Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Is cyber risk insurable? That question is often at the heart of the debate about the future of the cyber insurance industry. One of the primary drivers of that question is the insurance industry’s challenges when managing systemic cyber risk since many believe that systemic cyber risk has the potential to bankrupt the industry. While there hasn’t been a catastrophic cyber incident that has proven the skeptics right, there have been several close calls.

Organizations are increasingly reliant on complex systems and vast amounts of sensitive data, which makes them attractive targets for cybercriminals. However, while external threats are often in the spotlight, insider risks posed by privileged users who have elevated access to critical systems and sensitive information often goes unnoticed.

Whether you’re a Halloween or comic con fan, dressing up as your favorite character is something you’ve probably done at least once in your life. As a kid, you were excited to put on that flimsy Batman mask and cape, thinking you looked just like the hero you saw on the movie screen. As an adult, getting or making the most move-accurate costume may allow other people to think that you are the actor in disguise.

Drones are becoming ubiquitous. They are sold as toys, used in industry, and as weapons of war, so the possibility of one becoming co-opted by a threat actor could result in severe damage, disruption of services, or data theft. In response, CISA and the FBI released a notification and guidance on Chinese-manufactured unmanned aircraft systems (UAS) aka drones, that could have vulnerabilities enabling data theft or that could facilitate network compromises.

SolarWinds, MOVEit, Knight Capital, and now CrowdStrike. The vendor ecosystem will remain a major playing field for operational disruptions. But are you ready for the next inevitable event? As a CISO, your response to such a question from the board shouldn't be anything less than a resounding "Yes!" Here are five plans of action to help your organization survive the next major IT quake, whether it's due to another rusty security update or a third-party breach.

The ubiquitous CrowdStrike incident resulted in a major diversion of resources, with some hard-hit organizations assigning almost all of their IT and security personnel to damage control. As a CISO of an impacted organization, you will likely be required to answer for a lack of resilience to this type of event. To support your decision-making as you reevaluate your resilience budgets, this post outlines four resilience strategies based on key learnings from the CrowdStrike event.

In the modern workplace, GenAI models have become powerful assets due to their ability to introduce efficiency, up level product innovation, and expedite how teams close the gap on competitors. However, these powerful tools also introduce significant risks related to data security and governance. Companies that aren’t actively figuring out how to govern the GenAI they’ve adopted will inevitably be left vulnerable.

Some explanations about the hidden danger of GitHub features that allow anyone to access commits you thought had been deleted.

Data breaches have increased this year, costing businesses $4.88 million—a 10% increase from 2023 and the highest increase since the pandemic. The cost is due to several factors, but an internet leak is one of the common factors that cost businesses money, causes loss of reputation, and threatens the online privacy of the general public. So, what can you do to help yourself, friends, family, employees, or businesses to limit the costs of a data breach or internet leak?

Stolen credentials are the easiest route into your organization for a hacker. Verizon’s 2023 Data Breach Investigation Report found that threat actors used stolen credentials in 49% of attempts to gain unauthorized access to organizations. The problem IT teams face is knowing when credentials have been stolen or leaked in a breach – otherwise you’re waiting to respond to a security issue rather than handling it proactively.