Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![How Long Does It Take To Assess Third Party Cybersecurity Posture?](/sites/default/files/styles/4_3_small/public/migration/images/4.2-FOS-Infographic-Blog-Full_2.jpg.webp?itok=Q0DtnwCL)
With outsourcing continuing to rise, third party cyber risk management has become a pressing issue for organizations worldwide. Yet, many firms across the globe are approaching this challenge differently.
![How BitSight Helps Drive Quick Risk Reduction Across Third Party Ecosystems](/sites/default/files/styles/4_3_small/public/migration/images/3-27-Contextual-EVA-Blog-Full_1.png.webp?itok=GN5Gidos)
At a recent Bitsight Roadshow, a customer with an advanced third party risk management program declared “assessments are not risk reduction.” The statement was not meant to convey that assessments are useless for third party risk; rather, that assessments themselves don’t inherently drive risk down.
![Making the Case for Vendor Security to the C-Suite](/sites/default/files/styles/4_3_small/public/migration/images/bitsight-vendor-cyber-security-1_1.jpg.webp?itok=-wDy8DFK)
You’re responsible for information security at your organization. You dedicate yourself every day to identifying weaknesses and patching vulnerabilities in your network. You’ve developed policies to protect employees from cyber threats. You’ve designed procedures for responding in the event of a data breach, and you’ve practiced those procedures with company stakeholders.
![5 Highlights Of The NYDFS Cybersecurity Regulations](/sites/default/files/styles/4_3_small/public/migration/images/NYDFS%2520Cybersecurity%2520Regulations%2520-%2520thumb_1.jpg.webp?itok=FjSkp1R7)
In March 2017, the New York Department of Financial Services (NYDFS) cybersecurity regulations—known as 23 NYCRR Part 500—went into effect. According to the regulation, “any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law” is considered a covered entity and must comply.
![What You Need To Know About Vendor Compliance](/sites/default/files/styles/4_3_small/public/migration/images/checklist_vendor_compliance_small_1.jpeg.webp?itok=UaUTczO8)
Compliance, at its core, is a legal responsibility. It is defined as “act or process of doing what you have been asked or ordered to do.” Creating a successful vendor compliance program isn’t as simple as asking third parties to comply with your security requests or pestering them to answer your security risk assessment questions.
![Vendor Risks: 5 Ways To Improve Third-Party Cybersecurity](/sites/default/files/styles/4_3_small/public/migration/images/Vendor%2520Risks%2520-%2520Improve%2520Third-Party%2520Cybersecurity_1.jpg.webp?itok=Bj9vjS6A)
You can’t go more than a few weeks (or sometimes a few days) without hearing about yet another company whose data was compromised after hackers gained access through a third-party vendor. These attacks show that it’s no longer enough to secure only your own network from cyber attacks—you have to ensure your vendor networks are secured as well.
![The Importance of Speed in Driving Business Value Through Your VRM Program](/sites/default/files/styles/4_3_small/public/migration/images/11.21-Speed-VRM-Blog-Thumb_1.png.webp?itok=PhtwSRyf)
In today’s expanding business ecosystem, managing vendor risk is becoming increasingly critical to protecting companies’ sensitive data. With new threats emerging daily and companies continuing to outsource, vendor risk management is an issue that will only grow in affecting organizations and their business partners. According to a recent Navex Global study, the ability to promptly resolve newly identified risks is a top challenge for organizations’ third party risk management programs.
![3 Steps for Building A Third-Party Continuous Monitoring Plan](/sites/default/files/styles/4_3_small/public/migration/images/Third-Party%2520Continuous%2520Monitoring%2520Plan%2520-%2520thumb_1.jpg.webp?itok=xlJk7Fe5)
In today’s security climate, talk of proper cybersecurity procedures must include discussion of a continuous monitoring plan that applies both internally and externally (with the company’s third-party vendors). And while continuous monitoring is critical to the health and well-being of your company, it’s also incredibly challenging to do.
![How & Why U.S. Businesses Should Prepare For GDPR](/sites/default/files/styles/4_3_small/public/migration/images/thumb-general-data-protection-regulation-gdpr_1.jpg.webp?itok=GSB5v5Py)
As a U.S.-based company, you may be asking yourself, “Does my company need to prepare for the EU’s General Data Protection Regulation (GDPR)?” Simply put, if you process personal data for anyone in the European Union, the answer is very likely yes.
![Information Security In Banking & Finance Industry: 3 Critical Vendor Risks](/sites/default/files/styles/4_3_small/public/migration/images/Information%2520Security%2520In%2520Banking%2520-%2520BitSight_1.jpg.webp?itok=TVGkWjOz)
In a report focused on cybersecurity in the banking and financial sector, Bitsight researchers examined the security performance of more than 5,200 organizations in the Legal, Technology, and Business Services industries. These organizations—monitored by Finance organizations on the Bitsight Security Rating Platform—represent a critical part of the financial services supply chain. Our report shows a number of findings representative of information security in banking and financial industry.
![BitSight’s Newest Alerting Capabilities Showcase Evolution of Leading Security Rating Service](/sites/default/files/styles/4_3_small/public/migration/images/10.20-Blog-Thumb_1.png.webp?itok=Bc_W6r-6)
This August, Bitsight announced the release of several new risk vectors specifically chosen to help organizations identify and manage risks across their own networks and the networks of their third parties. Bitsight chose those new risk vectors to enhance the insights across the “spectrum of risk” and provide a more comprehensive picture of an organization’s security posture.
![5 Tips to Stay Safe During Cybersecurity Awareness Month](/sites/default/files/styles/4_3_small/public/migration/images/10.13-Blog-Thumb_1.png.webp?itok=pSu2_R-_)
October is Cybersecurity Awareness Month, which offers organizations the opportunity to thoroughly examine their security and risk programs and identify where any vulnerabilities might exist. Here at Bitsight, we talk about risk management every day. However, we have to practice what we preach — our IT Team offered some insight into areas where organizations can improve their network health not just this month, but regularly.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Ransomware is rapidly becoming one of the most common forms of malware distributed on systems all over the world.
![Making Vendor Risk Collaborative, Not Combative](/sites/default/files/styles/4_3_small/public/migration/images/Vendor-Access-Blog-Thumb_1.jpg.webp?itok=Zx5g1Mhj)
Reducing cyber risk that stems from third and fourth party vendors is no easy task. It requires that organizations not only have the ability to continuously monitor and identify new risk, but also the ability to work with their vendors to fix security issues quickly. Getting to risk reduction quickly means that both organizations are communicating effectively, using data and evidence rather than conjecture to make progress.
![Are Vendors Meeting Your Company’s Security Standards?](/sites/default/files/styles/4_3_small/public/migration/images/9.28-Insights-Blog-Thumb_2.png.webp?itok=52PXU3n1)
When it comes to vendor risk management, organizations ultimately need their vendors to meet the same standard of security performance they hold for their own organization. For years, the Finance industry has been a trailblazer in managing the risk posed by vendors, suppliers, and business partners. However, are vendors in the Finance supply chain meeting the same level of security performance held by Finance organizations?