Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2024

Data Localization: Definition, Benefits and Challenges

With the increase in privacy regulations, data localization is a rapidly growing concern for companies. With the right strategies and tools in place, companies can ensure their data remains secure and compliant with privacy laws while also benefiting from its localization. In this blog, we’ll explore what data localization is, the benefits and challenges, and how using the right set of tools can help.

Enabling More Precise Evaluation of Email Security with DMARC

Email is a well-known and widely used attack vector for malware distribution, phishing, and many other types of threats. For this reason, we evaluate certain email security practices as part of the Diligence category of risk vectors used to calculate Bitsight Security Ratings. On April 30, 2024, we added a new email security evaluation focused on the use of Domain-based Message Authentication, Reporting, and Conformance (DMARC) records.

Keeper Webinar: Building a Robust Governance, Risk & Compliance Framework: Challenges & Solutions

IT Compliance doesn't have to be chaotic. Join Teresa Rothaar, Keeper Security's Governance Risk & Compliance Senior Analyst, in this webinar for ActualTech Media on the challenges and solutions to build a robust GRC framework. Keeper helps every organization get full visibility and control over employee password strength, credential sharing, permissions, zero-trust network access and dark web exposure, strengthening auditing and compliance for HIPAA, PCI DSS, SOX, GDPR, CCPA and more.

Identity risk management: What is it and how can you achieve it?

Risk. It’s more than just an infuriating board game from your childhood. And when identity risk is involved in your cybersecurity landscape – and it will be involved, since identity is one of the most easily accessible and most frequently attacked facets of your IT environment – the potential consequences of its compromise extend well beyond losing control of a fantasy continent on a game board.

NIS2 Compliance Checklist (Free)

In January 2023, the European Commission (EC) released an updated version of the European Union (EU) Network and Information Security Directive (NIS2) to strengthen cybersecurity risk management across Europe’s essential services. NIS2 updates the original NIS directive and focuses more on regulations for cloud infrastructure, internet exchanges, domain service providers, and digital service providers.

What is the Critical Entities Resilience (CER) Directive?

The Critical Entities Resilience (CER) Directive is a new initiative in the EU that aims to ensure that critical entities providing essential services are effectively managing their network and information security. The CER Directive is part of the EU’s latest effort to build stronger cyber resilience across Europe, alongside NIS2 and the EU Cyber Resilience Act.

What is the Connecticut Data Privacy Act (CTDPA)?

The Connecticut State Government signed the Connecticut Data Privacy Act (CTDPA) into law on May 10, 2022, and the law became effective on July 1, 2023. The CTDPA joins the ranks of other US state privacy laws, like the California Consumer Privacy Act (CCPA) and the Colorado Privacy Act, providing Connecticut consumers with robust data privacy rights and protections.

What is the Oregon Consumer Privacy Act (OCPA)?

The Oregon State Government passed Senate Bill 619, also known as the Oregon Consumer Privacy Act (OCPA), in July 2023. The OCPA will become effective on July 1, 2024, the same day the Texas Data Privacy and Security Act will also impose obligations on data controllers and processors. Oregon’s privacy legislation follows the structure of several other US data privacy laws, including the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and the Montana Consumer Privacy Act.

The EU's Strategy for a Cybersecure Digital Single Market

The EU Digital Single Market Strategy (DSM Strategy) is a comprehensive initiative launched by the European Union to enhance Europe’s digital economy and maximise its growth potential across member states. The strategy includes evolving policies and specific initiatives aimed at the digitalisation of the European Union and adapting it to the rapidly changing digital ecosystem.

Insights from the Experts: Legal, Compliance, and Security Perspectives on SEC Regulations

In July 2023, the U.S. Securities and Exchange Commission (SEC) announced new cybersecurity rules that require publicly traded companies in the U.S. to disclose material cybersecurity incidents within four business days of determining whether the incident is material to the company’s financial performance. SecurityScorecard recently hosted a webinar discussing the implications of the new rules and how compliance, security, and legal experts can elevate their game to meet these new regulations.

