Read about the latest cybersecurity news and get advice on third-party vendor risk management, reporting cybersecurity to the Board, managing cyber risks, benchmarking security performance, and more.
Insights blog.
Slicing through CISA’s KEV Catalog
![Blog Image KEV Research Announcement](/sites/default/files/styles/cta/public/2024/05/01/Blog%20Image%20KEV%20Research%20Announcement.png?itok=dUMFV8Tg)
Slicing through CISA’s KEV Catalog
Dive into the critical insights of CISA's Known Exploited Vulnerabilities (KEV) Catalog with Bitsight’s latest blog! Discover how KEVs, which signal urgent cybersecurity risks, are being tracked and mitigated across industries. Learn why addressing these vulnerabilities quickly is vital and how it impacts organizational security.
![Third-Party Risk Management Insights: 2015 Gartner Security & Risk Summit](/sites/default/files/styles/4_3_small/public/migration/images/cta-banner-bg_34.png.webp?itok=ArzrhB3E)
On December 20, 2013, soon after news of Target’s data breach broke, Venky Ganesan (Managing Director at Menlo Ventures and Bitsight Board Member) talked about Bitsight on CNBC. When asked about cutting edge technology in the cyber risk management space, Venky responded, “I think the most important thing we find right now is that security has become a board room issue. Everybody in the board room wants to know how secure are we, how can we measure security, and how can we manage it. We have an investment in a company called Bitsight that lets us get a rating on how secure your infrastructure is.”
![OCC Guidance: Ongoing Monitoring & Third-Party Risk Management](/sites/default/files/styles/4_3_small/public/migration/images/bigstock-Washington-Dc-Usa--July----195982744_1.jpg.webp?itok=PSXbdkU7)
In October, the Office of the Comptroller of Currency (OCC) issued new guidance for banks regarding third party risk management, listing one of their reasons for issuing these guidelines as failure by the banks "to perform adequate due diligence and ongoing monitoring of third-party relationships." Current means of assessing third party security risk include annual audits and questionnaires, tools that are useful but which fail to provide the continuous, evidence-based assessments banks need to truly understand their vendor risk, especially when it comes to security risk management.
![The Third Party Risk Perspective: JPMorgan Chase UCARD Data Breach](/sites/default/files/styles/4_3_small/public/migration/images/jp_morgan_chase_logo_icon_articles_1.gif.webp?itok=8BifaUZ8)
Earlier this month, tech security blogs and mainstream news outlets reported on a large data breach that affected banking giant JPMorgan Chase. During the event, which lasted from mid-July to mid-September, the personal information of customers who accessed online accounts of the bank’s UCARD product may have been exposed. While there seems to be no official word on the cause of the breach, the prevailing consensus from news sources is that unencrypted customer data was visible in plain text from logs that track user actions on the website. While the bank insists there is no evidence of illicit use of the compromised information, it is offering affected customers temporary credit monitoring.
![UPDATED: So many vendors ... but who's to blame for the breach?](/sites/default/files/styles/4_3_small/public/migration/images/cyber-security-fingerprint-_1.png.webp?itok=zhdhT2G6)
The local news is abuzz with a story of Boston convention attendees being victims of a credit card data breach. The impact is small - only about 300 people have been affected - but there seems to be a lot of finger pointing and shuffling around while the conference organizers and convention center try to figure out which vendor is to blame.
![Shaun McConnon on Compliance & Security Risk](/sites/default/files/styles/4_3_small/public/migration/images/risk-mgmt-monitor_1.png.webp?itok=rVQIp5Qv)
On November 20th, Bitsight CEO Shaun McConnon was published by the Risk Management Monitor. His article, "Looking Beyond Compliance When Assessing Security" explores how risk managers can take a more comprehensive approach to mitigating security risk by augmenting traditional audits, questionnaires, tests and assessments with a continuous evaluation of security effectiveness.
![Cyber Risk Emerges as an Independent Category of Enterprise Risk Reporting](/sites/default/files/styles/4_3_small/public/migration/images/Mike-Duffy_1.jpg.webp?itok=JeCQGgjq)
This post is contributed by guest blogger Michael Duffy, a member of Bitsight's Board of Directors.
![Webinar: Managing Information Security Risk in Your Partner Ecosystem](/sites/default/files/styles/4_3_small/public/migration/images/webinar_1.jpg.webp?itok=-DXiou9A)
Bitsight has partnered with The iSMG Network for a webinar series beginning on October 24, 2013. Securosis analyst and President, Mike Rothman will present along side Bitsight CTO and Co-founder Stephen Boyer in a session titled, "Managing Information Security Risk in Your Partner Ecosystem."
![In Search of Useful Models](/sites/default/files/styles/4_3_small/public/migration/images/useful-models-for-security-risk-measurment_1.png.webp?itok=MbFvX1xS)
I was in graduate school when I first heard the well-known quote by statistician George Box: “Essentially, all models are wrong, but some are useful."
![Security Risk Management: Should You Take A Reactive or Proactive Approach?](/sites/default/files/styles/4_3_small/public/migration/images/reactive-or-proactive-security-risk-management_1.jpg.webp?itok=jNVbpeWO)
In a world of evolving threats, executives are faced with the challenge of deciding whether to allocate scarce security resources in proactive investments that may prevent attacks or in reactive investments in response to security failures. Some researchers have argued that the most effective security investments are those based on lessons from past attacks, particularly when defending against similar incidents.
![How is Partner Security Risk Being Managed Today?](/sites/default/files/styles/4_3_small/public/migration/images/Global-Business-Partners_1.png.webp?itok=M2i1sXQq)
Partner security risk is an important topic in the minds of risk officers today. With the number of companies being breached via third parties on the rise (New York Times, Bank of America, Twitter), this is clearly a big area of concern. In a survey conducted by Ponemon in February 2013, 65% of participants said their organization had a breach involving the loss or theft of their organization’s information when it was outsourced to a third party. In April 2013, the Information Security Forum (ISF) wrote "Of all the supply chain risks, information risk is the least well managed."