The Reciprocity® Community Edition is now available and is your chance to see the new Reciprocity ROAR Platform in action and it…is…totally…free! This is a great opportunity for you to not only get an instance of the ROAR Platform but also to see how the Reciprocity Community can provide you with meaningful content and connections to other organizations facing similar challenges. And did I mention that it’s free?!?

COBIT is an acronym for Control Objectives for Information and Related Technologies. The COBIT framework was created by Information Systems Audit and Control Association, ISACA to bridge the crucial gap between technical issues, business risks and control requirements. COBIT is an IT governance framework for businesses that want to implement, monitor and improve their IT management best practices.

When protecting an organisation against cyber attacks, the words security threats, vulnerabilities, risk exposure, and sometimes exploits are seen very commonly. Unfortunately, these terms are not used correctly or interchangeably and are often left undefined.

Your organization’s attack surface can be a tricky thing to monitor. In our connected world, it seems like your attack surface is always expanding. That’s probably true. Attack surface expansion has exploded, driven by cloud adoption, the use of SaaS (software as a service) tools, and the fact that so many organizations have come to rely on third-party vendors.

In a world full of security breaches and litigation, every organization needs a solid strategy to identify and reduce risks relating to the use of third parties, e.g., vendors, suppliers, partners, contractors, or other service providers.

This blog is the latest in a series dedicated to Zhadnost, a Russia-aligned botnet first discovered by SecurityScorecard in March.

In 2020, SecurityScorecard uncovered a case in which self-signed certificates caused misattributions for CDN IPs, and IPs shared by many websites. At the time, we mitigated this issue by labeling CDNs (e.g. Cloudflare, Akamai, Fastly, etc.), so that customers could easily determine if their scoring problems were related to shared IPs.

In a threat landscape where organizations outsource vital business processes that leave data security in the hands of third-party information technology, vendor risk management is increasingly important. A 2022 KPMG study found that 73% of survey respondents experienced at least one significant disruption caused by a third party over the past three years.

Modern organizations are increasing cloud adoption to reap the operational benefits of outsourcing critical business functions. A 2021 study found that 90% of surveyed organizations now use cloud computing, such as software-as-a-service (SaaS) services. SaaS solutions help organizations achieve vital objectives, such as cost reductions and faster time-to-market. However, like all other digital transformation products, they also introduce cybersecurity risks.

The 2021 CrowdStrike Global Security Attitude Survey found that on average, organizations take 146 hours to discover a cybersecurity incursion, an alarming increase on the 2020 average of 117 hours. This means that an intruder could remain inside an enterprise network for more than six days before detection. Moreover, those attackers can move laterally across the network in just 92 minutes, searching for — and often finding — sensitive enterprise data or other high-value assets.