Risk Management articles

Enterprises are attractive, high-value targets for hackers; and because enterprises often have more employees and a more complicated environment, protecting against phishing and social engineering attacks is even more difficult. The Dropbox breach of late 2022 is a prime example of this weakness. Hackers emailed a large number of Dropbox employees, directing them to a malicious website where their credentials were stolen. This kind of risk is more common than not. According to the 2023 Verizon Data Breach Report, 74% […]

Business Email Compromise (BEC) is a type of email cybercrime in which attackers impersonate the owner of an email account in an effort to defraud a company. The attack, which is increasing in prevalence, often looks to obtain funds or credentials. Global losses from BEC attacks have increased by 17% from December 2021 to December 2022, reports the FBI’s Internet Crime Complaint Center (IC3). From October 2013 to December 2022, the IC3 recorded over $50 billion in global losses due […]

During my 25 years of working in the security space, I’ve seen many shifts both in the security industry and the world outside of it. The technology that has been developed in the last two decades has drastically affected the way we work and the way we secure our business operations and data. I’ve watched as the industry shifted from securing data on servers to the cloud, and I believe another equally disruptive shift is coming soon. There are many […]

As cyber threats grow more numerous and sophisticated, they’ve placed an excessive burden on IT departments. Managed security services have emerged as a way to better serve a company’s cybersecurity needs and fill key gaps. There are many types of managed security services each with its own benefits and best applications. Let’s look at some of the more common types of managed security services to help you understand which might be the best for your organization. Types of managed security […]

The days of purchasing anti-virus software for your organization and knowing that’s all you need to do to be secure are long gone. Businesses large and small need a full security tech stack that includes a variety of tools and solutions to address a multitude of threats. The cybersecurity market, however, is crowded. With more than 3,500 vendors to choose from, it can be difficult to assess which vendors will best address your security concerns. The issue is further complicated […]

The U.S. Securities and Exchange Commission (SEC) has been busy trying to protect investors from losing funds due to cyberattacks. As the number of cyberattacks continues to rise, the SEC has taken a hard stance: A breach is an inevitability. To help affected parties, companies need to be prepared and communicate when an incident occurs. In March of 2022, the Cyber Incident Reporting for Critical Infrastructures Act of 2022 (CIRCIA) was signed into law. The SEC has since proposed additional updates to […]

As the threat landscape continues to grow and shift and cyberattacks continue to rise, many companies are looking for new ways to defend themselves against bad actors, nation-states, and competitors trying to hack their systems and steal intellectual property. One major threat organizations may not be on top of is the one that lurks within their company — insider threats. It’s estimated that 60% of data breaches are caused by insider threats, and a study by the Ponemon Institute found […]

Worldwide adoption of digital systems has led to the emergence of a very real threat to businesses of all sizes. While these digital solutions empower businesses to conduct their operations more efficiently, a constantly connected state means that business data is always at risk. Company data is often available from the internet, whether stored on the cloud or on-prem, and hackers are constantly trying to access it. With companies using third parties more and more, this data can often be […]

According to a study of 35,000 organizations and 12.6 million individuals by KnowBe4, over 33% of users are susceptible to becoming victims of phishing attacks. These attacks often come via phishing emails carrying malicious attachments in the form of .js files, PDFs, excel sheets containing malicious macros, or script files, each of which allows the attacker to execute malicious code. While email security tools often detect these attachments, many still get through, posing a risk to less-trained employees who aren’t […]

As economic uncertainty continues in Q3 of 2023, many small and mid-sized businesses (SMEs) are struggling to stay afloat. Spending needs to be curbed and executives are faced with tough choices about where to make cuts. For many, trimming the cybersecurity budget is often one of the first steps. After all, what are the chances a bad actor will go after a mom-and-pop shop when they can make far more by attacking a large corporation or major financial institution?  Higher-ups […]

Growing strain on IT departments means organizations need a better solution to manage their cybersecurity needs. IT departments are overworked. A recent survey published in Security Magazine found that 62% of IT Leaders frequently work on holidays or weekends, and almost 50% have needed to work through the night at least once. Many IT leaders also lack the specific cybersecurity knowledge necessary to put the right kind of security in place. They may only invest in preventative options and may […]

The growing sophistication of cybersecurity threats means that investing in top-quality cyber protection is no longer an option but a necessity. However, budget constraints make this virtually impossible for many organizations, especially smaller ones to do in-house. Managed security has emerged as a solution for organizations struggling to optimize their cybersecurity. With a managed security program, organizations can have top-of-the-line security for a fraction of the cost of assembling, integrating, and maintaining an internal program. That said, choosing the right […]

It is the 20th anniversary of CISA’s cybersecurity awareness month and for the beginning of the second decade of this tradition. While this year’s themes are geared towards personal security, there are ways to implement them within an organization for more cyber resilience so there’s still something to learn here. Here are the key themes for the year: These themes are important to be aware of, but on the organizational level, there’s a lot more that can be done to […]

Even the best-managed security programs can fall short if implemented poorly. Correctly executing managed security is just as important as selecting the right vendor. In fact, it is the final step in choosing that vendor for your business. Let’s dive into how to best implement managed security in your business. Importance of a Plan in Managed Security Implementation If you’ve done your homework right, you have a shortlist of vendors who appear to have the necessary expertise, time, resources, and […]