Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![An Update on the State of Cyber Risk in Spain](/sites/default/files/styles/4_3_small/public/migration/images/716%2520blog_1.jpg.webp?itok=1kgQ-WjY)
Today ElevenPaths, the Telefónica Group’s global cybersecurity unit, released a report highlighting cybersecurity trends for the first half of 2019. As a follow-up to a November 2018 report, ElevenPaths again takes a close look at how cybersecurity is trending in Spain and compares statistics for Spain against the whole of Europe.
![Report: Cybersecurity Skills Shortage Requires Different Approach](/sites/default/files/styles/4_3_small/public/migration/images/711%2520blog_1.png.webp?itok=9kWANbSk)
If your organization is grappling with a tight cybersecurity talent pool, you’re not alone. According to Gartner, 61% of organizations struggle to hire security professionals. It’s a problem that’s only going to get worse. The Harvard Business Review predicts that, by 2020, there will be more than 1.5 million unfilled cyber positions worldwide.
![Average Cost of Cyberattacks Soars to $4.6 Million Per Incident](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Futuristic-Raise-Arrow-Chart-D-270585412_1.jpg.webp?itok=_8UhsrPf)
The aftermath of a cyber breach can be costly. But just how expensive and where the brunt of that financial impact falls has been somewhat unclear, until now.
![New Iranian Cyber Warfare Puts U.S. Networks at Risk](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--202598437-1_1.jpg.webp?itok=5PYU3v37)
As tensions between the U.S. and Iran continue to heat up, a cyber war is already underway between the two nations.
![Research Paper Validates Security Ratings’ Correlation to Likelihood of Breach](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Businessman-Pressing-Security--301990636_1.jpg.webp?itok=0lLT-1-M)
This spring, the research paper titled “Risky Business: Assessing Security with External Measurements” was published on Cornell’s academic resource site. Authored by former Bitsight data scientist, Jay Jacobs, as well as fellow academics Stephanie Forrest and Benjamin Edwards, this paper highlights the research done to correlate security ratings with the incident of a breach. As such, the paper demonstrates how an organization’s security practices can be measured externally and how these practices can be linked to observed security problems. Using statistical analysis, the authors then study the correlation between risk vectors and botnet infections. The paper argues that this information is sufficient to assess the security maturity of an organization using only externally available information.
![Will BlueKeep Become WannaCry 2.0?](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--215591209_1.jpg.webp?itok=RIsAbzVg)
A little over a month ago, Microsoft discovered a software security vulnerability that could ultimately lead to one of the worst cybersecurity attacks since 2017’s infamous WannaCry ransomware incident.
![Cyber Attacks Can Wreak Havoc on the Business in Multiple Ways](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Button-On-Virtual-Screen-Press-248084767_1.jpg.webp?itok=wp54zvpH)
The past few years have shown us that the cybersecurity landscape has only gotten more complex, as massive attack after massive attack —WannaCry and NotPetya ransomwares, at Uber Technologies in 2016, from the Shadow Brokers group, and many more — jolted enterprises around the world.
![Data Insights on the BlueKeep Vulnerability](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Close-Up-Laptop-Computer-And-T-290302069_1.jpg.webp?itok=HuQiTlCQ)
On May 14th, Microsoft issued a warning about the BlueKeep vulnerability (CVE-2019-0708) affecting Remote Desktop Services Protocol (RDP), a component common in most versions of Microsoft Windows that allows remote access to its graphical interface. This vulnerability, if exploited by an external attacker, will lead to full system compromise, without requiring any form of authentication or user interaction.
![New Study: Organizations Struggle to Manage Cyber Risk in Their Supply Chains](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-World-Map-Plane-Logistic-In-Ne-216174871_1.jpg.webp?itok=_QxY0y-I)
A new report from McKinsey & Company sheds light on something we’ve known for many years – organizations are struggling to make significant progress in managing cybersecurity risk in their supply chains.
![Eradicate Cyber Threats: Launch Your Third-Party Risk Management Program](/sites/default/files/styles/4_3_small/public/2022/02/18/Eradicate%20Cyber%20Threats-%20Launch%20Your%20Third-Party%20Risk%20Management%20Program.png.webp?itok=vfTPV2fd)
When launching a third-party risk management (TPRM) program, one of the best places to begin to be proactive about mitigating cyber risk from your third parties is by examining the vulnerabilities present on their network. Despite global knowledge of the harm that vulnerabilities can do to users and businesses alike, they still continue to persist and cause business interruption worldwide.
![The Perfect Cyber Storm is Brewing. Are You Prepared?](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Abstract-Technology-Background-250119211_2.jpg.webp?itok=tVGGXqu4)
Data breaches are never far from the news. Some recent headlines have even suggested that they’ve become the “new normal.” And while we haven’t seen a wide-scale attack since WannaCry was unleashed two years ago, a recent turn of events suggests that the perfect cyber storm may be brewing.
![Security Performance in Business Context: How Forecasts Empower Organizations to Improve Processes](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Asian-Business-Adviser-Meeting-253996027_1.jpg.webp?itok=2v6oJlEy)
When it comes to managing your organization’s cybersecurity performance, understanding the business context in which you make decisions is key. By leveraging security ratings you can understand the efficacy of your current security program, identify control gaps and/or failures, and determine the best allocation of resources that will lead to overall process improvement. With this level of visibility, security and risk leaders can now lead more data-driven conversations around cybersecurity with internal and external stakeholders about important security initiatives and feel more confident in the investments they are making in their security programs.It’s critical that security leaders understand how to prioritize their efforts. Bitsight for security performance management allows you to easily examine the importance of an event based on both asset importance and event severity. And now with Bitsight’s new integration between the Asset Risk Matrix and the Bitsight Forecasting engine — any security team can quickly assess the expected impact of their efforts based on Bitsight’s recommended remediation plan.
![Docker Hub: Exposing the Hidden Cost of Data Breaches](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Cyber-Security-Data-Protection-252265303_2.jpg.webp?itok=Ozvoe4oY)
Big risks can come from small, sometimes unexpected places. When compared to all the other vendors you need to manage, you might not think of an image container for apps as a high priority — but the recent breach of Docker Hub shows otherwise.
![What the Marriott Breach Can Teach Us About Cybersecurity in the Tourism & Hospitality Industry](/sites/default/files/styles/4_3_small/public/2022/06/17/bigstock-Passport-Photo-Camera-Smart-min.jpg.webp?itok=HhmDIr7b)
Last fall, news broke of the Marriott breach that compromised the records of up to 500 million customers. The data breach occurred through the IT company, a third party, that managed the Starwood reservation database.
![BitSight Contributes to Verizon's 2019 Data Breach Investigations Report](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Data-Breach-On-Wooden-Blocks--286847518_1.jpg.webp?itok=0ShaiBLz)
Last week, Verizon published its annual Data Breach Investigations Report (DBIR) which details the major trends in data breaches observed over the previous year. This report has become a widely respected industry standard that companies (across all industries) hold in high regard and frequently reference.