Webinar: Incorporating Digital Risk Exposure in Your Threat Detection Strategy

Watch as Kroll experts Wojcieszek and Scott Hanson outline the key benefits of incorporating surface, deep and dark web intelligence into your threat detection and response plans. During the session, they discuss the top use cases of digital risk protection and the best approaches to mapping out and reducing your digital risk across all areas of the internet. They also outline how security teams can use this external threat intelligence to improve their threat detection and response efforts and get wider visibility across the attack lifecycle.

New Drill Down Feature Illuminates a Deeper View of Cyber Risk Drivers

‍The power of an on-demand cyber risk quantification (CRQ) platform lies in its ability to harness an extensive amount of data, filter it, and consequently produce an objective assessment that offers key stakeholders an understanding of how likely their organization is to experience certain cyber events, along with the respective financial losses.
Featured Post

Human risk management automation can help beat burnout

Cyber criminals are relentlessly exploiting new technologies to improve their chances of success. As such, security professionals are feeling the pressure of keeping watch against these threats and trying to stay a step ahead of these criminals.

Understanding how Rationality, Deterrence Theory, and Indeterminism Influence Cybercrime.

Understanding the factors influencing cybercriminal behavior is essential for developing effective cybercrime prevention strategies. Rationality plays a significant role in shaping criminal decisions, particularly through the lens of the rational actor model and deterrence theory.

Vulnerability Management Benchmarking: Metrics and Practices of Highly Effective Organizations

This webinar dives deep into vulnerability management metrics, the challenges of maintaining cloud and ephemeral assets, and the discrepancies in vulnerability management across different organizations. Join us as we unravel the nuances of MTTR (Mean Time to Remediate), SLA (Service Level Agreements), and how high-performing organizations manage cybersecurity threats more efficiently. Don't miss this discussions on the role of data democratization in cybersecurity and how organizations can transition from reactive to proactive vulnerability management, no mature your VM maturity.

How Exposure Visibility Turbo Charges Strategic Security Prioritization

One of the biggest benefits that an exposure management program can afford a security program is the power of risk-informed prioritization. When security leaders think of tooling like attack surface management (ASM) platforms, the most evident prioritization benefits come in the day-to-day tactical decisions of which threats and which exposures to have SecOps practitioners tackle first.

360 degrees of application security with Snyk

Application development is a multistage process. The App goes through various stages, each with its own area of focus. However, application security, a.k.a. AppSec, is constant throughout all the stages. For example, when a developer codes, it’s expected that the code will be secure. Similarly, the artifacts that are worked upon or generated as an end output of the respective stages are all required to be secure.

What is the EU Cyber Solidarity Act?

The EU Cyber Solidarity Act is a new initiative that follows the European Union's latest efforts to build stronger cyber defenses against evolving cybersecurity threats. This legislation introduces a new strategy for enhanced cooperation between EU member states and focuses on how EU nations can better prepare and respond to cyber incidents.

How to Perform a Vendor Risk Assessment

Vendor risk assessments are critical for any organization that relies on third-party vendors. Third-party risk can negatively affect an organization’s security, compliance, and performance, resulting in devasting security breaches or disruptions in its supply chain that halt business operations. Organizations use vendor risk assessments to evaluate and manage third-party vendor risks associated with outsourcing business operations or procuring goods from external suppliers.

Insider Risk Management in 2024: A Comprehensive Guide

Insider risk management targets threats from the very heart of an organization—its people. Whether intentional or accidental, actions by insiders like employees, contractors, or partners can lead to severe financial and reputational damage. And as high-profile incidents of corporate sabotage and intellectual property theft by insiders continue to make headlines, businesses can no longer afford to be complacent.

Expanding Horizons: The Role of IoT in Catalyzing Business Growth

Welcome to the frontier of modern business operations, where the Internet of Things (IoT) is not just a buzzword but a transformative force. It's an era where everyday objects are imbued with connectivity, allowing for seamless interactions and smarter decision-making. But what makes IoT so crucial for businesses today?

