet protocols for securing traffic between systems with an encryption algorithm.

What is Risk Modeling?

Investments in effective risk management, and especially in IT systems to manage risk, have historically paid huge dividends. In a 2023 PwC US Risk Perspectives Survey, 57 percent of C-suite respondents reported seeing better decision-making capabilities thanks to investments in such applications. But there is still significant room for improvement in enterprise risk management, starting with better risk modeling and forecasting.

Simplify AppSec program management with Software Risk Manager

In a world where software risk is business risk, you need a robust ASPM solution that simplifies testing, triage and risk management. Now more than ever, organizations are realizing that software risk is business risk, and making application security programs scalable and efficient is paramount to successfully managing that risk.

What is a Cybersecurity Risk Assessment?

A cybersecurity risk assessment is an examination of an organization or potential vendor’s current technology, security controls, policies, and procedures and which potential threats or attacks could affect the company’s most critical assets and data. Organizations can use cybersecurity risk assessments to understand their ability to protect sensitive data, information, and critical assets from cyber attacks.

Your Ultimate Guide to AICPA's SOC 2 Updates

Cybersecurity is ever-changing and a critical consideration for business survival. One must always be prepared to keep their business secure and their customers satisfied. But how do you keep up with all the compliance framework changes, such as last October’s SOC 2 guidance updates? This was my challenge as the GRC manager at a SaaS startup: an updated compliance framework version would be released, and I’d need to figure out how to incorporate the new requirements.

Following METI's Attack Surface Guidance with Bitsight

On May 29 2023, the Cybersecurity Division of the Commerce and Information Policy Bureau of the Ministry of Economy, Trade and Industry of Japan (METI) released an introduction guidance on Attack Surface Management (ASM) as a response to the increased cyber threats as a result of companies’ rapid digital transformation has led to a dynamic and growth of their internet footprint and possible attack vectors.