Read news articles covering Bitsight, the leader in security ratings. We're proud to be featured in these leading business & technology publications, journals, blogs, and broadcasts.
In The News
Bitsight Enterprise Analytics takes the guesswork out of identifying risk concentration throughout and enhances security performance across distributed enterprise groups. The solution helps security and risk leaders simplify security program monitoring, management and reporting by aligning risk management and communication with the existing business structure.
In 2016, security scanning and ratings firm Bitsight found that 13% of the higher-education sector had been infected with ransomware, the highest rate across all industries. Bitsight warned that the sharing mindset at schools and universities lead to more cybersecurity risk.
"Those in the education field naturally have an 'information-sharing' mentality, which lends to a high rate of peer-to-peer file sharing," the company stated in a blog post. "Universities and higher ed institutions encourage collaboration — but as a result, you often see students and faculty engaging in file-sharing activity on the school’s primary network."
Marc Light, vice president of data and research at risk management vendor Bitsight, agreed and said enterprises should take note of RDP vulnerabilities and patch them immediately. Bitsight released new research at Black Hat 2019 that showed the rate of patching for BlueKeep-vulnerable Windows systems has slowed recently, despite repeated warnings from both Microsoft and U.S. government agencies.
Bitsight is raising concerns over a potentiality "where the rate of patching tapers off leaving behind a legacy set of systems that remain vulnerable, perhaps unbeknownst to system Operators."
Likewise, Bitsight has also identified BlueKeep risk by industry, finding that the Telecommunications industry has an outsized risk, with over one third of organizations having vulnerable systems. Education follows in section place at just over 5%, followed by Technology, Government, and Utilities.
The public websites of more than half of 1,550 utilities in the U.S. and other countries assessed by security ratings firm Bitsight, use outdated software, according to a June report. This gives attackers an opening to companies’ systems, the report said.
Utilities are also wary about cyber threats targeting their supply chains. Many companies that do business with power suppliers have weaker cybersecurity safeguards than the utilities do, said Jake Olcott, Bitsight’s vice president for communications and government affairs.
Yet, while a catastrophic worm is the obvious threat, other, more subtle dangers exist as well, says Dan Dahlberg, director of security research at Bitsight.
"You think of the activities of the sorts of people trying to take advantage of this vulnerability for nefarious purposes — there are people who are less experienced, who would likely turn it into a worm," he says. "But there are other actors who might utilize this vulnerability in a much more stealthy manner, and that is going to be much harder to detect."
In early July, Bitsight found that some 800,000 computers still exhibited external signs of vulnerability to BlueKeep. About 5,000 systems are patched daily, Dahlberg says.
When BlueKeep was first discovered, the number of affected systems was put at around one million globally. Following the research from Bitsight in July, the authors claimed not much had been done to reduce the number of affected systems with the number thought to be around 800,000 at the time of publication.
Cybersecurity ratings company Bitsight, detailed that the number of exposed public-facing machines with the vulnerability dropped 17% between May 31 and July 2 but not far enough.
Bitsight found that the most responsive industries in mitigating BlueKeep have been legal, nonprofit/NGO and aerospace/defense with a 32.9 percent, 27.1 percent and 24.1 percent respective reduction in the number of organizations affected.
Security ratings firm Bitsight earlier this month scanned the Internet looking for vulnerable systems with remote desktop protocol services exposed to BlueKeep. The scan showed that as of July 2, a total of 805,665 systems remain vulnerable to BlueKeep, a 17.8% decrease over the nearly 973,000 vulnerable systems that Bitsight discovered in a scan it performed last month. Of the Internet-exposed systems that remain vulnerable to BlueKeep, about 105,170 are located in the US.
Suppliers such as Bitsight, a provider of software to manage third-party risk, has seen an increase in focus from senior managers on controlling how data is shared in supply chains, which may link hundreds or thousands of organisations together. Bitsight also collects security performance data from more than 180,000 companies globally. Since 1 May 2018, it has measured a 1.8% improvement in the performance of European organisations, while those in most other areas have slipped backwards.
Security ratings firm Bitsight, which has been tracking the malware since May, recently gathered telemetry from command-and-control domains that Triada-infected devices have been communicating with.
According to Bitsight, the telecommunications industry is by far the most affected, with over 30% of companies having exposed vulnerable devices. This sector is followed at a distance by education (6%) and technology (5%). At the other end of the chart we have the legal, insurance and finance sectors. It’s worth noting, however, that at least some progress has been observed across all industries.
As of July 2, security ratings company Bitsight had found that there was a 17 percent decrease in systems vulnerable to BlueKeep, indicating some progress in the patching of systems. However, "approximately 805,665 systems remain online that are vulnerable to BlueKeep," Bitsight had indicated in its July 17 blog post.
Currently, there exists a BlueKeep "working exploit" developed by the U.S. Department of Homeland Security, as well as one developed by the "private sector," Bitsight indicated. Bitsight recommended applying Microsoft's patches and removing the exposure of systems to Internet access.
Despite warnings from Microsoft, government agencies and cybersecurity companies, many organizations around the globe have yet to patch older Windows systems against the BlueKeep vulnerability that could let attackers take over devices, cybersecurity ratings firm Bitsight warns.