Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Do's & Don'ts for Security Professionals Presenting to Executives](/sites/default/files/styles/4_3_small/public/migration/images/bitsight-how-to-present-to-senior-executives_1.jpg.webp?itok=mLDoZ4AA)
Cybersecurity is a growing topic of discussion in Board meetings everywhere, and more and more security professionals are being asked to present on it in high level meetings. Company leadership is busy, so it’s your responsibility to present a case to them that’s ready for review. We reached out to some security executives and CIOs and asked them for tips on what common mistakes to avoid when presenting your case to executives or the Board.
![Break Out Of The Tinynuke Malware](/sites/default/files/styles/4_3_small/public/migration/images/2.2-Tinynuke-Blog-Thumb_1.png.webp?itok=DDSr8s_e)
New Tinynuke variant with a DGA in the wild
![Making the Case for Vendor Security to the C-Suite](/sites/default/files/styles/4_3_small/public/migration/images/bitsight-vendor-cyber-security-1_1.jpg.webp?itok=-wDy8DFK)
You’re responsible for information security at your organization. You dedicate yourself every day to identifying weaknesses and patching vulnerabilities in your network. You’ve developed policies to protect employees from cyber threats. You’ve designed procedures for responding in the event of a data breach, and you’ve practiced those procedures with company stakeholders.
![Upgrading to the Django Rest Framework V3](/sites/default/files/styles/4_3_small/public/migration/images/1.25-Engineering-Blog-Thumb_1.png.webp?itok=8pL7yXR7)
Due to security, reliability, and growth reasons, organizations are constantly upgrading their software to newer releases. Some upgrades are incremental and minor in nature. Others, like the upgrade from Django Rest Framework (DRF) V2 to V3, require coding changes due to incompatibilities between the releases. This article is about Bitsight's upgrade experience, lessons learned, and how we improved because of it.
![The Cost Of Cyber Risk: How Security Ratings Help With Policy Pricing](/sites/default/files/styles/4_3_small/public/migration/images/Thumb-The-Cost-Of-Cyber-Risk-How-Security-Ratings-Help-With-Policy-Pricing_1.jpg.webp?itok=e0JVlLC9)
Policy pricing is something every insurance company and underwriter struggles with at some point. The primary issue is differentiating between the risk an applicant presents and the information you’re given. Let’s take a closer look at how policy pricing is examined in cybersecurity today.
![BitSight Hackathon 2017](/sites/default/files/styles/4_3_small/public/migration/images/BitSight-Hackathon-4_1.png.webp?itok=fPbfA3cm)
For the second year in a row, Bitsight gave its engineers, product managers, and data and research scientists the day off from normal work to make something cool. The hackathon day had all the typical stuff: awesome custom-designed t-shirts, pizza for lunch, and a demo day the next day. The only “requirement” for teams was that they produce a working prototype to demo. We wanted actual code (not great code, necessarily, but code), not just design mocks.
![A Breakdown Of Terms In The General Data Protection Regulation (GDPR)](/sites/default/files/styles/4_3_small/public/migration/images/A-Breakdown-Of-Terms-In-The-General-Data-Protection-Regulation-GDPR_1.jpg.webp?itok=x0QyQUkj)
If your company processes the data of individuals who reside in the European Union, the General Data Protection Regulation (GDPR) is likely a hot topic around the office right now. Once the regulation goes into effect in May 2018, companies in violation of the GDPR could face massive penalties. But creating a compliance plan for your company can be quite difficult if you’re unfamiliar with the language used in the regulation.
![What Is the Benefit To an Outside-In Approach to Security Ratings?](/sites/default/files/styles/4_3_small/public/migration/images/12.22-Blog-Image-thumb_1.png.webp?itok=ix3wq5SV)
When Bitsight pioneered the security ratings market over six years ago, it was the first to use the outside-in approach to security ratings. Although not initially intuitive to many people, the value of this approach has become increasingly clear for many reasons and subsequently, its adoption has become more widespread. At Bitsight, we believe that an outside-in approach is the best way to build a security ratings product, and has proven valuable in many use cases.
![The Top 10 Cybersecurity Articles Of 2017: A Recap](/sites/default/files/styles/4_3_small/public/migration/images/Cybersecurity%2520Articles%2520-%2520Thumb_1.jpg.webp?itok=dXIo-aKM)
2018 is right around the corner, and while we’re looking forward to what’s coming, we’re also thinking back on the best of this year. Here’s a look at 10 of our most frequently viewed cybersecurity articles in 2017.
![BitSight Releases ROBOT Vulnerability Identification Feature](/sites/default/files/styles/4_3_small/public/migration/images/Robot-Vulnerability-Blog-Thumb_1.png.webp?itok=PFGoWQgP)
Within the Bitsight Security Ratings platform, we prioritize features specifically chosen to help organizations identify and manage risks across their own networks and the networks of their third parties. Bitsight now enables users to identify organizations who are potentially vulnerable to ROBOT — short for "Return Of Bleichenbacher's Oracle Threat"— attacks. The vulnerability behind the ROBOT attack was originally discovered in 1998 and has resurfaced through a number of proprietary TLS/SSL implementations, affecting some of the most popular websites — including Facebook and PayPal. The vulnerability ultimately provides a method by which an attacker can decrypt TLS/SSL traffic and obtain sensitive information.
![To Quote Or Decline? Using Security Ratings To Validate Cyber Underwriting Decisions](/sites/default/files/styles/4_3_small/public/migration/images/Cyber%2520Underwriting%2520Decisions%2520-%2520thumb-1_1.jpg.webp?itok=E4Debzzh)
Determining whether you should quote or decline a cyber insurance applicant is an extensive and critical process. Typically, the decision is made after gaining an understanding of what the company does, identifying critical application information, and considering your organization’s risk appetite. But are you able to verify whether the decisions you’ve made are valid?
![5 Highlights Of The NYDFS Cybersecurity Regulations](/sites/default/files/styles/4_3_small/public/migration/images/NYDFS%2520Cybersecurity%2520Regulations%2520-%2520thumb_1.jpg.webp?itok=FjSkp1R7)
In March 2017, the New York Department of Financial Services (NYDFS) cybersecurity regulations—known as 23 NYCRR Part 500—went into effect. According to the regulation, “any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law” is considered a covered entity and must comply.
![Extra Budget 101: Invest in Your Cybersecurity and Risk Program](/sites/default/files/styles/4_3_small/public/migration/images/12.13-Cybersecurity-Budget-Blog-Full_1.png.webp?itok=ah-vG_aY)
As security and risk professionals work to finish out the year, they must also be thoughtful about planning for 2018. While it’s great to end the last quarter of the business year on a strong note, it’s even more critical for businesses to set themselves up for success when returning to work in January. One of the best ways to accomplish this is to be strategic about the extra budget they possess in Q4, and asking themselves this question: how can my organization be mindful about spending extra funds to benefit our security program later on?
![What You Need To Know About Vendor Compliance](/sites/default/files/styles/4_3_small/public/migration/images/checklist_vendor_compliance_small_1.jpeg.webp?itok=UaUTczO8)
Compliance, at its core, is a legal responsibility. It is defined as “act or process of doing what you have been asked or ordered to do.” Creating a successful vendor compliance program isn’t as simple as asking third parties to comply with your security requests or pestering them to answer your security risk assessment questions.
![A Year in Review: A Look Back on BitSight’s 2017](/sites/default/files/styles/4_3_small/public/migration/images/12.8-Year-In-Review-Blog-Thumb_1.png.webp?itok=-YIG3gCa)
As 2017 draws to a close, we can’t help but be grateful for what a banner year this has been for Bitsight.