Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Meet Our Engineers: Nuno Boavida](/sites/default/files/styles/4_3_small/public/migration/images/EngineeringDadtaScienceBlogThumb_1.png.webp?itok=Qk1XKDiU)
Read this Q&A with a member of Bitsight’s engineering team to learn about his role as a front-end developer in our Lisbon office, his experience, and more.
![5 Credible Cybersecurity Threats To The Financial Services Sector](/sites/default/files/styles/4_3_small/public/migration/images/cybersecurity_financialservices_full_1.jpg.webp?itok=hWNB9eZQ)
The financial services sector has traditionally been viewed as highly mature when it comes to cybersecurity initiatives. In fact, this Bitsight Insights report found that the financial sector had the highest Security Rating of all examined industries. But even though companies in the financial sector has been discussing the necessity of monitoring cybersecurity for quite some time, the threat landscape is constantly evolving—leading to a more complex cyber ecosystem every day. This makes it all the more critical to be proactive when it comes to cybersecurity issues.
![BitSight Research Explores A Risk Frequently Ignored: Critical Updates](/sites/default/files/styles/4_3_small/public/migration/images/Q2-Insights-Report-Blog-Thumb_1.png.webp?itok=kxIYbFPe)
Last month, thousands of computers across the world were infected by a strain of ransomware known as WannaCry. Estimates show that this massive attack impacted over 300,000 computers across banks, hospitals, telecommunications services, train stations, and numerous other critical services. Months before this attack, Microsoft had released a patch of all Server Message Block (SMB) vulnerabilities, including EternalBlue, which researchers believe is one of the vulnerabilities that criminals exploited to carry out the attack. Despite the available patch, it appears that many companies neglected to install the critical update (MS17-010) from Microsoft prior to the attack.
![Meet Our Data Scientists: Jessica Louie](/sites/default/files/styles/4_3_small/public/migration/images/MeetOurDataScientistsBlogFull_4.png.webp?itok=C5TE0EAF)
Check out this Q&A with one of Bitsight’s data scientists to learn about what she does as a part of our data science team, her experience, and more.
![BitSight Helps Scale the Current Vendor Risk Assessment Approach](/sites/default/files/styles/4_3_small/public/migration/images/5.30.VendorRiskManagementBlogFull_1.png.webp?itok=YKlLLxt_)
While your current Vendor Risk Management (VRM) or Third-Party Risk Management (TPRM) program may have areas of strength, there is most certainly room for improvement. These programs are a significant driver of both internal and external advisor time, extremely costly, and limited in scale. How can you harness more actionable insight to scale your program and truly and continuously understand the cybersecurity of your third parties? Using Bitsight Security Ratings, you can see a positive impact on your TPRM/VRM program by getting more value out of what you are already doing.
![Meet Our Engineers: Nick Whalen](/sites/default/files/styles/4_3_small/public/migration/images/EngineerDataScienceBlogFull_14.png.webp?itok=WGJamRF-)
Want to know what it’s like to be an engineer at a fast-growing start-up? Check out this Q&A with a member of Bitsight’s engineering team to learn about his role as Engineering Manager, his experience, and more.
![How the Impact of WannaCry Ransomware Was Felt Around the World](/sites/default/files/styles/4_3_small/public/migration/images/Assesing-Global-Impact-WannaCry-Ransomware-Thumb_1.png.webp?itok=Sm1FjJ9M)
After the initial analysis of the WannaCry ransomware attacks, our Research & Development team put together a global assessment of the impacts and repair process needed for affected systems to recover.
![Meet Our Data Scientists: Tom Montroy](/sites/default/files/styles/4_3_small/public/migration/images/MeetOurDataScientistsBlogThumb_1.png.webp?itok=xZnQqT_J)
Want to know what it’s like to be a member of Bitsight’s data science team? Read this Q&A with Bitsight’s Senior Data Scientist, Tom Montroy, to learn about his job, experience, and more.
