Third parties are a necessary part of your enterprise. They are your vendors, your suppliers, your contractors, and your partners. Without them, you can’t do business. Third parties provide cloud services, store sensitive data, and provide other important services. Unfortunately, third parties are also a major source of cyber risk. Cybercriminals often target third-party providers to target their clients’ data and networks, such as the notorious SolarWinds breach at the end of 2020.

Creating a cyber-resilient organization means understanding your security risks and how to mitigate them. However, the cybersecurity risk’s continuously shifting nature makes it challenging for organizations to choose the right risk assessment strategy. By understanding the types of risk assessments and how to use them, you can make better-informed decisions.

Utility companies are increasingly being targeted by cybercriminals. Although the highest profile utility cyber attack in recent memory was the May 7 ransomware attack on Colonial Pipeline that caused gas shortages on the East Coast, power companies of all kinds are popular with criminals for a reason: they can’t afford a shutdown and they have the money to pay a ransom.

Confidentiality, Integrity, and Availability. These are the three core components of the CIA triad, an information security model meant to guide an organization’s security procedures and policies. While people outside the information security community might hear the phrase CIA Triad and think “conspiracy theory,” those in the cybersecurity field know that the CIA Triad has absolutely nothing to do with the Central Intelligence Agency.

The Internet of Things (IoT) is a growing concern for today’s digitally-focused businesses. Every connected device you own can add another security concern to your list. If it collects and stores personal information and data, you’ve just added another attractive target for criminals to access your network. In fact, 57% of IoT devices are vulnerable to medium or high-severity attacks.

According to a study conducted by Ropes & Gray, 57% of senior-level executives rate “risk and compliance” as the top two categories they feel the least prepared to address. There are a lot of misconceptions about compliance and risk management. Both help to prevent security threats to the organization’s legal structure and physical assets. And often, when people hear the terms compliance and risk management, they assume the two are the same.

Everything connected to your network poses a security risk. Every application on every device poses a threat to that device which then increases your security risk profile. Ultimately, organizations need visibility into all users, applications, and devices on their networks. Whether arising from employees using personal devices or downloading applications to corporate devices, shadow IT is becoming a bigger problem for organizations.

In most companies today, there is a critical divide between the Chief of Information Security (CISO) and their board of directors. Our new book, The Perfect Scorecard: Getting an ‘A’ in Cybersecurity from your Board of Directors , is an attempt to close that gap. The Perfect Scorecard features insights from 17 leading CISOs and executives known for their leadership skills and their ability to communicate across roles and sectors.

A Service Organization Controls (SOC) report provides independent validation over a company’s internal financial reporting controls. They were originally used to validate compliance with the Sarbanes-Oxley Act of 2002. When the SEC released the “ Commission Statement and Guidance on Public Company Cybersecurity Disclosures ,” SOC reports started to include cybersecurity. Understanding what a SOC Type 2 report is can give insight into why it is important to your organization.

2020 was the year of the DDoS attack. Distributed Denial of Service (DDoS) attacks spiked over the last year, driven by the pandemic and the fact that so many people were locked down, working from home, and using online services to get through the pandemic. According to a report from NETSCOUT, more than 10 million DDoS attacks were launched last year, targeting many of the remote and essential services people were using to make it through the lockdown.