Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In baseball, it’s tempting to think that once you’re on a base, the hard part is over.

In today's interconnected business landscape, Third-Party Risk Management (TPRM), sometimes called vendor risk management (VRM), is a critical cybersecurity strategy for organizations aiming to safeguard their operations and reputation. With most companies increasing their reliance on external vendors and service providers, managing and mitigating risks associated with these third-party relationships is paramount.

In the past, we’ve written a lot about FedRAMP certification and the way the Ignyte platform can help you with record-keeping and the overall process. We’ve largely glossed over the role that the third-party assessment organization plays, hand-waving it as a relationship you build between your chosen 3PAO and your own organization. As a certified 3PAO, however, we do have a unique insight into this process.

Earlier this year, a Chinese company named Funnull acquired the polyfillio. Due to this acquisition, this code was used to redirect mobile visitors to scam sites. Over 100,000 websites using the previously popular Polyfill JS open-source project are vulnerable to attacks that redirect traffic to sports betting and pornography sites.

In 2013, the Australian Prudential Regulation Authority (APRA) introduced Prudential Practice Guide CPG 235, a comprehensive framework designed to enhance data risk management across the finance sector. This guide provides financial institutions with principles and best practices to safeguard data integrity, confidentiality, and availability. This blog explores CPG 235, its key components, compliance requirements, and how implementing the framework can enhance data security standards at your organization.

As cyber threats increase in complexity and frequency, traditional security methods often fall short of safeguarding sensitive data and vital systems. DevSecOps offers a groundbreaking approach by incorporating security practices into all stages of the software development lifecycle (SDLC). By uniting development, security, and operations, DevSecOps ensures that security is a collective responsibility, promoting a culture of collaboration and ongoing enhancement.

For two decades or so now, web applications have been the backbone of many businesses, making their security paramount. Dynamic Application Security Testing (DAST) and penetration testing are crucial for identifying and mitigating security vulnerabilities in web application security. While both aim to enhance application security, they differ significantly in their approach, execution, and outcomes.

Third-party penetration testing has emerged as a critical component of a comprehensive cybersecurity strategy. This article delves into third-party penetration testing and compares it with in-house pen testing, exploring its importance, benefits, and how to select a reliable provider.

Organisations employ various strategies to protect their digital assets and infrastructure. Two key components of a robust cybersecurity framework are Red Teams and Blue Teams. These specialised groups play distinct yet complementary roles in ensuring an organisation’s security posture remains strong in the face of constantly emerging threats.

Expanded support for multi business units, locations, and products. With multiple segments support across TrustCloud, you can develop and visualize your GRC requirements across business units, locations, and products. You can segment responsibilities and determine hierarchical impact through transparent parent-child relationships.