Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Team Fun In The Summer Sun: Community Engagement at BitSight](/sites/default/files/styles/4_3_small/public/migration/images/Corporate-Cup-Blog-Thumb_1.png.webp?itok=gcISpKLu)
Here @Bitsight, we are committed to our mission to transform the understanding of cyber risk through the usage of Security Ratings. It’s pretty serious stuff and involves lots of inspiration and even more perspiration. BUT we are not just about work. It’s important to us to have balance — to be involved in the local community and also to have plenty of fun.
![The “Swap” Model: Is Your Goal to Mitigate Risk...Or Just Move it Around?](/sites/default/files/styles/4_3_small/public/migration/images/7.25-Blog-Thumb_1.png.webp?itok=fWub5BOs)
In today’s security ratings services market, a few companies have offerings described as “swaps” or “slots.” When considering third party monitoring, this gives organizations the option to “trade out” which vendors they are monitoring when they see fit. But, does this type of disjointed monitoring actually proactively mitigate risk (which is the goal of utilizing a security ratings service) or just shift it around and hide it? This approach poses several problems.
![Meet Our Engineers: Nick Whalen](/sites/default/files/styles/4_3_small/public/migration/images/EngineerDataScienceBlogFull_14.png.webp?itok=WGJamRF-)
Want to know what it’s like to be an engineer at Bitsight? Check out this Q&A with a member of our engineering team to learn about her role as a software engineer, her experience, and more.
![How To Balance Speed & Quality In Cyber Underwriting Practices](/sites/default/files/styles/4_3_small/public/migration/images/Thumb-balance-speed-quality-in-cyber-underwriting_1.jpg.webp?itok=cUaUPC8M)
As an underwriter who’s constantly trying to balance being both quick and careful, the worst thing you can do is treat every single applicant the same. Doing so can ultimately be setting you up to take on more risk than you’d expect. Of course, the more experience you have, the better you’re able to quickly assess a company’s risk posture.
![Scaling Our SPA](/sites/default/files/styles/4_3_small/public/migration/images/Structuring-SPA-blog-thumb_2.png.webp?itok=BjlI3n00)
Bitsight recently completed a reorganization of a large part of our Single Page Application (SPA) code. Our goal was to make our codebase more scalable and developer-friendly by adding a few simple rules for where different parts of the application should live. In this article, I’ll describe what we left the same, what we changed, and how we did this while continuing to ship features on time.
![How Practitioners Can Share Their Security Expertise With the Board](/sites/default/files/styles/4_3_small/public/migration/images/7.11Blog-Thumb_1.png.webp?itok=XRa6xKKu)
There’s no doubt that organizations understand the value of implementing strong cybersecurity programs and encouraging their third parties to do the same. As data breaches continue worldwide, 63% of those breaches are caused through a third party vendor, according to Soha Systems’ Third Party Advisory Group. As such, Boards of Directors realize the need to have security and risk practitioners such as Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs) provide their expertise and guidance. In today’s landscape, cyber risks are at the front of Boards’ minds. This is why it is critical that security practitioners be in the room.
![Cybersecurity Team Structure: 7 Important Roles & Responsibilities](/sites/default/files/styles/4_3_small/public/migration/images/Cybersecurity%2520Team%2520Structure%2520-%2520thumb_1.jpg.webp?itok=muV_Ya_o)
You’ve heard it said that a chain is only as strong as its weakest link. When it comes to your cybersecurity team, this adage couldn’t be more appropriate. If you want this team to perform with both diligence and accuracy, it’s critical that you consider the following:
![Cyber Risk Should Be A Growing Concern to the Municipal Bond Market](/sites/default/files/styles/4_3_small/public/migration/images/MunicipalBondsBlogThumb_1.jpg.webp?itok=iH6E5UFQ)
Following an increase in ransomware cyber attacks, most notably May 2017’s WannaCry attack, U.S. public sector entities are starting to see the effects of these attacks on the almost $4 trillion municipal debt market. As a result, issuers are now starting to consider the cybersecurity posture of borrowers at the town, city, and local levels when they apply for bonds.
![Petya / NotPetya: What Security Diligence Tells Us](/sites/default/files/styles/4_3_small/public/migration/images/wannacry_gif_1.gif.webp?itok=fWlN-9Nn)
There are many details of yesterday’s ransomware attack are still being worked out, and its impact is still being assessed. Yet, there are many security diligence steps organizations can take to reduce exposure to these types of attacks. Below are best practices security and risk teams should be aware of, and implications for organizations who fall behind.
![Meet Our Data Scientists: Jessica Louie](/sites/default/files/styles/4_3_small/public/migration/images/MeetOurDataScientistsBlogFull_4.png.webp?itok=C5TE0EAF)
Want to know what it’s like to be a data analyst? Check out this Q&A with a member of Bitsight’s data science team to learn about what he does at Bitsight, his experience, and more.
![Catching the Blind Spots of Vendor Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/VRM-Blind-Spots-Blog-Thumb_1.png.webp?itok=FgUSqlOA)
In today’s day and age, organizations understand that data breaches are a growing problem, but many fail to realize that a third party breach can impact them as much as a breach on their own network. Here we’ll examine several misconceptions surrounding vendor risk management (VRM), and how you can proactively create a strategy to avoid common pitfalls.
![Takeaways from the 2017 Gartner Security & Risk Management Summit](/sites/default/files/styles/4_3_small/public/migration/images/IP-Registration-Blog-Full_1.png.webp?itok=7RfxYxLE)
This year marked another great Gartner Security & Risk Management Summit with over 3,000 attendees, bringing together CEOs, CIOs, CISOs, IT Directors, Risk Managers, and other risk and security professionals to National Harbor, MD from June 12-15. An underlying theme emerged from the numerous sessions I attended and the various conversations I had: all roads lead back to business value. Whether it’s a new vendor that a company is looking to onboard, or a cloud technology the organization is implementing, everything should tie back to a business decision.
![8 Free Cybersecurity Resources For Risk Managers & CISOs](/sites/default/files/styles/4_3_small/public/migration/images/cybersecurity_resources_full_1.jpg.webp?itok=cM_NFoLT)
Anyone who works in cybersecurity or organizational risk on a regular basis knows how valuable it is to stay up to date on the latest research. If you’re curious about a specific topic—anything from vendor security assessments to ransomware—or you want to improve your vendor risk management program, take a look at the cybersecurity resources and tips below. We’ve rounded up Bitsight’s most frequently downloaded guides, white papers, and research insights. And the best part? They’re all free.
![Keeping Your Reputation Safe: Why Monitoring the Attribution of IP Addresses Matters](/sites/default/files/styles/4_3_small/public/migration/images/IP-Registration-Blog-Thumb_1.png.webp?itok=10Qmu4r7)
Bitsight Security Ratings are based on security events and configurations present on a company’s digital infrastructure. As we discuss these ratings with companies, we’ve found that many of them have infrastructure registered to them that they are unaware of. With the recent WannaCry ransomware attacks (and with the increased frequency of cyber incidents overall), it is becoming critical that organizations take a more thorough look at their infrastructure. This preventative measure can help identify any vulnerabilities or malicious activity on unmonitored parts of a network, as well as confirm that accuracy of registrations.
![4 Reasons To Use Security Ratings Before Your Next Acquisition](/sites/default/files/styles/4_3_small/public/migration/images/securityratings_acquisition_full_1.jpg.webp?itok=dlkM46c2)
For years, cybersecurity was considered a “check-the-box” discussion during the merger and acquisition (M&A) process. It was almost always examined to ensure there weren’t any glaring issues or major red flags—but there wasn’t a whole lot of care or thought put into it.