Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Vendor security is becoming a focal point of risk management for many organizations. In many ways, this trend started with the Target breach from 2013, which highlighted the extensive financial and reputational impact of a third party security breach. Gartner estimates that by 2019, the need for transparency into operational and security activities within a vendor's value network will drive demand for vendor security by 30%.
![The Top 7 CIO Challenges In 2017](/sites/default/files/styles/4_3_small/public/migration/images/The%2520Top%25207%2520CIO%2520Challenges%2520In%25202017%2520-%2520thumb_1.jpg.webp?itok=WwdsqVp4)
In today’s security landscape, the CIO has a large and important role to fill. They must be aware of and compliant with regulations in their industry, focus on ensuring that the right security controls are in place for the organization and its vendors, and be able to consider the risks and benefits of new business processes.
![Portfolio Remediation Strategy Screenshot](/sites/default/files/styles/4_3_small/public/2022/11/29/Portfolio-Quality-ScreenShot-1_1.png.webp?itok=R0qDcA0W)
With third parties becoming a major attack vector into organizations, Bitsight is focused on enabling security and vendor risk professionals to better prioritize their efforts when it comes to identifying and monitoring cyber security risks across their vendor ecosystem. Bitsight Security Ratings customers can now prioritize issues and receive customized alerts when the aggregate performance of multiple companies change.
![How To Approach IT & Cybersecurity Benchmarking As A CIO](/sites/default/files/styles/4_3_small/public/migration/images/benchmarking_full_1.jpg.webp?itok=u57h21fO)
To a chief information officer (CIO), cybersecurity is a multifaceted concern. Not only could a breach that results in a loss of sensitive data or information be a legal or reputational nightmare for their organization, but it could also cost them (and others in the C-suite) their job.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
In this article, we will be detailing an issue we discovered affecting a number of low-cost devices. It allowed for adversaries to remotely execute commands on the devices as a privileged user if they were in a position to conduct a Man-in-the-Middle attack. The binary responsible appears to be an insecure implementation of an OTA (Over-the-air) mechanism for device updates associated to the software company, Ragentek Group, in China. All transactions from the binary to the third-party endpoint occur over an unencrypted channel, which not only exposes user-specific information during these communications, but would allow an adversary to issue commands supported by the protocol. One of these commands allows for the execution of system commands. This issue affected devices out of the box.
![Red Cross Data Breach: How 550,000 Australian Donors Were Exposed](/sites/default/files/styles/4_3_small/public/migration/images/Red%2520Cross%2520Data%2520Breach%2520How%2520550000%2520Australian%2520Donors%2520Were%2520Exposed%2520-%2520thumb_1.jpg.webp?itok=g_jdqFRI)
In 2015, the Australian Red Cross contracted with a web development company called Precedent to create a new website. Unfortunately, the vendor left sensitive donor information from the Red Cross in a backup database on a public-facing website.
![Ransomware's Impact On Government Cybersecurity](/sites/default/files/styles/4_3_small/public/migration/images/Ransomwares%2520Impact%2520On%2520Government%2520Cybersecurity%2520-%2520thumb_1.jpg.webp?itok=QqlLFPj8)
In our most recent Bitsight Insights report, we discuss the pervasive issue that is ransomware. The report states that education has the highest rate of ransomware across all industries—and government comes in second.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Written with the assistance of Dan Dahlberg, Ethan Geil, and Ross Penkala.
![Ideas For Incorporating Continuous Risk Assessment Software Into New Vendor Selection](/sites/default/files/styles/4_3_small/public/migration/images/Takeaways_From_Yahoos_500-Million-Account_Breach_1.jpg.webp?itok=cJ9BbjfA)
Onboarding third-party vendors that will have access to your network and data can have dire consequences if you don’t have the ability to gauge vendor risk. In a recent joint survey between Bitsight and IDG Research Services, more than 260 IT managers and professionals, nearly 70% said they were “extremely concerned” or “very concerned” about the security risks posed by third-party vendors and suppliers. Another study found that nearly two-thirds of breaches involve a third party.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Bolek is a recent malware from the Kbot/Carberp family. We first heard about this malware from the cert.pl blog post in May 2016, and since then, a few others have published additional information about it (links below).
![Takeaways From Yahoo's 500-Million-Account Breach](/sites/default/files/styles/4_3_small/public/migration/images/Takeaways_From_Yahoos_500-Million-Account_Breach_-_thumb_1.jpg.webp?itok=-h5T1wcL)
Last month, email giant Yahoo announced the compromise of 500 million user accounts—which is being called the largest breach from a single site in history. The breach compromised names, email addresses, telephone numbers, dates of birth, passwords, and some encrypted or unencrypted security questions and answers.
![Debunking Security Rating Myths](/sites/default/files/styles/4_3_small/public/migration/images/vendor_selection-stock-big_4.jpg.webp?itok=IZoUSuh8)
Ponemon Institute’s study, Data Risk in the Third-Party Ecosystem, highlights the challenges that companies face in protecting sensitive and confidential information shared with third parties.
![Debunking Security Rating Myths](/sites/default/files/styles/4_3_small/public/migration/images/vendor_selection-stock-big_4.jpg.webp?itok=IZoUSuh8)
Security Ratings are still a relatively new phenomenon. As a result, many security and risk professionals are still familiarizing themselves with how ratings work, the data used to compute ratings, and how ratings are put into action. We expect this education to continue: consumer credit scores are always changing and after many years, people are still constantly coming up to speed with the multitude of factors that affect their score.
![bitsight-blog](/sites/default/files/styles/4_3_small/public/2024/05/24/bitsight-blog.jpg.webp?itok=-q3o2lKI)
Like many technical industries, cybersecurity has a lot of specialized lingo. But there are two dozen cybersecurity terms in particular that are critical to understand. We’ve defined them here (in alphabetical order) and linked to a few articles that may help you better understand them along the way.
![The Rising Face of Cybercrime: Ransomware](/sites/default/files/styles/4_3_small/public/migration/images/ransomware-stock-big_1.jpg.webp?itok=X6LOX3eZ)
Ransomware has been all the talk lately in the security industry- and deservedly so. These attacks have surged in the last year: hospitals, banks, and local police departments have all been infected with ransomware. Organizations have been paralyzed for days and weeks as a result of ransomware infections. In March, a MedStar Health clinic in Baltimore reportedly turned away patients and had trouble accessing electronic medical records. In a separate incident, the University of Calgary paid a $20,000 ransom earlier this year after malware encrypted the university's email servers. In addition to a financial loss for organizations that decide to pay ransoms, these attacks have the potential to cause severe operational disruptions for companies.