Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![How to Prove Your Organization’s Cybersecurity Investment is Paying Off](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1291014910_1.jpg.webp?itok=MeoXA2sz)
In light of recent widespread breaches and security incidents, such as the cyber attack targeting SolarWinds, security and risk managers are under more pressure than ever to prove that their cybersecurity investments are actually paying off.
![Use the right cybersecurity analytics to make a business case for risk management](/sites/default/files/styles/4_3_small/public/migration/images/Use%2520the%2520right%2520cybersecurity%2520analytics%2520to%2520make%2520a%2520business%2520case%2520for%2520risk%2520management_1.jpg.webp?itok=2PNqWuUF)
Not long ago, corporate executives would give only passing thoughts to their organization’s cybersecurity postures. Leadership and board members would take notice in the wake of a major data breach, for example, or a couple of times a year as a “check the box” exercise to maintain compliance with regulations. Overall, however, cybersecurity analytics didn’t really garner much attention.
![Email Security Best Practices: Using SPF Cybersecurity to Mitigate Malicious Threats](/sites/default/files/styles/4_3_small/public/migration/images/BitSight_SPF_framework_1.png.webp?itok=UglhB2fp)
The threat from malicious email represents one of the greatest risks to IT security. That threat continued unabated in 2020, especially in the wake of the COVID-19 pandemic. Research indicated that in 2020 the number of nefarious emails increased dramatically, reaching about 1.5 million malicious emails per day during one particularly intense three month period.
![A response to Security Ratings - Love, Loathe or Live With Them](/sites/default/files/styles/4_3_small/public/migration/images/Blue_background_numbers_1.jpg.webp?itok=heBnReDb)
A week ago (which seems like a world ago given everything that’s happened with SolarWinds) Phil Venables -- formerly CISO of Goldman Sachs and now CISO of Google Cloud -- posted an interesting expose on security ratings this week. Phil has a better perspective than most on the value and challenges of ratings not only because of the positions that he’s held but also because he is one of the authors of the Principles of Fair and Accurate Security Ratings. These principles also guide how Bitsight thinks about our rating overall.
![Best Practices For Managing Third Party Risk](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1698716524_1.jpg.webp?itok=E4rm62DO)
Properly managing third party risk and preventing damaging outcomes that result from gaps in your vendor ecosystem can be difficult and costly. With the recent SolarWinds data breach wreaking havoc on thousands of organizations globally, including many fortune 500 companies and organizations within the government sector, the need for efficiency when managing third party risk has never been more top of mind.
![BITSIGHT ANALYSIS OF SOLARWINDS ORION — PART 2: DECLINING PREVALENCE](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1705312225_1.jpg.webp?itok=iupwgerZ)
In light of the cyber attack targeting SolarWinds, security and risk professionals are working to identify instances of the Orion software within their organization -- including their broader partner ecosystem -- and reduce their exposure. How responsive have organizations been to the SolarWinds hack?
![BitSight Analysis of SolarWinds Orion Breach — Part 1: Prevalence](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1007122360_1.jpg.webp?itok=nMNGvoTV)
The cyber attack targeting SolarWinds, a provider of network and system monitoring software, is shaping up to be one of the most significant attacks against a critical supply chain partner, with significant implications for national security. Similar to NotPetya, the attackers compromised a software provider in order to gain access to the trusted update channel. Any organization using specific versions of the SolarWinds Orion Network Configuration Manager (SolarWinds Orion) product is presumed to be at risk.
![What Does Risk-Based Cybersecurity Reporting Look Like?](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1648407448_1.jpg.webp?itok=RKxpWUXk)
Effective communication between different members of your team can make all the difference when it comes to maintaining your desired security posture and preventing massive cyber incidents. Reports can play a critical role in these communications, serving as the central mechanism through which to align on the most significant issues and make more confident, data-driven decisions.
![3 Steps to Building an Effective Cyber Risk Strategy](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1088986847_1.jpg.webp?itok=bUbqzj96)
In today’s “new normal” operating environment, you’re contending with a growing attack surface, limited resources, and an increasingly remote workforce — all at once. Given these conditions, it’s more important than ever to have a solid security performance management program in place.
![What Cybersecurity Questions Your Report Should Answer | BitSight](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_734785402_2.jpg.webp?itok=JYUjrQP0)
Boards are increasingly looking at cybersecurity as a crucial part of the business. The problem is, the board doesn’t always know what to look for or how cybersecurity impacts the business. What the board really wants to hear in the next report is how you’re generating results for the organization and how those results are creating ROI on the spend. Here are a few cybersecurity questions and a few metrics that the board really wants to hear about in the next report.
![Zerologon: BitSight Observations on a Dangerous Vulnerability](/sites/default/files/styles/4_3_small/public/migration/images/zerologon%2520blog%2520post%2520image_1.jpg.webp?itok=oN0mvHvD)
New vulnerabilities emerge daily... but not every vulnerability is being actively exploited by nation state actors. Zerologon (CVE-2020-1472) is one such vulnerability. Zerologon was recently identified by the National Security Agency (NSA) as one of 25 vulnerabilities actively being exploited by Chinese state-sponsored actors.
![Meet Our Customer Success Team: André Mártires Agostinho](/sites/default/files/styles/4_3_small/public/migration/images/Customer-Success-Blog-Full_46.png.webp?itok=8mryN1Um)
Check out this Q&A with a US-based member of Bitsight's Customer Success team to learn about her role as an Bitsight Advisor & Customer Success Manager, her experience, and more.
![BitSight’s View into the NSA’s Top Vulnerabilities](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1613354131_2.jpg.webp?itok=ZxiVnhdn)
In a highly unusual move, the National Security Agency released research on October 20, 2020, highlighting 25 common vulnerabilities that are being actively exploited by Chinese state-sponsored actors. The NSA issued the alert in order to help companies prioritize vulnerability management. Most of the NSA vulnerabilities can be exploited to gain initial access to networks that are directly accessible from the Internet.
![Worm Phishing Campaign Success On The Rise](/sites/default/files/styles/4_3_small/public/migration/images/Worm%2520phishing%2520campaign%2520blog%2520post%2520image_2.jpg.webp?itok=Wtgfczs5)
The majority of us have been through phishing training for our jobs, where the simplified best-practices for all employees are laid out. These usually include reporting to IT when you receive emails from suspicious accounts, those that contain links without a description or subject lines that don’t make sense, or content you’re not familiar with or normally asked for, among other questionable communication.
![Worm Phishing Campaign Success On The Rise](/sites/default/files/styles/4_3_small/public/migration/images/Worm%2520phishing%2520campaign%2520blog%2520post%2520image_2.jpg.webp?itok=Wtgfczs5)
The majority of us have been through phishing training for our jobs, where the simplified best-practices for all employees are laid out. These usually include reporting to IT when you receive emails from suspicious accounts, those that contain links without a description or subject lines that don’t make sense, or content you’re not familiar with or normally asked for, among other questionable communication.