Insights blog.

Want to know what it’s like to be a member of Bitsight’s data science team? Read this Q&A with Bitsight’s Senior Data Scientist, Tom Montroy, to learn about his job, experience, and more.

Check out this Q&A with a member of Bitsight’s engineering team to learn about his role as a Senior Test Engineer at Bitsight, his experience, and more.

The Shadow Brokers, a hacking group known for releasing exploits and vulnerabilities allegedly used by the National Security Agency (NSA), published a cache of tools over a month ago on April 14th. This release had initially caused panic within the security industry as it was believed at the time that some of the exploits were using zero day vulnerabilities, or vulnerabilities for which the vendor had not yet made a fix available. It was later learned that Microsoft had released a patch for these vulnerabilities in a March update, MS17-010.  Since these vulnerabilities were first revealed, a set of malicious actors have deployed the DOUBLEPULSAR backdoor onto affected machines to permit easier access, and another set have written a worm, known as WannaCry, to take advantage of unpatched systems and spread internally within a network. Bitsight customers have the ability to filter their portfolio of continuously monitored companies to determine those companies that are at risk because they have the DOUBLEPULSAR implant on a host.

Consider this: If you’re part of a large company with thousands of suppliers, you need efficient processes and tools to get a good sense of the risk those suppliers present. If you’re a part of (or own) a small company with only 20 suppliers, you likely don’t have a team of full-time employees dedicated to vendor risk assessment—which makes efficient processes critical for you as well. 

Spend any time in web development and you will be struck by the daunting pace at which the technology landscape changes.  The must-have technologies of today quickly become the legacy spaghetti code of yesterday.  In some cases, adopting new technology is as simple as adding a new library. Other times, large scale architectural changes need to be made.  For those looking to move from traditional server side MVC apps to newer client side single page apps, the migration path is not easy nor clear cut. 

In 2015, Bitsight published a report, Beware the Botnets: Botnets Correlated to a Higher Likelihood of a Significant Breach. In that report, researchers discovered that companies with botnet grades of ‘B’ or lower were more than twice as likely to experience a significant data breach. Now two years since that study, researchers examined more than 70,000 organizations and found similar results, including additional risk vectors that correlate to an increased likelihood of an organization experiencing a breach. Organizations have begun to take action based on these findings by communicating with trusted third parties who are likely to experience a data breach based on their security posture.

Among other things, cybersecurity is a primary focus on the Bitsight blog. The following is a list of Bitsight’s most-read cybersecurity articles and resources on the topic over the past couple of years, along with a description of what you’ll find in each.

Five to 10 years ago, communicating cyber risk wasn’t just difficult—it was downright rare. CISOs and CIOs were almost never asked to report metrics on cybersecurity to anyone except their direct supervisors.

The importance of monitoring third-party vendors has increased in recent years with the numerous data breaches originating in vendor systems. You have likely heard from news coverage of major breaches that because of how interconnected organizations are today, it’s critical to make sure your vendors aren’t leaving your data exposed.

Reputational risk is the potential for damage to an organization’s character or good name. If a bank or financial institution is hit with an incident that puts a mark on its reputation, the event could compromise the company’s perceived legitimacy, thus affecting the number of current customers, prospective customers, shareholders, and the stock price. And because information is disseminated online and through social media so rapidly, this type of event could cause reputational harm almost immediately.

A few months ago, Anubis Bitsight Labs researchers discovered that millions of low-cost Android phones, many of them in the United States, were vulnerable to Man-in-the-Middle attacks. The backdoor could be exploited through unregistered internet domains that had been hardwired into the Ragentek firmware used in these devices. A hacker with control of the domains could have installed malware bypassing Android’s security protections.

We were curious about what CISOs and security managers have on their minds these days—so we searched around online and asked a few to share their thoughts. Below, you’ll find some interesting insights and observations to get a good conversation started in your office. 

Stress and worry are emotions that are often linked with the period between the beginning of a new year and mid-April, the federal tax filing deadline. Modern technology has brought with it techniques and applications that reduce this burden by making it easier for consumers to prepare a tax return. Unfortunately the age of e-filing has come with increased risk of tax fraud due to cybercrime. According to IRS statistics, investigations, prosecutions, and convictions for tax crimes, including those involving identity theft, have been on the decline over the last three years.

As an underwriter in the cyber insurance industry, you know that insurance is all about information. You’re responsible for making decisions about your applicants based on the details given to you—but you’re also aware of the potential for asymmetry in this information.

Fortune 1000 organizations are acknowledged for generating significant amounts of revenue. Yet beyond bringing in a considerable amount of money, these companies are also integral to the supply chains of many organizations around the world. Recognizing this, Bitsight researchers set out to understand the security strengths and weaknesses found in Fortune 1000 companies. Companies that share data and network access with these organizations should be cognizant of common cyber risks found within these organizations, and use this insight to better inform their third party risk management programs.