Generative AI and Cyber Security

There has been a lot of talk about Artificial Intelligence (AI) in recent years. It is certainly a polarizing subject. While it raises hopes about the future of technology and what humanity is capable of, it also raises questions around human control and technological determination. There are those who worry that Artificial Intelligence is going to ‘take people’s jobs’, or even take over the world, and that the world will end up like a dystopian ‘Terminator’ style film.

Who is affected by NIS2 and what does it mean for your compliance?

In a regulatory landscape where new national, vertical, or international regulations are published on what seems like a weekly basis, the European Commission’s NIS2 Directive stands out. This legislation, which applies to all organizations operating across the European Union, has provided legally binding measures which organizations must abide by in order to ‘boost the overall level of cybersecurity in the EU.’

Leveraging Risk-Based Vulnerability Management with AcuRisQ

Maintaining an inventory of assets (websites, APIs and other applications) is a good start. However, when each of these websites have tens of open vulnerabilities, the sheer volume overwhelms you, leading to alert fatigue. Then, how do you decide where to begin? Enter Indusface AcuRisQ, the solution to your prioritization dilemma.

What is the Montana Consumer Data Privacy Act (MTCDPA)?

Montana Governor Greg Gianforte signed Senate Bill 384, the Montana Consumer Data Privacy Act (MTCDPA), on May 19, 2023. The consumer privacy law will become effective on October 1, 2024, and requires covered entities that process personal data to comply with several transparency and disclosure obligations. The MTCDPA follows the structure and scope of other US state data privacy laws, including the California Consumer Privacy Act, Tennessee Information Protection Act, and Colorado Privacy Act.

What is the Tennessee Information Protection Act (TIPA)?

Tennessee Governor Bill Lee passed the Tennessee Information Protection Act (TIPA) on May 11, 2023. TIPA becomes effective on July 1, 2025, and groups Tennessee with California, Colorado, Virginia, and other states that have published their own data privacy law while waiting for a comprehensive federal law from the U.S. Government.

Cyber Risk Solutions from Kroll

We are the world’s leader in incident response. Merging complete response capabilities with frontline threat intelligence from over 3000 incidents handled per year and end-to-end expertise we protect, detect and respond against cyberattacks. For immediate assistance, contact us via our 24x7 cyber incident hotlines. Tackle every facet of today and tomorrow’s threat landscape with guidance from Kroll’s Cyber Risk experts. Enriched by frontline threat intel from 3000+ incident response cases every year, Kroll’s protection, detection, and response solutions immediately mature your cyber posture.

Introducing UpGuard Trust Exchange

Security questionnaires represent the cornerstone of most third-party risk management (TPRM) programs. They allow organizations to responsibly appraise a vendor's security posture before they move forward with onboarding and grant the vendor access to internal systems and data. Nevertheless, most security teams feel burdened by time-consuming and lengthy security questionnaires, especially when faced with additional resource and staffing limitations.

Implementing A Vendor Risk Assessment Process in 2024

A Vendor Risk Assessment (also referred to as a third-party risk assessment) is a critical component of a Vendor Risk Management program. As such, the overall impact of your VRM efforts hangs on the efficiency of your vendor risk assessment workflow. This post outlines a framework for implementing a streamlined vendor risk assessment process to prevent potential data breach-causing third-party security risks from falling through the cracks.

Advanced GDPR Compliance Strategies for Cybersecurity

As digital transformation continues to multiply pathways to personal data, complete GDPR compliance is getting harder to attain. Whether you’re a data protection officer or a cybersecurity professional helping your organization remain compliant, this blog suggests advanced GDPR compliance strategies you may not have yet considered - beyond that delightful cookie consent notice we all love.

4-Stage Vendor Risk Management Framework (2024 Edition)

A Vendor Risk Management framework is the skeleton of your VRM program. Without it, your Vendor Risk Management program will collapse under a heavy burden of inefficient processes. This post outlines the anatomy of an effective VRM framework to help you seamlessly manage security risks in your third-party network.

