Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

September 2023

Effective Risk Management: The COSO ERM Framework

Enterprise risk management (ERM) frameworks allow organizations to identify, assess, manage, and monitor risks across all levels of an organization. One of the most well-known approaches to ERM is the COSO ERM framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The framework offers guidelines and best practices for organizations seeking to achieve a balanced perspective on risk.

Qualitative vs. Quantitative Cybersecurity Risk Assessment

Risk mitigation is at the heart of cybersecurity. By connecting to the Internet, implementing upgraded IT systems, or adding a new vendor to your organization, you are automatically exposing your business to some level of cyber risk. With outsourcing on the rise and a growing reliance on vendors who are processing, storing, and transmitting sensitive data, assessing and mitigating risk is becoming increasingly important.

Overcoming Cybersecurity Headwinds Part 2: Automation and Repurposing Time Savings

Welcome back to our Overcoming Cybersecurity Headwinds blog series—inspired by my latest webinar about third party risk with Marc Crudginton, CISO at Howard Hughes Corporation. In our last blog, we explored the wisdom of centrally managing cyber risk efforts across your organization and your third-party supply chain—a strategy that helps you do more with less in an era of budget constraints. Today, we dive deeper into the core of efficient Third Party Risk Management (TPRM): Automation.

Combining IT and OT security for enhanced cyber risk management

Historically, IT and OT have operated in separate worlds, each with distinct goals and protocols. IT, shaped by the digital age, has always emphasized the protection of data integrity and confidentiality. In this space, a data breach can lead to significant consequences, making it crucial to strengthen digital defenses. On the other hand, OT, a legacy of the Industrial Revolution, is all about ensuring machinery and processes run without interruptions.

How we operationalize security risk assessments at Vanta

This post is part of an ongoing series where you’ll hear directly from Vanta’s own Security, Enterprise Engineering, and Privacy, Risk, & Compliance Teams to learn about the team’s approach to keeping Vanta—and most importantly, our customers—secure. In today’s post, you’ll hear from Rob Picard, who leads Vanta’s Security team, and Matt Cooper, who leads Vanta’s Privacy, Risk, & Compliance team. ‍

GDPR Compliance Guide: A 9-Step Checklist

With many nuances to consider, adhering to the General Data Protection Regulation (GDPR) requirements can be a daunting task. After all, the entirety of the GDPR consists of a whopping 99 Articles. Fortunately, by following a GDPR security checklist, you can help your organization ensure that all required facets of data security are covered without sifting through pages and pages of legalese.

A Deep Dive into the Exploit Prediction Scoring System EPSS

The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild. EPSS’s goal is to assist network defenders to better prioritize vulnerability remediation efforts. While other industry standards have been useful for capturing innate characteristics of a vulnerability and provide measures of severity, they are limited in their ability to assess threat. EPSS fills that gap because it uses current threat information from CVE and real-world exploit data.

5 Strategies to Reduce Attack Surface Exposure

Bitsight was recently named an Overall Leader in the 2023 KuppingerCole Analyst AG Leadership Compass for Attack Surface Management. The report—which provides an overview and comparison of relevant vendors in defined segments—also identified Bitsight as a leader in several other categories, including Product Leader, Innovation Leader, and Market Leader. To read the in-depth report analysis, download your free copy here.

Effective Cybersecurity and Risk Management Starts Here

Hear first hand from Chief Technical Officer, Randy Watkins, as he explains why attack surface mapping is critical to an organization’s security posture and managing their IT assets. Learn how prioritizing security risk helps to cut through a sea of security issues and gives focus to security teams on what is critical.

