Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Interest in Financial Services Third Party Risk Rising](/sites/default/files/styles/4_3_small/public/migration/images/ConnectedBusiness_1.png.webp?itok=DUiD5Va_)
There’s certainly been a lot of talk about third party risks recently. There’s been the fallout from the Target breach, and the role a subcontractor played in that incident. Then there was the U.S. Department of Homeland Security incident, where the DHS reportedly exposed private documents of at least 114 contractors that bid for work at the agency, as well as plenty of discussion surrounding third-party risk and the critical infrastructure, too. And there’s also been considerable attention given to third-party risks as it relates to financial services companies.
![Hearts Bleed Over Latest SSL Vulnerability](/sites/default/files/styles/4_3_small/public/migration/images/openssl-logo_1.png.webp?itok=W_VTl4Na)
On April 7, the open-source OpenSSL project issued an advisory regarding a critical vulnerability identified as CVE-2014-0160 and called “Heartbleed.” This flaw, which takes advantage of OpenSSL’s heartbeat feature, has been present in OpenSSL for over two years, but was only recently discovered. It allows an attacker to trick systems running any version of OpenSSL 1.0.1. from the past two years into revealing 64 KB of data sitting in its system memory per request. There is no limit to the number of requests an attacker can make. Attackers can gain access to private keys, user names, passwords, credit card data, and other sensitive information. They can spoof a website by launching a more effective man-in-the-middle attack. What is both scary and brilliant about attacks exploiting this vulnerability is that they leave no trace in the server logs.
![Risk 101: SSL Key Indicator in Security Effectiveness](/sites/default/files/styles/4_3_small/public/migration/images/SSL-Implementation-UPDATED-022814_1.png.webp?itok=XewSQrAv)
This post is part of the Risk 101 series.
![Managing Third Party Security Risk in the Critical Infrastructure](/sites/default/files/styles/4_3_small/public/migration/images/third-party-security-risk-critical-infrastructure_1.jpg.webp?itok=A1Sgx8mb)
There’s no shortage of challenges when it comes to securing the critical infrastructure. These are very complex, interconnected systems, and highly motivated, potentially well-trained and funded adversaries target them. And should critical infrastructure systems become unavailable, whether electrical, financial, or communications systems – every public sector organization and private enterprise that relies on them is also in danger of being severely hampered, or even shut down.
![Why a Proactive Approach to Vendor Risk Management is Necessary](/sites/default/files/styles/4_3_small/public/migration/images/Proactive-Reactive-Risk-Management_1.png.webp?itok=uZY-VuxF)
When third party vendors, partners, processors and contractors find out about a breach of your customers' data, do you know what their notification practices are? Would you be surprised to know that almost a full third of them probably won't ever let you know that they've put your data at risk?
![Third-Party Risk Management Insights: 2015 Gartner Security & Risk Summit](/sites/default/files/styles/4_3_small/public/migration/images/cta-banner-bg_34.png.webp?itok=ArzrhB3E)
Last week I had the opportunity to be in San Francisco for the RSA conference and Metricon 9. The discussion at the conference and what is now coming out in news reports is that this was the largest RSA event to date in terms of attendance and exhibitors. I agree with what Morgan Stanley cited in their RSA Conference takeaways report: the attention that recent high profile breaches have received contributed to the increased interest from attendees. Cyber risk has finally become a board level issue. The heightened awareness and consequently anticipated increases in security budgets evidence the recognition that organizational cyber security performance is a critical business issue.
![Cyber Security Risk: Perception vs Reality in Corporate America](/sites/default/files/styles/4_3_small/public/migration/images/Optimism-Bias-Leads-to-Security-Risk_1.png.webp?itok=tApcRb-8)
In February, Bitsight released a new Bitsight Insight examining the cyber health of the U.S. economy and found that 82% of the 460 companies assessed had an externally observable security compromise in 2013. Examples of security events observed by Bitsight include communications between compromised computers inside an organization and external computers known to be under the control of an attacker, distribution of malware, and propagation of malicious email. Although these security events do not necessarily equate to data loss, each one is an indication that the organization has been compromised in some manner.
