Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![How and When to Reassess Your Vendor’s Cybersecurity Posture](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1427663000_1.jpg.webp?itok=U860PgFg)
From a security perspective, your work isn’t done when a new vendor signs on the dotted line. After the onboarding process is complete, you must implement continuous monitoring practices to ensure your new third-party maintains the desired security posture — and doesn’t expose your organization to unwanted risk.
![The Shifting Role of the Security Professional: Doing More With Less](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_384090190_1.jpg.webp?itok=IQSITf83)
The COVID-19 outbreak has seen the roles of many cybersecurity professionals change — and many worry what it will mean for protecting their organizations from attacks.
![Shine a Light on Shadow IT](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_653465086_1.jpg.webp?itok=8X6ao8RG)
Over the last several years Shadow IT has grown from a minor annoyance into a major threat to business operations. While the term is often used to refer to runaway tech spending by users in marketing or dev-ops or finance, it has in fact become a much larger issue that involves the very core of organizational infrastructure with the potential to pose enormous cyber risk.
![BitSight Research Reveals Vulnerabilities in Point of Sales Systems](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1263203356_1.jpg.webp?itok=DUHPXoJ-)
When people talk about cybersecurity risks, the first area that normally comes to mind is malware. Some might even consider that it’s the worst event that can happen, as it normally indicates that a malicious actor has already bypassed the layers of security and now has free-reign to do what they want. The circumstances that led to the compromised systems, however, often tell a larger story. Issues like EternalBlue and BlueKeep require prompt response by system administrators in order to minimize the risk posed to their attack surface. Vulnerabilities often represent unpredictable changes of an organization’s attack surface that increase the risk of breach and compromise where the organization has to react accordingly based on their response plans and internal processes.
![Vendor Contract Do’s and Don’ts](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1148503103_1.jpg.webp?itok=LuYMO3SX)
According to an Opus and Ponemon Institute study, 59% of companies have experienced a data breach caused by one of their vendors or third parties — while only 16% claim they effectively mitigate third-party risks. Don’t be a part of these alarming statistics: In order to protect your organization’s valuable information, it’s critical that you set up the necessary security expectations from the onset of a new vendor relationship. Now, as an increasing percentage of businesses are moving to the remote office model, having these security conversations early on is even more critical — because residential IPs account for more than 90% of all observed malware infections and compromised systems.
![3 Ways to Mitigate Cyber Risk in Temporary COVID-19 Hospitals](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_642880945_1.jpg.webp?itok=qqZviqNy)
As cases of COVID-19 have grown, a lack of capacity has led governments to erect temporary hospitals in our nation’s stadiums, parks, and convention centers.
![You Can’t Secure What You Can’t See](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1396063595_1.jpg.webp?itok=0REXdk4D)
In the world of cybersecurity, there’s one ultimate truth that applies in every scenario: You can’t secure what you can’t see. Making informed, comparative decisions about your digital ecosystem requires you to understand where all your critical assets live — and any inherent risks present there. With as much as 75% of the workforce shifting to remote work in some industries, this visibility is more critical than ever.
![Pre-installed Android Threats: Data Insights](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_590576420_1.jpg.webp?itok=USgZm_Cj)
We used to think of malicious software — or malware as it’s more commonly known — as a threat to laptops and desktop computers. But as we are increasingly using mobile devices for many important things in our daily lives such as banking, cybercriminals are targeting smartphones and tablets more often. Consequently, Apple iOS and Android, which are the most popular mobile operating systems, have become targets for cybercriminals. Android still remains the most targeted because it has more market share and it’s open source, contrary to its direct competitor.
![How to Determine the Right Level of Vendor Assessment](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1056582023_1.jpg.webp?itok=UjJCPQhe)
When onboarding new vendors, it takes the median company an average of 90 days to complete due diligence — 20 days longer than it did four years ago, according to Gartner. In a competitive business climate where speed can be the difference between success and failure, a lengthy onboarding process undercuts your organization’s efforts at digital transformation and growth acceleration. And now, with as much as 75% of the workforce in some industries shifting to remote work due to the coronavirus outbreak, finding operational efficiencies in your onboarding process is more important than ever.
![The Long-term Impact of COVID-19: How Security Leaders Can Adapt](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_638403709_1.jpg.webp?itok=bfxaJMrL)
In a matter of weeks, the COVID-19 pandemic has established a “new normal” in society. But it has also rapidly shifted the business of cybersecurity.
![Don't Think Migration to the Cloud is a Risk? Think Again.](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_611605280_1.jpg.webp?itok=_cD1HjdT)
The cornerstone of digital transformation is the migration of apps and data to the cloud. There are obvious benefits to doing this. Businesses become more nimble and agile, and the cost of maintenance and development is off-loaded to a third-party. The benefits are so profound that, as of 2019, 84% of businesses used cloud-based SAAS (software as a service) apps.
![How to Make Your Third-Party Risk Management Program More Efficient](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1110779549_1.jpg.webp?itok=tHZuEUiJ)
With as much as 75% of the workforce shifting to remote work in some industries, organizations around the world are seeking to rapidly acquire new software and technology to properly enable the business, facilitate the new needs of workers, and prevent employees from turning to unauthorized shadow IT.
![Understanding a Vendor’s Cybersecurity Risk](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1265499847_1.jpg.webp?itok=t-mPCLCF)
Did you know that, according to an Opus and Ponemon Institute study, 59% of companies have experienced a data breach caused by one of their vendors or third parties? During these uncertain times, when many industries are shifting to an increasingly remote workforce, organizations may feel pressure to accommodate new business requirements by onboarding new technology faster. However, given the frightening implications of a potential breach — and the fact that phishing attacks and other cyber scams are on the rise due to the ongoing coronavirus pandemic — it’s more important than ever that you consider a potential vendor’s cybersecurity posture before you sign on the dotted line.
![The Most Useful and Impactful Security Metrics Every CISO Should Have](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1219444957_1.jpg.webp?itok=70SlNa73)
Security leaders are increasingly making their cases through metrics. Data-driven measurement of cybersecurity performance can be used to justify spending, quantify risk, and more.
![Is Your Reputation at Stake?](/sites/default/files/styles/4_3_small/public/migration/images/shutterstock_1361000201_1.jpg.webp?itok=HKRRaRPO)
It’s often said that our reputation precedes us. When it comes to the damage that can be done by a cybersecurity incident, that couldn’t be more true. In today’s security-focused world, a single breach can dramatically impact the public perception of your organization, ultimately leading to a loss of business and a hit to your bottom line.