Unpacking ISO 31010: Effective Risk Assessment Techniques

ISO 31010 is a supplementary document to the risk management standard ISO 31000. It was developed to support the risk assessment process in ISO 31000, outlining different risk assessment techniques to broaden the scope of an organization’s risk evaluation methods. This post offers a comprehensive overview of ISO/IEC 31010, highlighting the standard’s potential to increase the effectiveness of risk management strategies. Learn how UpGuard streamlines Vendor Risk Management >

How to Prevent Third-Party Vendor Data Breaches

Third-party data breaches can happen at any time to any organization. This type of breach occurs when a vendor (or some other business partner) holding your company’s data suffers a breach, and your data is exposed. According to the Verizon 2022 Data Breach Investigations Report, 62 percent of all data breaches happen via third-party vendors.

SmokeLoader's Plugins

SmokeLoader is a well-known malware family that has been around for more than 10 years. Its main purpose is to download and drop other malware families. However, SmokeLoader's operators also sell plugins that add capabilities to the main module. Those plugins allow an affiliate to collect browser data from infected computers, as well as emails, cookies, passwords, and much more. In this blog post, we'll dissect SmokeLoader's plugins that were received by an infected computer from the botnet "0020".

Power Up with AI - How to Take Your GRC to the Next Level

Get ready to dive into the intersection of AI and GRC, where leveling up your program isn't just a metaphor – it's the next level of success. GRC leaders are discovering how AI is the ultimate power up, enhancing their security posture and helping them knock out risks and liability proactively. With AI by their side, GRC teams are dashing through challenging security questionnaires, scoring points with customers, and leaving their competitors in the dust.

What is the Cost of Cyber Liability Insurance?

In today’s digital age, where businesses rely heavily on technology and data, the risk of cyberattacks and data breaches has become a constant concern. These incidents can lead to significant financial losses, damage to a company’s reputation, and even legal liabilities. To mitigate these risks, many businesses turn to cyber liability insurance. But what exactly is the cost of cyber liability insurance, and how do insurers determine it?

5 Risks Of Outdated Software & Operating Systems

One of the most common ways that hackers target organizations is by exploiting vulnerabilities in outdated software. Outdated software risks can leave you open to a variety of hacks, including ransomware, malware, data breaches, and more. The fact is, failing to update your software doesn’t just mean you’re missing out on the latest version—it means you could expose your organization to major security vulnerabilities, like the widespread Apache Log4j2 vulnerability.

What is Cyber Attack Insurance?

Businesses of all sizes are increasingly reliant on technology to conduct their operations efficiently. While technology offers numerous benefits, it also exposes organizations to a growing threat—cyber attacks (or cyberattacks). As the frequency and sophistication of cyber threats continue to rise, businesses are turning to a crucial safeguard: cyber attack insurance.

Why we need to democratize governance, risk, and compliance

Today’s uncertain economy has presented an array of problems to organizations of every size and across all industries. In the world of tech titans alone, 70,000 jobs have been lost over the past year. It’s safe to say that businesses have laid off and lost talented and experienced professionals from their rosters. We feel losing talent more acutely in cybersecurity and privacy as risk of cyberattacks and breaches may cost the global economy $10.5 trillion annually by 2025.

What is Calculated Risk in Business?

Every business decision involves an element of risk. Management’s job is to assess that level of risk as best as possible, and to weigh that risk correctly against the potential rewards. That risk-versus-reward equation is the basis for taking calculated risks, often referred to as your “risk-adjusted return on investment.” So how should an executive team approach this process?

Cloud Threats Memo: Mitigating the Risk of Third-party Apps

The use of third-party apps (also known as “connected apps”, “cloud to cloud apps”, “OAuth apps”) are apps developed by external and internal developers or organizations that can interact with and extend the functionality of a primary SaaS App. These are growing exponentially across organizations.

5 Steps to Performing a Cybersecurity Risk Assessment

There’s no such thing as one-size-fits-all cybersecurity. Every organization faces a unique set of security risks, and needs to take its own unique approach to cybersecurity risk assessment. Unfortunately, however, cybersecurity risk assessments aren’t easy to undertake, and getting started can be the most challenging part of your risk management strategy. To help, we’ll take you through the process step by step.

