With the rise of ransomware and cyber attacks, the term defense-in-depth has risen to the forefront, but what exactly does it mean? At its core, defense-in-depth is a protection mechanism for network security–an approach that involves layering or using multiple controls in series to protect against possible threats. This layered concept provides multiple redundancies in the event systems and data are compromised.

We’re excited to announce Nightfall’s partnership with Cribl, the high scale, data processing and observability platform. Cribl’s platform gives companies greater value out of their data by serving as the core plumbing connecting all of your data platforms, allowing users to set up workflows and extract essential data for processing, analysis, or storage.

Over 20 years ago, USB flash drives, also known as thumb drives, were regarded as a breakthrough in portable data storage technology. Today, they are seen as a major security risk. If you must use a USB flash drive for data storage, there are ways to improve your data security. Read on to learn how to secure your thumb drive. If you’re aware of sensitive data and its storage requirements, skip ahead to our top 7 tips for securing your USB flash drive.

ePHI stands for electronic protected health information. Electronic protected health information is protected under the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA. ePHI security is governed by the HIPAA Security Rule. With the rise of telehealth, covered entities need to understand the requirements for safely transmitting, storing, and using ePHI to be compliant with the Security Rule and to protect a patient’s privacy.

When defining security policies, it is critical to know who the user is and what their privileges should be based on their role, and whether the device itself or the state of the device at the time of connection is in a known good state.

Title II of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) has two key provisions: the Privacy Rule and the HIPAA Security Rule. The Privacy Rule establishes standards for protecting certain health information, or PHI. The Privacy Rule requires those organizations that are governed by HIPAA (covered entities) to implement safeguards to protect the privacy of PHI, and gives individuals the right to access and share their health records.

Today’s threat actors often carry out cyber attacks with the primary objective of accessing and exfiltrating sensitive information from your IT environment. Efforts to obtain this “crown jewel” information usually involve complex multi-phase cyber attacks. But another way in which sensitive data ends up in the hands of malicious actors with a lot less effort is when an organization exposes sensitive data assets in a data leak incident.

It's not uncommon to hear about businesses storing large volumes of personal data. There are endless reasons as to why personal data may be collected and processed, such as to build user profiles in order to send targeted products and services. However, many businesses fail to consider what should be done with the data once it has served its purpose, without negatively influencing their reputation and infringing upon a data subjects' rights.

Another day, another data breach has become a common refrain, in a world saturated with data breaches and other types of data exposures. But over the past few years, a subtle change in the nature of breaches has taken place. We documented some of this change in our analysis of the 100 largest breaches in the 21st century, highlighting that breaches were getting larger and more likely the result of misconfigurations.

We are excited to share that NC Protect for Microsoft 365 is now available in both Microsoft Azure Marketplace and Azure Government Marketplace! archTIS customers can now take advantage of the productive and trusted Azure cloud platform, with streamlined procurement, deployment and management of NC Protect for M365 from the Marketplaces.

Today, for enterprises and even SMB companies, IT is a sprawling but interconnected universe of applications, devices, and services all running in tandem to maintain the lifeblood of these organizations—data. Navigating the complexities of this arrangement is not just a challenge for security teams (something which Nightfall customers have attested to, before adopting our platform), it’s a genuine challenge for anyone who must manage and use information.

Missed last week’s archTIS Defense & DIB Cybersecurity Summit with leading industry and defense experts? Watch the recording for their insights on the zero trust, CMMC 2 and the new threats the industry is facing and how to best combat them.

Broadly speaking, an information security program is a set of activities and initiatives that support a company’s information technology while protecting the security of business data and enabling the company to accomplish its business objectives. An information security program safeguards the proprietary information of the business and its customers. The Gramm-Leach-Bliley Act (GLBA) has a more specific definition of what a security information program should entail.

In early April, the tech industry witnessed a major GitHub security incident targeting GitHub organizations using Heroku and Travis CI. GitHub was made aware of this threat via an attack leveraging AWS API keys to GitHub’s own npm production infrastructure. As upstream security risks within SaaS platforms become more common, organizations that leverage these platforms are relying on tools like Nightfall to protect themselves.

The Gramm-Leach-Bliley Act (GLBA) aims to protect consumer financial privacy with three provisions: the Financial Privacy Rule, the Safeguards Rule, and the Pretexting Provisions. In our previous post, we covered the GLBA Financial Privacy Rule and what financial institutions, as defined by the GLBA, need to know to be compliant.

Microsoft Teams is a fantastic collaboration tool allowing people to share data effortlessly within the same organization and even across organizations. Unfortunately, because it was built with collaboration as the primary driver, it can be easy to ‘overshare’ data you don’t want to share.

We’re pleased to announce that Nightfall has joined Snyk’s Technology Alliance Partner Program (TAPP). Nightfall will sit alongside partners like RedHat, and Hashicorp to provide critical DevSecOps functionality to developers.