Breach Management articles

If HTTPS provides true end-to-end encryption, how do web firewalls crack into your network traffic to do their filtering?

And if a legitimate firewall can do this when you want, what stops random cybercriminals somewhere further down the line from doing it when you don’t?

Vulnerability management is an essential element of every cybersecurity plan. It involves the ongoing monitoring of a company’s digital footprint to find and fix any vulnerabilities in devices, systems, and applications that bad actors could exploit. It decreases a company’s risk exposure and is a proactive way of ensuring threat actors can’t gain access to a company’s private data. It’s also a huge undertaking. Many applications, including those that are cloud-based, that companies use need to be checked and patched […]

Employees are a major attack vector for threat actors targeting organizations. Recent research by Stanford University confirms this, revealing that 88% of all data breaches are caused by human error. These human errors might be as simple as sending an email to an incorrect address or leaving a database publicly viewable; but they can also be more involved, as when employees become victims of targeted phishing campaigns. Let’s detail how employees might be increasing risk for organizations and what organizations […]

Just how much security does a VPN give you?

What could go wrong with the security you think you’re enjoying, and what potential problems do you need to be aware of?

Do you back yourself to spot the scams that drop into your email inbox?

Could you teach your friends, family and colleagues to do the same?

You’ll hear an array of different shorthand jargon terms including ‘BEC’, ‘CFO fraud’ and ‘spearphishing’ used to refer to cyberscams that trick you into paying invoices, perhaps even substantial ones, to the wrong person. We take a look at how the crooks go about scamming both purchasers and suppliers, and what you can do to protect yourself and your business. Few of us get paid in cash anymore, with the flipside that few of us pay for things in cash, […]

Cybersecurity requires ongoing focus, dedication, and a willingness to revise our behaviours regularly, based on good science rather than merely on popular anecdotes. Don’t copy everything that everyone else is doing in the hope that some of it will work for you, because there are plenty of security “precautions” out there that simply don’t provide the protection they promise. Cybersecurity is hard. Not because the crooks are smarter than us (often they are not), and not because all software is […]

The Defense Industrial Base (DIB) is frequently targeted in complex cyberattacks, with the Pentagon estimating that it stops 36 million emails containing ransomware and phishing attacks daily. That means any person or business conducting business with the Department of Defense (DoD), needs to have the appropriate security controls in place to ensure sensitive information doesn’t get into the hands of a national adversary. To address this concern, the Cybersecurity Maturity Model Certification (CMMC) was created. This is a set of […]

Credential stuffing is all over the news at the moment. We explain what it is and look into why it is causing a rift between service providers and users, and we ask the all-important question, “Who should bear the cost? Cybersecurity is awash with jargon, and some of it is troublesome because it is ambiguous, or poorly-chosen, or just plain wrong. An excellent example is the phrase password rotation, which is widely used by sysdamins and cybersecurity practitioners who should […]

Effectively building, implementing, and operationalizing a cybersecurity strategy is no small feat, and often requires significant employee power and resources — resources that many businesses don’t have. The skills needed to develop and implement a security strategy are incredibly technical, and the security labor shortage has meant most talent is scooped up by large enterprises. That leaves many businesses with few options, including outsourcing security to a third party, delegating security tasks to IT, or skipping cybersecurity efforts altogether. While […]

So many breaches! Such dramatic graphs! So much malware! Such huge numbers! Do cybersecurity ‘Number Games’ force us to confront the scale of contemporary cybercriminality, or merely lure us into shrugging off our own cybercrime experiences as inconsequential and unimportant? No one quite knows where the famous saying ‘A picture is worth 1000 words’ comes from, or who first worked out that the multiplier was exactly 1000, and not, say, 874, or 1024. Indeed, many different languages share this equation, […]

As the tech landscape becomes increasingly vast yet more interconnected and bad actors utilize more advanced techniques, the process of building a security strategy and implementing that strategy is becoming ever more complex. Although new point solutions and service offerings are emerging to address some of those complexities, it doesn’t do much to help businesses that don’t have the expertise, time, or budget to operationalize a whole security tech stack. This speaks to the larger problem of operationalizing cybersecurity. As […]

Malware writeups used to tell you everything there was to know about each new threat. Cybersecurity support staff insisted on knowing the gory details so they could plan their responses. But life’s not like that today, and it’s not because threat researchers aren’t as smart or as diligent as they used to be! Portmanteau words, as Humpty Dumpty famously explained to Alice in “Through the Looking Glass” way back in the 1870s, started out as a bit of linguistic fun, […]

The year 2023 hasn’t been kind in terms of data breaches. By October, the number of data compromises was already up by 17% (2,116 compromises) compared to the entirety of 2022. An Apple-commissioned study carried out by MIT professor Dr. Stuart Madnick labels the current state of data breach prevalence as an “epidemic.”  The Identity Theft Resource Center (ITRC) attributes the 2023 increase to the combined increase of zero-day vulnerabilities, ransomware attacks, and supply chain attacks. Each of these elements […]

As the threat landscape continues to grow and shift and cyberattacks continue to rise, many companies are looking for new ways to defend themselves against bad actors, nation-states, and competitors trying to hack their systems and steal intellectual property. One major threat organizations may not be on top of is the one that lurks within their company — insider threats. It’s estimated that 60% of data breaches are caused by insider threats, and a study by the Ponemon Institute found […]