Championing Supply Chain Cybersecurity Amid Evolving Regulations-A New CISO Imperative

Supply chain cybersecurity and resilience have become pivotal across various cyber regulations, most notably NIS2 and DORA. In this blog, stemming from our latest ebook '5 Proven Strategies to Maximize Supply Chain Cyber Risk Management’, we will explore the reasons why resilience is a new mandate for CISOs today and, most importantly, how to secure the supply chain at scale—in line with evolving regulatory requirements.

Behind the Screen: The Peril of Neglecting Mobile Apps

Everyone knows that running outdated computer applications comes with annoyances and risks. An outdated application might face performance issues or just become slower than modern versions. It might face compatibility issues and have limited functionalities. It might lose technical support and even fail to meet current industry standards and regulations, which could put your organization at risk for non-compliance penalties and legal action.

From Risk to Fix in a Single Click: How CultureAI Are Redefining Nudges in Cyber Security

The term 'nudge' has become a buzzword in cyber security over recent years, often being mistakenly equated with 'notifications'. CultureAI aims to shift this perception by leveraging Nudge Theory principles to implement actionable Nudges.

Cybersecurity Challenges in European Telehealth

Telehealth or telemedicine is one of the most common ways of providing healthcare services in the EU, with nearly 77% of countries adopting some type of telehealth service. Countries like Norway, Sweden, Denmark, and Italy are considered some of the world’s leaders in providing telehealth services. Following the COVID-19 pandemic, telehealth became widely adopted across Europe, with many countries participating in cross-border collaboration.

Third-Party Risk Management Policy Template (Free)

Organizations commonly rely on third parties such as vendors, suppliers, and other business partners to handle critical operations. While third-party relationships can provide many benefits, they also introduce a range of risks that can threaten data security, compliance, and business continuity. Therefore, it's crucial to recognize and manage these risks with a robust Third-Party Risk Management policy.

The NIST AI Risk Management Framework: Building Trust in AI

The NIST Artificial Intelligence Risk Management Framework (AI RMF) is a recent framework developed by The National Institute of Standards and Technology (NIST) to guide organizations across all sectors in the use of artificial intelligence (AI) and its systems. As AI continues to become implemented in nearly every sector — from healthcare to finance to national defense — it also brings new risks and concerns with it.

Vendor Risk Management Assessment Matrix (Clearly Defined)

A vendor risk management assessment matrix could enhance your visibility into vendor risk exposure, helping you make more efficient risk management decisions. In this post, explain what a vendor risk assessment matrix is, how to use it, and provide a step-by-step guide for designing your own.

Cross-Border Data Flow: The EU-US Privacy Shield's Demise

Digital advancement has drastically changed businesses' operations, including increasing global data flows. One consequential aspect of this transformation is the transfer of data across national borders, which poses significant legal, privacy, and security challenges. The EU-US Privacy Shield was a critical agreement that previously protected data transferred between the European Union and the United States.

Control Web Panel - Fingerprinting Open-Source Software using a Consolidation Algorithm approach

At Bitsight, part of the core work of the Vulnerability Research team is to analyze new high-profile vulnerabilities and ensure we come up with ways to detect, at an internet-wide scale, who is affected by these. Sometimes - more often than not - the direct exploitation of these vulnerabilities is significantly intrusive, and thus we can not load a direct port of the publicly available Proofs-of-Concept onto our internet scanning infrastructure.

MAX Prevents CRITICAL Zero-Day Vulnerability

Today we learn about SecurityScorecard's MAX and how it single-handedly prevented a MAJOR Zero-Day Vulnerability. With SecurityScorecard MAX, you no longer have to worry about your supply chain being at risk. SecurityScorecard is the global leader in cybersecurity ratings and the only service with over 12 million companies continuously rated. The company is headquartered in New York and operates in 64 countries around the globe.

The EU Cyber Resilience Act: Securing Digital Products

The EU Cyber Resilience Act (CRA) is a major piece of cyber legislation passed in 2024 in the European Union (EU) that regulates cybersecurity for digital products and services. The EU Cyber Resilience Act directly complements the NIS2 Directive, which regulates risk management and incident reporting across the European market.