What is ISO 31000? An Effective Risk Management Strategy

ISO 31000 was specifically developed to help organizations effectively cope with unexpected events while managing risks. Besides mitigating operational risks, ISO 31000 supports increased resilience across all risk management categories, including the most complicated group to manage effectively - digital threats. Whether you’re considering implementing ISO 31000 or you’re not very familiar with this framework, this post provides a comprehensive overview of the standard.

The Top 7 Cyberattacks on U.S. Government

In a world where ones and zeros are the new battleground, these threats, cyberattacks have become a significant threat to governments worldwide. The United States, with its vast array of government agencies and critical infrastructure, is no exception. Cybersecurity threats that impact the public sector range from state-sponsored attacks to financially motivated hacking groups. In this blog post, we’ll delve into the top 7 cyberattacks on the U.S.

3 Tangible Benefits of an A Rating

Security ratings are a standard in cybersecurity. Many organizations rely on them to manage their security programs and they create ROI for the organization. Despite the potential benefits, it can be challenging for organizations who are evaluating different security ratings options to determine the value they will get from them. When making investment decisions, it’s essential to know where the investment will take you and quantify that benefit.

Overcoming Cybersecurity Headwinds Part 1: Start With a Unified Approach

In today's digital economy, every industry faces the challenge of doing more with less. Cybersecurity, a critical pillar of modern business operations, is no exception. Organizations are confronted with the need to secure their digital ecosystems while navigating budget constraints. As their supply chains expand, so do the risks—and the costs.

Cyber Risk Exposure: How to Act When You Can't Measure Risk

You can’t manage what you can’t measure – and unfortunately, measuring cyber risk exposure can be quite difficult. That’s not, of course, because no one attempts to put labels on risks and threats. In fact, there is a great deal of effort placed on identifying, quantifying, and deciding how to manage cyber risk.

UpGuard Summit September 2023 - Panel Discussion

Join our moderator Will Scott as he sits down with three of our knowledgeable customers, who share their best cybersecurity risk management practices. Guest Speakers Abhi Arora - Information Security Lead at Teneo Nomfundo Ndlanya - Group Governance, Risk & Compliance Manager at Coca-Cola Beverages Africa Thibault Millant - Information Security Officer at Scorpio Group.

Why Reduce Software Supply Chain Risks with Intelligent Software Security

There’s a growing array of risks lurking within the supply chain of the digital solutions we increasingly depend upon. Leaving gaps in your software supply chain security (SSCS) could spell disaster for your organization. Let’s explore how new analysis defines an end-to-end solution and why Veracode was ranked as an Overall Leader, Product Leader, Innovation Leader, and Market Leader in the Software Supply Chain Security Leadership Compass 2023 by KuppingerCole Analysts AG.

Using a Standardized Approach for Measuring Cybersecurity in Government

Last week at the annual Billington CyberSecurity Summit in Washington, DC, officials from government agencies gathered with industry leaders to discuss cyber threats, as well as geopolitics and issues of national security. One of the highlights was a fireside chat on Friday with Anne Neuberger, deputy national security adviser for cyber and emerging technology.

CIO Vs. CISO: Who Does What?

Every organization handles security differently, based on their needs and internal structure—but in some mid-sized and large companies, both the chief information officer (CIO) and the chief information security officer (CISO) are involved. This can set up a CIO vs. CISO standoff. Indeed, historically, the relationship between the CIO and CISO has been described as adversarial but ever-evolving.

The SEC's New Cybersecurity Regulations Part II: What Shareholders Should Know

It seems everyone is concerned about cybersecurity these days, and the investor community is no different. Shareholders are reading the headlines—ransomware attacks, data breaches, infrastructure disruptions—and they are wondering how these incidents could impact the companies that they invest in. Shareholders are about to get a lot more information from companies in the months ahead. In July 2023, the U.S.

