FIPS 140-3 is the long-awaited update to FIPS 104-2 which was established on May 25, 2001. This updated validation process is finally capable of addressing the cryptographic modules that have evolved since 2001. This validation process includes testing with respect to certain standards or protocols and then the issuing of an official certificate from NIST (National Institute of Standards and Technology) confirming compliance with FIPS 140-3.

Inherent risks are the cyber risks and vulnerabilities within an organization before security measures are implemented. In contrast, residual risk is calculated after cybersecurity protections have been put in place to protect against all of these inherent risks; its calculation includes every possible attack vector that could affect a system or data.

The Solarwinds supply chain attack has made the danger of third-party breaches very clear. Businesses globally are realizing that their vendors may not be as secure as they originally thought. The concerning truth about vendor relationships is that you can never be confident of a prospective vendor's cybersecurity. In fact, onboarding new third-party vendors increase your digital risk and the likelihood of becoming victim to a third-party breach.

Threat modelling is a process for identifying potential threats to an organization's network security and all the vulnerabilities that could be exploited by those threats. Most security protocols are reactive - threats are isolated and patched after they've been injected into a system. Threat modelling, on the other hand, is a proactive approach to cybersecurity, whereby potential threats are identified and anticipated.

The rising trend in data breaches continues to angle upwards, and as a result, there has never been a more precarious time in history to launch and maintain a successful business. To prevent the repetition of mistakes that result in data theft, we’ve compiled a list of the 56 biggest data breaches in history, including recent data breaches in 2021. Click on the table of contents dropdown above for a list of all the companies in this post.

Social Engineering, in the context of cybersecurity, is the use of deception to convince individuals into relinquishing their personal information online. This information is then exploited in cyberattacks. Most social engineering campaigns target employees because they could be manipulated into gateways to an organization’s sensitive data. The success of these campaigns relies on a lack of cybersecurity awareness training in the workplace.

The mastermind that orchestrated the SolarWinds attack may finally have a name. On Thursday, April 15th, the White House officially announced that the Russian Foreign Intelligence Service (SVR) - also known as APT 29, Cozy Bear, and The Dukes - was responsible for the campaign that exploited the SolarWinds Orion platform. But the attacks are not over yet. A joint advisory from the U.S.

Though digital transformation is necessary, it's accompanied by some serious risks. This is the scaling conundrum of 2021 - organizations must embrace digitization to remain relevant, however, the greater the digital transformation, the greater the associated digital risks. Thankfully, with the correct digital risk management, organizations can continue to safely embrace digital transformation while mitigating the byproduct of digital risks.

The personal information of over 500 million Facebook users has been published on a hacker forum on the dark web. To put the impact into perspective, in 2019, the population of the entire United States was 328.2 million. This data was stolen in 2019 after a vulnerability in Facebook’s ‘Add Friend” function was exploited.