Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This is a developing story. Updates will be amended as new information and guidance become available.

From Executive Orders to cyber insurance and evolving regulations, security teams are entering the age of evidence. Want to do business with a government entity? You must demonstrate adherence to zero-trust principles. Want cyber insurance? You need documentation of your entire attack surface. Want to conduct financial services business in various regions? Show your operational resiliency.

Investors came into 2022 feeling good, with a three-year average annual return for the S&P 500 of 24%. In March, things changed. The Federal Reserve raised interest rates, signaling it was time to switch to bonds. The playbook said bonds were the much safer play. Then Russia invaded Ukraine. Commodity prices, especially energy and food, spiked. Supply chains broke. The E.U. faced a winter without enough energy to heat homes or power businesses.

Attack Surface Assessment tools enable information security teams to look at their organizations “outside-in” from the attacker’s point of view, prioritizing the issues that attackers will see first.

In the past, the attack surface was defined and protected by the boundaries of the organization’s physical network (aka the LAN). Using physical security methods, firewalls, and careful monitoring, organizations kept their data, endpoints, and networks secure. The entire attack surface was internal, within a well-defined and fortified perimeter.

In business and life, getting the timing and the team right is half the battle.

Anyone who’s ever been in a relationship knows that the beginnings and ends are the toughest parts. This is when the baggage is dusted off, brought to light and (all too frequently) used detrimentally. Mergers and acquisitions — and their mirror image, divestments — are the organizational equivalents of marriage and divorce. During the process, past indiscretions are discovered, leveraged in negotiations and ideally rectified or laid to rest.

On Thursday, December 9, a zero-day vulnerability CVE-2021-44228 (a.k.a. Log4Shell, LogJam, and Log4j) was made public. This vulnerability impacts Apache Log4j versions 2.0-beta9 to 2.14.1, and it has the highest possible CVSS score of 10.0. As of today, it is widely regarded as one of the most dangerous and widespread vulnerabilities to date.

Cyber Monday and the holiday shopping season are around the corner: don’t be the victim of an online shopping scam or cyber security breach. Cyber Monday is here, and the holiday shopping season is in full swing. With some of the world’s biggest brands vulnerable to a Magecart attack, you can’t be too careful with your credit card information.