Cyberattack at Sisense Puts Critical Infrastructure on Alert

The cybersecurity community woke up on Thursday to news of a cyberattack on Sisense, a major business analytics software company. It’s thought that the breach may have exposed hundreds of Sisense’s customers to a supply chain attack and provided the attacker with a door into the company’s customer networks.

Chapter One: The State of Vulnerability Management

Vulnerability exploitation is involved in over half of breaches, making it a huge risk to organizations. And the problem only continues to balloon year over year... both in the speed at which attackers are capitalizing on exploited vulnerabilities, and in the way that technology and assets outgrow most organization's current vulnerability management programs. In this series, we're going to be breaking down how vulnerability management has grown and evolved over time, plus how to modernize your program using things like risk-based vulnerability management.

5 Key Steps on How to Perform a Cybersecurity Risk Assessment

Assessing cybersecurity risks is critical for identifying vulnerabilities in your systems that can potentially lead to data breaches, financial loss, reputation damage, legal liabilities, and other negative consequences. Knowing your weaknesses will help you take proactive measures to protect your sensitive information, comply with relevant regulations, and ensure business continuity.

What to Expect with Bitsight's 2024 Ratings Algorithm Update

As communicated in January, Bitsight will conduct a ratings algorithm update (RAU) on July 10, 2024, as part of our ongoing efforts to optimize our methodology to provide the best external indicator of the performance of cybersecurity controls. Today, we’re excited to announce that our 2024 RAU is available to preview in the Bitsight applications.

Why the CISO & Security Leader Has Become the Chief Storytelling Officer

The role of the Chief Information Security Officer (CISO) or Security Leader has undergone a transformation as profound as the threats we face. Between new regulations such as SEC, NIS2, and DORA, the explosion of generative AI, and the rapidly expanding attack surface, the burden is now on cybersecurity leaders to not only protect the organization but build confidence with customers, regulators, board members, and other stakeholders. The key to building trust? Storytelling.

G2 Spring Report 2024: UpGuard Awarded #1 TPRM Software

In the latest G2 Spring Report, UpGuard ranked as the leading third-party and supplier risk management solution. G2 also recognized UpGuard as a market leader in third-party risk management (TPRM) for the seventh consecutive quarter, reaffirming UpGuard’s continued excellence and commitment to providing world-class cybersecurity solutions to global mid-market and enterprise organizations.

Change Healthcare Ransomware Attack Spotlights Single Point of Failure with Third-Party Vendor

The ongoing cyberattack on Change Healthcare, a major player in medical claims processing in the United States, had profound repercussions across the healthcare sector. With the company forced to disconnect over 100 systems, medical claims processing ground to a halt. This disruption, termed by the president and chief executive of the American Hospital Association as “the most serious incident of its kind” in healthcare, brought many medical providers to the brink of closure.

Navigating Cybersecurity Risk Management: Aligning Stakeholder Expectations in Response to Regulations

In light of the SEC's cybersecurity disclosure regulations in the US and NIS2 in Europe, corporate executives and institutional investors are facing a pressing need to align their expectations and improve understanding around cybersecurity risk management. The evolving threat landscape and regulatory environment highlight the importance of cohesive strategies to measure, prioritize, mitigate, and communicate cyber risks effectively.

SecurityScorecard Unveils the Industry's Most Predictive Cybersecurity Risk Ratings with Refined Scoring Algorithm

Now more than ever, the specter of cyber threats looms large over organizations of all sizes and sectors. The consequences of a data breach stemming from just one vulnerability can be catastrophic, ranging from financial losses to irreparable reputational damage. As businesses strive to reinforce their defenses against these evolving threats, the need for a reliable and predictive cybersecurity risk assessment tool has never been greater.