![Meet Our Engineers: Nick Whalen](/sites/default/files/styles/4_3_small/public/migration/images/EngineerDataScienceBlogFull_14.png.webp?itok=WGJamRF-)
Check out this Q&A with a member of Bitsight’s engineering team to learn about his role as a Senior Test Engineer at Bitsight, his experience, and more.
![Understanding the Effects of DoublePulsar & WannaCry Across Industries](/sites/default/files/styles/4_3_small/public/migration/images/5.15blogthumbnail_1.png.webp?itok=URjtN0BM)
The Shadow Brokers, a hacking group known for releasing exploits and vulnerabilities allegedly used by the National Security Agency (NSA), published a cache of tools over a month ago on April 14th. This release had initially caused panic within the security industry as it was believed at the time that some of the exploits were using zero day vulnerabilities, or vulnerabilities for which the vendor had not yet made a fix available. It was later learned that Microsoft had released a patch for these vulnerabilities in a March update, MS17-010. Since these vulnerabilities were first revealed, a set of malicious actors have deployed the DOUBLEPULSAR backdoor onto affected machines to permit easier access, and another set have written a worm, known as WannaCry, to take advantage of unpatched systems and spread internally within a network. Bitsight customers have the ability to filter their portfolio of continuously monitored companies to determine those companies that are at risk because they have the DOUBLEPULSAR implant on a host.
![Vendor Risk Management: 5 Ways To Improve Your Efficiency](/sites/default/files/styles/4_3_small/public/migration/images/Vendor%2520Risk%2520Management%25205%2520Ways%2520To%2520Improve%2520Your%2520Efficiency%2520-%2520thumb_1.jpg.webp?itok=7SIyApcR)
Consider this: If you’re part of a large company with thousands of suppliers, you need efficient processes and tools to get a good sense of the risk those suppliers present. If you’re a part of (or own) a small company with only 20 suppliers, you likely don’t have a team of full-time employees dedicated to vendor risk assessment—which makes efficient processes critical for you as well.
![5 Must-Haves When Transitioning to a Single Page Application](/sites/default/files/styles/4_3_small/public/migration/images/5.10.blogthumbnail_1.png.webp?itok=m5ghxp5h)
Spend any time in web development and you will be struck by the daunting pace at which the technology landscape changes. The must-have technologies of today quickly become the legacy spaghetti code of yesterday. In some cases, adopting new technology is as simple as adding a new library. Other times, large scale architectural changes need to be made. For those looking to move from traditional server side MVC apps to newer client side single page apps, the migration path is not easy nor clear cut.
![Two Years Later, Still at Least Twice as Likely](/sites/default/files/styles/4_3_small/public/migration/images/5.1.17blogthumbnail_1.png.webp?itok=Xujdkln3)
In 2015, Bitsight published a report, Beware the Botnets: Botnets Correlated to a Higher Likelihood of a Significant Breach. In that report, researchers discovered that companies with botnet grades of ‘B’ or lower were more than twice as likely to experience a significant data breach. Now two years since that study, researchers examined more than 70,000 organizations and found similar results, including additional risk vectors that correlate to an increased likelihood of an organization experiencing a breach. Organizations have begun to take action based on these findings by communicating with trusted third parties who are likely to experience a data breach based on their security posture.
![The 8 Most-Read Cybersecurity Articles On The BitSight Blog](/sites/default/files/styles/4_3_small/public/migration/images/Thumb-cyber-security-articles_1.jpg.webp?itok=eU8-9tP5)
Among other things, cybersecurity is a primary focus on the Bitsight blog. The following is a list of Bitsight’s most-read cybersecurity articles and resources on the topic over the past couple of years, along with a description of what you’ll find in each.
![How To Communicate Cyber Risk As A CIO](/sites/default/files/styles/4_3_small/public/migration/images/How%2520To%2520Communicate%2520Cyber%2520Risk%2520As%2520A%2520CIO%2520-%2520thumb_1.jpg.webp?itok=kaQlzAtV)
Five to 10 years ago, communicating cyber risk wasn’t just difficult—it was downright rare. CISOs and CIOs were almost never asked to report metrics on cybersecurity to anyone except their direct supervisors.