What a Cybersecurity Risk Management Process Entails

Organizations today are at greater risk of a cyberattack than ever before, and that risk will only grow as new technologies keep emerging in the future. That means an ever greater need for cybersecurity risk management — that is, the process of identifying, analyzing, prioritizing, and mitigating your organization’s cybersecurity risks.

Software risk as business risk: The importance of building trusted software | Synopsys

Join us at the Synopsys User Conference 2023 in Bengaluru as we explore the critical link between software risk and business risk. Discover the implications of software vulnerabilities, cybersecurity incidents, and the importance of building trust in your software supply chain. Gain insights into managing business velocity while maintaining secure software development practices. Learn why software security is a top priority in today's rapidly evolving technological landscape and how it impacts your organization's risk management.

The SEC's New Cybersecurity Regulations: What Investors and Shareholders Should Know

It seems everyone is concerned about cybersecurity these days, and the investor community is no different. Shareholders are reading the headlines—ransomware attacks, data breaches, infrastructure disruptions—and they are wondering how these incidents could impact the companies that they invest in. Shareholders are about to get a lot more information from companies in the months ahead. In July 2023, the U.S.

Navigating APRA's CPS 234: A Universal Metric

In an era where digital innovation has become the lifeblood of businesses, cybersecurity has taken center stage in the corporate world. The Australian Prudential Regulation Authority (APRA) recognized this need and introduced CPS 234, a regulation that puts cybersecurity at the forefront of APRA-regulated entities. APRA is currently conducting an independent tripartite cyber assessment of compliance with CPS234, which took effect in 2019.

What are Software Supply Chain Attacks?

Software supply chain attacks, or digital supply chain attacks, have become increasingly prevalent over the last couple of years. According to a study by KPMG, 73% of organizations have experienced at least one significant disruption from a third-party in the last three years. What’s the best way to protect against potential software supply chain attacks? To get the answer, let’s define what those attacks are, how they happen, and how you can defend against them.

An Easy Guide to Understanding Risk Management and Quantification, 2

‍This is the second of a two part series on highlighting the power of cyber risk quantification, based on a webinar hosted by Kovrr’s Director of Product Management, Amir Kessler. Part two delves into the transformative potential of converting cyber risks from financial insights to actionable plans. Watch the full webinar here.

Today's Top Risk Management Frameworks

Business environments change every day. That’s why using a risk management framework is a crucial part of any organization. It helps manage different kinds of threats you face day in, day out. Organizations with robust RMFs are better prepared to thrive and adapt in this unpredictable world, ensuring their continued success and resilience. This article introduces risk management frameworks and explains the significance of using one in your organization.

How to Build a Customized TPRM Framework

Third-party risk management (TPRM) is reviewing and mitigating risks associated with outsourcing business operations to third-party vendors or service providers. Risks are varied but include cybersecurity risks like data breaches or reputational risks that affect business continuity. If your organization wants to create a TPRM program or upgrade your current risk management strategy, focusing on customization can be critical in setting your organization apart.

An Overview of ENISA's Risk Management Standards Report

The European Union Agency for Cybersecurity (ENISA) published its Risk Management Standards report on March 16, 2022. The report's primary objective was to produce an organized overview of all published standards that address aspects of risk management. Subsequently, ENISA aimed to describe the various methodologies organizations can use to implement the risk management frameworks it covers.

What You Need to Know About Security Compliance Management

Security compliance management is that set of policies, procedures, and other internal controls that an organization uses to fulfill its regulatory requirements for data privacy and protection. Put another way, security compliance management is a subset of regulatory compliance management that specifically addresses data protection. Clearly security compliance management is important.

The Statistical Analysis of Measuring Cybersecurity Risk

Businesses are more at risk of cyber attacks than ever before. Calculating that risk, however, can be a challenging task. In this post we will provide an overview of traditional calculation methods and explore the future of measuring cybersecurity risk: statistical analysis. The cost of a cyberattack can be painfully high, sometimes high enough to shut down business operations entirely.