How SecurityScorecard STRIKE Identifies Zero Days in the Wild

SecurityScorecard STRIKE threat researchers discovered 12 zero-days in customer environments in the last year. Attacks are increasingly targeting third-party software. The zero-day vulnerability that emerged in Progress Software’s MOVEit Transfer product last year was a stark reminder of the real-world impact of such vulnerabilities. It wreaked havoc on businesses and governments worldwide, with cyber criminals exploiting it since May of 2023.

Material Incident Reporting Obstacles in SEC Cybersecurity Disclosures

‍ Over the past few decades, cyber attackers have increasingly wreaked havoc on the market, taking advantage of newer, more sophisticated ways to exploit system vulnerabilities. However, in fear of losing competitive advantages, organizations had notoriously downplayed the impact of these attacks, misleading investors and resulting in stock prices that did not accurately represent the risk landscape. ‍

Perspective-Driven Probability: Simplifying Risk Assessment with FAIR Methodology

Explore the nuanced nature of probability and risk assessment in this insightful video. Join us as we navigate the diverse perspectives that shape individual interpretations of what's probable. Discover how the FAIR (Factor Analysis of Information Risk) methodology provides a structured approach to understanding and communicating risk, making it accessible not only to the creator but to a wider audience. Gain insights into the challenges of assigning probabilities to uncertain events with limited data, and learn how FAIR methodology offers clarity in the face of uncertainty.

Meeting Third-Party Risk Requirements of DORA in 2024

The deadline for achieving complaince with the Digital Operational Resilience Act (DORA) will be here before you know it, with enforcement beginning in January 2025. With Third-Party Risk Management being the central focus of the EU regulation, it’s imperative to cater your TPRM program to the DORA regulation to achieve sustainable compliance. In this post, we outline the DORA requirements related to third-party risk management and explain how to comply with them.

How exposure management can help CISOs benchmark their security posture against industry peers--and why that's important

Digital transformation initiatives and the adoption of cloud, mobile, and remote work models have eviscerated the traditional security perimeter. Enterprise assets are distributed across the cloud, endpoints, mobile, and personally owned devices and expanded the attack surface in the process. Organizations are increasingly vulnerable to attack via unknown and unmanaged Internet-facing assets.

Third-Party Risk Management vs Vendor Risk Management

Organizational risk management often mentions third-party risk management (TPRM) and vendor risk management (VRM). The cybersecurity industry commonly uses these terms interchangeably, but there is a distinct difference between these two crucial components of an organization's broader risk management strategy.

Vendor Due Diligence Questionnaires: Free Template

Vendor due diligence questionnaires are a type of security questionnaire for third-party vendors or service providers that are an essential part of any third-party risk management program (TPRM) program. By using a vendor due diligence questionnaire, security teams can evaluate a new vendor’s overall risk hygiene before entering into a business partnership.

8 Steps to Cultivate a Culture of Risk Awareness in Higher Education

Over the last few years, the education industry has increased its dependency on third-party service providers, expanding the average attack surface and escalating the importance of comprehensive risk awareness. Higher education institutions that rely on large vendor ecosystems must develop robust cultures of risk awareness to safeguard their data and daily operations from cyber attacks, data breaches, and other disruptions.

Deciphering CUI: What is Controlled Unclassified Information?

In today’s interconnected digital world, safeguarding sensitive data and preventing unauthorized access is vital, especially for U.S. government agencies, contractors, and other information-sharing partners that compete for Department of Defense (DoD) contracts. While many organizations that work alongside the U.S.

Website References Object Storage

Is the "Website References Object Storage" issue type bringing your rating down and you don't know what to do about it? Watch this short video which explains what these are and what you can do to improve them. SecurityScorecard is the global leader in cybersecurity ratings and the only service with over 12 million companies continuously rated. The company is headquartered in New York and operates in 64 countries around the globe.

HTTP Proxy Service Detected

Is the "HTTP Proxy Service Detected" issue type bringing your rating down and you don't know what to do about it? Watch this short video which explains what these are and what you can do to improve them. SecurityScorecard is the global leader in cybersecurity ratings and the only service with over 12 million companies continuously rated. The company is headquartered in New York and operates in 64 countries around the globe.

