Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![BitSight Integrates With ServiceNow to Reduce Risk Throughout Vendor Management Programs](/sites/default/files/styles/4_3_small/public/migration/images/1200x628-1b%2520%25281%2529_1.png.webp?itok=-g8xkwpk)
Organizations rely on third-parties to keep competitive in the marketplace. The EY global third-party risk management survey highlights that in 2019–20, over 33% of the 246 global companies surveyed were managing and monitoring third-party risk for over a 1000 vendors. As more vendors are onboarded into company networks, managing cybersecurity threats becomes a greater challenge, but a necessity.
![Your Attack Surface is Growing, Your Security Risk Assessments Should Evolve Too](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1690026925_1.jpg.webp?itok=LP-j512S)
Security risk assessments are an important tool in your organization’s arsenal against cyber threats. They shine a spotlight on areas of risk in your digital ecosystem, inform and prioritize mitigation strategies, and ensure hard-earned resources are allocated where they’re needed most. Assessments can also help you evaluate your third parties to mitigate the very real possibility that they’ll introduce unwanted risk into your organization.
![What is Security Orchestration, Automation and Response (SOAR)?](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_540164146_1.jpg.webp?itok=F6wQ0UZ-)
A couple of years ago, industry research firm Gartner introduced a new acronym—SOAR—into the cybersecurity nomenclature. SOAR stands for “security orchestration, automation, and response.” It’s not an individual tool, or even set of tools. Like ISO 27001, GDPR, FISMA, and others, SOAR is a cybersecurity framework organizations can use to create an effective risk mitigation strategy.
![Celebrating 10 Years of BitSight: A Co-Founder Looks Back](/sites/default/files/styles/4_3_small/public/migration/images/bitsight%252010th%2520anniversary%2520banner4-1-1_1.png.webp?itok=AQMq1KiJ)
It’s hard to believe, but Bitsight is celebrating our 10 year anniversary this week! I co-founded Bitsight in 2011 with my friend and grad school classmate, Nagarjuna Venna. When I think back at our original idea of creating a global cybersecurity ratings system, I’m surprised that our original thesis and vision still holds true today. It’s been an incredible journey filled with twists and turns, and I wanted to share some thoughts about where we’ve been and where we’re headed in the next decade.
![Optimize Your Cybersecurity Program With Financial Quantification](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1933009952_1.jpg.webp?itok=tAd7b-le)
Now more than ever before, it’s critical to build a strategic security performance management program in which you take a risk-based, outcome-driven approach to measuring, monitoring, managing, and reporting on your organization’s cybersecurity program performance over time. Of course, in order to do so, you need an easily understandable framework through which you can conduct a cyber risk analysis and lead meaningful conversations on the business impact of your organization’s risk exposure.
![4 Best Practices for Attack Surface Management](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_613167605_1.jpg.webp?itok=2WiePjlt)
Accelerated by the pandemic, digital ecosystems are expanding. New ways of working remotely, and the rapid adoption of cloud technologies have increased the number of digital touch-points that employees interact with. Unfortunately this expanded attack surface creates new points of exposure that make it difficult for security leaders to pinpoint where cyber risk exists, or when a risk is worth concern.
![Three Ways To Improve Your Cyber Risk Monitoring Tools](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1182594889_1.jpg.webp?itok=jmebBYdU)
Whether your organization is just beginning to develop your security performance management systems, or you already have a mature and established program in place, there is always room to innovate and improve the cyber risk monitoring tools you use.
![Elevate Cyber Risk to Business Risk With Financial Quantification](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1083923609%2520%25281%2529_1.jpg.webp?itok=M3F6q0aj)
There’s no question about it: Being exposed to cyber risk is an inevitable part of doing business in today’s world. In fact, a recent ESG study found that 82% of organizations believe that cyber risk has increased over the past two years.
![BitSight Observations Into Hafnium Part Four: Who Is Still Vulnerable?](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1651775455_2.jpg.webp?itok=-ESfJPLc)
The unfolding Hafnium attack is the latest event in the trend of cyber events. CISO’s are starting to recognize that enterprise cyber security is being redefined to mean me and all my suppliers, or the combination of first and third party cyber risk is enterprise risk. NotPetya demonstrated that breaching a small accounting firm could cost a firm like Merck over $1B in damage.
![Common Cloud Service Providers Are Not Immune To Cyber Attacks](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1722461929_1.jpg.webp?itok=rFgHGEcD)
Oftentimes, security managers fall into the trap of believing that a large or commonly used cloud services organization is safe to have connected to their network. Cloud services providers aren’t immune to bad actors targeting their network, and in reality can expose extremely sensitive information when they are targeted.
![BitSight Observations Into HAFNIUM Attacks, Part Three: Exploitation and Vulnerability Persists](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_517900255_1.jpg.webp?itok=8PxFIUOH)
Organizations around the globe continue to address the fallout from the Microsoft Exchange Server zero-day attacks. It was recently announced that hackers may now be exploiting the vulnerabilities in Exchange to drop ransomware into vulnerable systems via backdoor attacks (or Web shells). There is significant urgency for organizations to update their systems and patch immediately to stop these backdoor attacks that originated with Exchange.
![BitSight Observations Into HAFNIUM Attacks, Part Two](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1349504000_2.jpg.webp?itok=GaoLmSBD)
Microsoft Exchange is a critical business software used by organizations around the world for email. Sensitive data and communications are stored and transacted on the platform daily. In an unusual situation, threat actors have performed mass exploitation on zero-day vulnerabilities associated with Microsoft Exchange.
![BitSight Observations Into HAFNIUM Attacks, Part Two](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1349504000_2.jpg.webp?itok=GaoLmSBD)
Microsoft Exchange is a critical business software used by organizations around the world for email. Sensitive data and communications are stored and transacted on the platform daily. In an unusual situation, threat actors have performed mass exploitation on zero-day vulnerabilities associated with Microsoft Exchange.
![Should Security Ratings Require Independent Verification?](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_620211089_2.jpg.webp?itok=K0bAEtQF)
As a recent Forrester report highlighted, there are many cybersecurity ratings available. Security ratings have a valuable place in your overall cyber risk mitigation strategy, for many reasons.
![BitSight Observations Into the HAFNIUM Attacks: Part One](/sites/default/files/styles/4_3_small/public/migration/images/Screen%2520Shot%25202021-03-09%2520at%252012.11.30%2520PM-1_1.png.webp?itok=XDgvDBEd)
On March 2, Microsoft announced that it has detected multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server. According to Microsoft, in the attacks observed, cybersecurity threat actors used this vulnerability to access on-premises Exchange servers, which enabled access to email accounts, and installed additional malware to facilitate long-term access to victim environments.