Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![A Risk-based Approach to Cybersecurity Can Save Time & Money](/sites/default/files/styles/4_3_small/public/migration/images/A_Risk_based_Approach_to_Cybersecurity_Can_Save_Time_And_Money_1.jpeg.webp?itok=mlMxqdSx)
If you’ve glanced at the opinion columns of security industry publications, you’ve probably seen the term “risk-based” floating around, as in “the time is now for a comprehensive, risk-based approach” or “a risk-based approach to security is key to business alignment."
![The Board’s Role in Managing Disruptive Risk: Enter Security Ratings](/sites/default/files/styles/4_3_small/public/migration/images/4.12-Blog-Image-Board-Security-Ratings_1.jpg.webp?itok=bUuAmLnh)
Today, disruptive risks are an area of focus for corporate directors worldwide. On a global basis, we face disruptions in areas like geopolitical volatility, economic slowdown, emerging technologies, cybersecurity threats, and climate change.
![NERC CIP-013-1: Effective Date, Preparation Strategies, & Impact](/sites/default/files/styles/4_3_small/public/migration/images/4.10-Blog-Image-NERC-Utilities_1.jpg.webp?itok=FeBQXNSs)
The North American Electric Reliability Corporation (NERC) has developed a new set of cybersecurity standards designed to help power and utility (P&U) companies limit their exposure to third-party cyber risks and preserve the reliability of bulk electric systems (BES).
![Gartner Names Security Ratings a Top 10 Security Project for 2019](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Security-Global-Network-278195797_2.jpg.webp?itok=Ms35xcK9)
Just a few weeks ago, Gartner released their list of “Top 10 Security Projects for 2019”, and named security ratings services as a business imperative.
![Is Your Risk Management Program Ready for the New European Banking Authority’s Guidelines?](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Euro-Coins-Stacked-On-Each-Oth-223184503_1.jpg.webp?itok=RFOUPRap)
In June 2018, the European Banking Authority (EBA) put forth guidelines on outsourcing arrangements that highlighted the importance of risk management within financial organizations. The notice of these guidelines was announced in June 2018 and will be enforced later in 2019.
![BitSight Security Ratings Platform Expands Its Visibility in Compromised Systems](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-cybercrime-hacking-and-techno-239309626_1.jpg.webp?itok=vqoYygdC)
Since creating the Security Ratings market in 2011, a core component of Bitsight’s value to users has been providing industry-leading comprehensive visibility into malware communications.
![Fraudulent Android Advertising SDK Installed In Over 15 Million Devices](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Wroclaw-Poland--Jan------282826726_1.jpg.webp?itok=0JuQVZje)
Every day, Bitsight monitors the global threat landscape in a constant effort to identify software that may be placing users and organizations at risk. The presence of malware — or simply potentially unwanted applications — in an organization is an indicator that some security controls may be failing, or that some additional measures should be taken.
![Cyber Risk Considerations During the M&A Process](/sites/default/files/styles/4_3_small/public/migration/images/mergers-acquisitions-nacd-blog-image_1.jpg.webp?itok=hOODsYci)
Data breaches are a constant in today’s headlines, but in recent years the risk has been front and center of some of the most significant M&A deals. In 2017, Verizon discounted its acquisition price by $350 million when Yahoo belatedly disclosed that it experienced several massive breaches. And in November 2018, Marriott publicly disclosed that Starwood’s guest reservation database — containing hundreds of millions of personal records — had been compromised since 2014, prior to the Marriott acquisition. These incidents — and countless others — raise critical questions. How should Boards be thinking about cyber risk in the acquisition process? What steps should they take to address this risk prior to the acquisition?
![Advanced Security Benchmarking with BitSight Peer Analytics](/sites/default/files/styles/4_3_small/public/migration/images/Peer%2520Analytics%2520Laptop%2520Blog%2520Header_1.jpg.webp?itok=R2eMRhSX)
Based on security performance data of hundreds of thousands of global organizations, Peer Analytics gives security and risk leaders visibility into the relative performance of their cybersecurity programs against a meaningful set of peers. These analytics help them set achievable performance targets based on their Bitsight Security Rating, effectively allocate limited resources, and efficiently prioritize security efforts with a focus on continuous program improvement.
Peer Analytics provides companies with a more granular view of their security rating. It is based on hundreds or thousands of companies (a broader set of similar organizations) that allow you to see where there are gaps in your security performance: at the ratings level, risk vector grade level, and at the vector detail event level.
Peer Analytics: Analyze, Prioritize, Act
Today, security and risk leaders use Peer Analytics to:
Set achievable security goals based on relative performance withi
Peer Analytics provides companies with a more granular view of their security rating. It is based on hundreds or thousands of companies (a broader set of similar organizations) that allow you to see where there are gaps in your security performance: at the ratings level, risk vector grade level, and at the vector detail event level.
Peer Analytics: Analyze, Prioritize, Act
Today, security and risk leaders use Peer Analytics to:
Set achievable security goals based on relative performance withi
![How to Be Confident In Your Third-Party Risk Management Program](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--198899707_1.jpg.webp?itok=5c5MC4rw)
When it comes to third-party risk management (TPRM), many organizations are just beginning to figure out the core components of their program — and some are not implementing any measures to monitor their third parties at all.
![Software Risk Management: 3 Tips for Project & Product Managers](/sites/default/files/styles/4_3_small/public/migration/images/2.19-software-risk-management-tips-blog-image_1.jpg.webp?itok=3sztYmaO)
The development and deployment of software applications is inherently risky; a number of things can go wrong both during development and after launch. Project and product managers must stay aware of risks coming from a variety of areas, including:
![Cyber Basics: Understand Vulnerabilities, Threats & Exploits](/sites/default/files/styles/4_3_small/public/migration/images/bigstock--202598059_2.jpg.webp?itok=tu_C-ocn)
In 2019, cyber incidents will be the second most important global business risk. The more cyber incidents that continue to happen on a global scale, the more critical it is for users to understand how to classify the dangers that exist for both businesses and users. In this blog post, we’ll break down the basics and explore the difference between three key areas of cyber risk: vulnerabilities, threats, and exploits.
![The Time is Now: NYDFS Deadline Means Risk Managers Need to Focus on Third-Party Risk](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Manhattan-Skyline-At-Night-Ne-18683036_1.jpg.webp?itok=93QBhXGR)
In March 2017, the New York Department of Financial Services (NYDFS) cybersecurity regulations — known as 23 NYCRR Part 500 — went into effect. According to the regulation, “any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law” is considered a covered entity and must comply.
![What You Can Do Today to Prevent A Data Breach](/sites/default/files/styles/4_3_small/public/migration/images/What-You-Can-Do-Today-to-Prevent-A%2520Data-Breach_2.jpeg.webp?itok=kFzp4yuX)
When it comes to data breach prevention, there are plenty of guides for reducing risk in the long term. While it’s definitely valuable to be working on a data breach prevention strategy with 6-month, 1-year, or 5-year goals, not every cybersecurity initiative takes so much time.
![BitSight EXCHANGE Sound Bites: Transferring Risk Through Cyber Insurance](/sites/default/files/styles/4_3_small/public/migration/images/jake-exchange-2_1.jpg.webp?itok=OQ1jNtQP)
In the months since Bitsight’s inaugural EXCHANGE forum inaugural EXCHANGE forum, we have been digesting and processing the incredible sessions and discussions that came about from this forum. It was a great event that brought together security executives from all over to discuss the challenges they face in their roles every day.