When organizations hear “third-party risk management,” they often consider the processes needed to mitigate risks when working with a third-party vendor. These can include procurement risks and risks associated with starting new vendor relationships, often referred to as "onboarding,”—but what about when a working relationship ends?

Cisco has released a Product Security Incident Response Team (PSIRT) advisory regarding a zero-day vulnerability in the web UI feature of Cisco IOS XE software. Cisco has stated that the web-based user interface should never be accessible through the public internet, yet research indicates that more than 10,000 Cisco devices have been exploited by an unknown threat actor. This critical vulnerability is being tracked as CVE-2023-20198 and is currently undergoing investigation for active exploitation.

The Sender Policy Framework (SPF) is an email authentication protocol that specifies email authorization through Domain Name System (DNS) records. When an email is sent through the Simple Mail Transfer Protocol (SMTP), there is no requirement for authorized messages, which means that spammers can forge your domain in their phishing attacks.

Cybersecurity is becoming a growing priority for organizations, as daily news headlines feature large-scale data breaches due to unauthorized access and ransomware attacks dismantling systems across the globe. The last thing an organization wants is to become the next headline because its poor cybersecurity posture left it vulnerable to hackers. Cybersecurity audits meticulously analyze and report on an organization’s security program, helping them identify weak points that need addressing.

Today’s rapidly evolving digital world requires organizations to build a robust cybersecurity plan to safeguard internal infrastructures and oversee third-party vendors' cyber health. The Essential 8 is a cybersecurity framework developed by the Australian Signals Directorate designed to help organizations protect themselves against different cyber risks.

In the past, passwords alone were considered an effective security measure for protecting user accounts and deterring cybercriminals. Motivated by the increased threat of data breaches and other cyber attacks, the cybersecurity industry has since evolved from relying on passwords to favoring more robust authentication methods, such as multi-factor or two-factor authentication (2FA).

A vendor risk report provides stakeholders with a snapshot of your Vendor Risk Management (VRM) performance. With concerns over the threat of supply chain attacks growing, cybersecurity reporting is evolving towards an increased focus on Vendor Risk Management program performance. Board members and senior management want to know how effectively your VRM initiatives are identifying and addressing vendor-related security risks.

A cybersecurity report shouldn’t be feared. Instead, it should be regarded as an opportunity to demonstrate the effectiveness of your cybersecurity program, and while management is brimming with delight over your efforts, maybe also a chance to sneak in a request for that cyber budget increase.

Organizations utilize hundreds, sometimes thousands, of vendors to handle their day-to-day production, workflow, and business processes. With this many vendors, it’s easy for details to fall through the cracks and miscommunication to occur. Organizations often turn to vendor management systems to help manage multiple vendor relationships throughout a vendor lifecycle.