![Third-Party Risk Questionnaires: Best Practice or Legacy Tool?](/sites/default/files/styles/4_3_small/public/migration/images/Third%2520party%2520risk%2520questionnaires_False%2520Sense%2520of%2520Security_1.png.webp?itok=G-5KSd9p)
Questionnaires have been a key part of third-party risk management programs for decades. And, until recently, they were the primary way businesses checked up on the cybersecurity performance of their third-party vendors.
![Regulators Put More Emphasis on Third-Party Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/third-party-information-security-regulations_1.png.webp?itok=aCwF-41m)
With so much of today's business processes dependent on a complicated network of suppliers, contractors, and service providers, the problem of determining liability for data privacy and protection is quickly coming to a head. When sensitive data is hosted in a provider's infrastructure, is that provider or its customer responsible for protecting that data? If a company entrusts a partner with a customer database and that partner lets the database be compromised, which company is responsible for notifying those customers and who will end up footing the bill for legal damages?
![Target Breach Investigation Shows Tangled Web of Third Party Risks](/sites/default/files/styles/4_3_small/public/migration/images/Target-Third-Party-Breach_1.png.webp?itok=nFDwXPHI)
As more and more details surrounding the Target breach continue to unfold, it's becoming evident just how complicated it can be for investigators and journalists to follow the trail of evidence left behind. The latest reports suggest that one or more business partners were used by the attackers to gain access to Target's systems. Below is a summary of top stories which provide insight into the tangled web of third party vendors and suppliers which may have left Target vulnerable to attack, highlighting just how esstential it is for organizations to be aware of their third party risks.
![The Impact of Target’s Data Breach Throughout the Partner Ecosystem](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-The-Hamilton-Crossings-shoppin-260589403_1.jpg.webp?itok=0VLcEZmN)
Many of the facts surrounding the Target breach still remain unclear, even as details continue to emerge publicly. We still don’t know what the final tally of breached organizations will be, but the list keeps growing. In addition to who else has been breached and the impact on their customers, another factor we need to consider is how Target's business partners may be impacted. In a data breach on any retailer, card issuers, payment processors, insurers, suppliers and other parties may face substantial loss as the investigation and recovery costs ripple through these networks.
![Security Success is Found When Continuously Measuring the Right Things, Across Your Ecosystem](/sites/default/files/styles/4_3_small/public/migration/images/Monitoring-icon_1.png.webp?itok=pzmgfFKP)
Security monitoring and measuring needs to be expanded to trusted third parties; here’s why.
![Target & Neiman Marcus Are Not Alone: Malware in the Retail Sector](/sites/default/files/styles/4_3_small/public/migration/images/BitSight_retail_threats_1.png.webp?itok=8vA4Jt1m)
The past few weeks have been full of news regarding cyber attacks in the retail sector. First Target, and then Neiman Marcus. Now news outlets are reporting that three other well-known retailers may announce breaches that occurred in the past year.
![Security Ratings Uncover Decline in Security Posture of US Retailers](/sites/default/files/styles/4_3_small/public/migration/images/BitSight_SecurityRatings-_Retail_Sector_%25281%2529_1.png.webp?itok=JMIfNhIt)
In light of the recent news of retailers being attacked late last year, we at Bitsight looked into our security ratings (an external measure of a company’s security posture) to gain some insight into these attacks.
![Risk Universe Explores Vendor Risk Management with Mike Duffy](/sites/default/files/styles/4_3_small/public/migration/images/riskuniverse-logo_1.jpg.webp?itok=iv6h0D0l)
With increased emphasis on third party risk management coming down from regulators and executive boards alike, cyber risk in the extended enterprise is shaping up to be a hot topic in 2014.