Why the CISO Has Become the Chief Storytelling Officer

The role of the Chief Information Security Officer (CISO) has undergone a transformation as profound as the threats we face. Between new regulations such as SEC, NIS2, and DORA, the explosion of generative AI, and the rapidly expanding attack surface, the burden is now on cybersecurity leaders to not only protect the organization but build confidence with customers, regulators, board members, and other stakeholders. The key to building trust? Storytelling.

Elevating a UK Bank's Cyber Risk Mitigation Capabilities

Seeking to bolster its operational resilience, a UK bank was on the hunt for a partner to enhance their threat visibility throughout its environment, assuming the responsibility of monitoring key infrastructure and assets around the clock. In fast-moving threat landscape where security alerts can quickly multiply, Kroll's Managed Detection and Response (MDR) service, Kroll Responder, cuts through the noise. Learn how we helped our client improve cyber resilience by significantly reducing false positives, thus improving operational efficiency and security effectiveness.

Examining NIST CSF 2.0: Everything you need to know

In 2014, the National Institute of Standards and Technology (NIST) released its Cybersecurity Framework (CSF) following a presidential executive order to help organizations better understand, reduce, and communicate cybersecurity risk. In the decade since its introduction, NIST CSF has become one of the most widely recognized and utilized frameworks globally, built upon five key functions: Identify, Protect, Detect, Respond, and Recover.

How Cyber Exposure Management Strengthens Overall Enterprise Risk Management

In recent years, there's only been a handful of data breaches within public companies that could be considered financially "material." These breaches include those often pointed to as examples in cybersecurity presentations: the 2013 Target breach, the 2017 Equifax breach, the 2019 Capital One breach, and most recently, the Colonial Pipeline incident.

The Impact of FAIR on Risk Management with Jack Jones | Razorthorn Security

Welcome to Razorwire, the podcast that cuts through cybersecurity and risk management complexities. Host Jim welcomes Jack Jones, creator of the FAIR risk methodology, for an in-depth discussion on how his approach has transformed information security risk perception and management. Jack shares his journey from facing scepticism to global recognition, detailing the development of FAIR and its impact on the industry. He also previews his upcoming book on the controls analytics model, exploring the future of risk management and FAIR's role in advancing cybersecurity practices.

National Vulnerability Database Updates: How SecurityScorecard's CVEDetails can help

The National Vulnerability Database (NVD), the world’s most widely used vulnerability data source, has been having some problems recently, causing uncertainty and anxiety for everyone dealing with security vulnerabilities. Many organizations, including cybersecurity vendors, rely on CVE data provided by NVD. As a government organization operated by the U.S.

What is the NIST cyber security framework?

The NIST Cybersecurity Framework is a set of guidelines and best practices designed to help organisations better manage and reduce cybersecurity risk. It stands for the National Institute of Standards and Technology Cybersecurity Framework (CSF). The Framework was developed by NIST, part of the U.S. Department of Commerce, and first published in 2014, following an executive order by then President, Barack Obama which focused on improving the cybersecurity of critical infrastructure in the United States.

What Cybersecurity Metrics Should I Report to My Board?

‍ ‍ Chief information security officers (CISO) or respective organizational cybersecurity leaders are most likely well aware of the cybersecurity risks their organizations face. However, being aware of and communicating important cyber risk management data to the board of directors are two entirely different matters.

Telephony Or VoIP Device Accessible Issue And How To Fix It On Your Scorecard

Is the "Telephony/VoIP Device Accessible" issue type bringing your rating down and you don't know what to do about it? Watch this short video which explains what these are and what you can do to improve them. SecurityScorecard is the global leader in cybersecurity ratings and the only service with over 12 million companies continuously rated. The company is headquartered in New York and operates in 64 countries around the globe.

Top open source licenses and legal risk for developers

If you’re a software developer, you’re probably using open source components and libraries to build software. You know those components are governed by different open source licenses, but do you know all the license details? In particular, do you know the sometimes-convoluted licensing conditions that could pose compliance challenges for your organization?