Risk Management: Page

How to create a third-party risk management policy

NIST's Cybersecurity Framework offers some helpful tips for organizations to fortify their third-party risk management strategies. Here's how to implement them.

By Matthew Smith • Feb. 5, 2025

What is threat modeling?

Threat modeling is the systematic process of identifying threats to and vulnerabilities in software applications, and then defining countermeasures to mitigate those threats and vulnerabilities to better protect business processes, networks, systems and data.

By Rahul Awati , Michael Cobb • Jan. 23, 2025

Cryptocurrency scams: Common types and prevention

Cryptocurrency scams are rising, and thieves are using new and old techniques to steal money. Some of the latest scams involve rug pull scams, Ponzi schemes and phishing scams.

By Amanda Hetler • Dec. 17, 2024

What are Common Criteria (CC) for Information Technology Security Evaluation?

Common Criteria (CC) is an international standard (ISO/IEC 15408) for evaluating information technology security products.

By Katie Terrell Hanna • Dec. 5, 2024

How to protect against malware as a service

Malware operators are further monetizing their malicious software by selling it to other attackers on a subscription basis. Learn how to detect and mitigate the threat.

By Ashwin Krishnan • Dec. 4, 2024

How to build an effective third-party risk assessment framework

Don't overlook the threats associated with connecting vendors and partners to internal systems. Do your due diligence and use third-party risk assessments to prevent supply chain attacks.

By Amy DeCarlo • Nov. 27, 2024

How AI is reshaping threat intelligence

As promising as AI technology is for threat intelligence, organizations grapple with a long learning curve and other challenges that could impede successful adoption.

By Amy DeCarlo , Sharon Shea • Nov. 27, 2024

How to define cyber-risk appetite as a security leader

In this excerpt from 'The CISO Evolution: Business Knowledge for Cybersecurity Executives,' learn how to define and communicate an enterprise's true cyber-risk appetite.

By Wiley Publishing, Alissa Irei • Oct. 16, 2024

5 online payment security best practices for enterprises

Ensuring the security of your company's online payment systems is key to preventing costly attacks, meeting compliance requirements and maintaining customer trust.

By Amanda Scheldt • Sept. 26, 2024

Top vulnerability management challenges for organizations

Organizations understand vulnerability management is essential to identifying cyber-risks, but coordinating teams, tools and handling CVEs keeps the pressure on.

By Jon Oltsik • Sept. 18, 2024

6 steps toward proactive attack surface management

With organizations' attack surfaces growing, new research shows better asset management, tighter access policies like zero trust and consistent configuration standards can help.

By Jon Oltsik • Sept. 11, 2024

Cyber-risk quantification challenges and tools that can help

While cybersecurity risk should inform budget and strategy decisions, quantifying risk and the ROI of mitigation efforts isn't easy. Cyber-risk quantification tools can help.

By John Burke • Sept. 10, 2024

Cyber-risk management remains challenging

Strong cyber-risk management demands collaboration and coordination across business management, IT operations, security and software development in an ever-changing environment.

By Jon Oltsik • Sept. 9, 2024

How to use the NIST CSF and AI RMF to address AI risks

Companies are increasingly focused on how they can use AI but are also worried about their exposure to AI-fueled cybersecurity risks. Two NIST frameworks can help.

By Matthew Smith • Aug. 26, 2024

5 open source Mitre ATT&CK tools

Security teams that use the Mitre ATT&CK framework should consider using these open source tools to help map attacker techniques to the knowledge base.

By Ashwin Krishnan • Aug. 26, 2024

Cyber-risk management: Key takeaways from Black Hat 2024

Product updates announced at Black Hat USA 2024 can help security teams better manage constantly changing attack surfaces and ensure new AI projects won't pose security risks.

By David Vance • Aug. 16, 2024

Evolving threat landscape influencing cyber insurance market

Many aspects of cyber insurance were addressed throughout Black Hat USA 2024, including changes in the threat landscape that affect policies and coverage.

By Arielle Waldman • Aug. 9, 2024

Security framework to determine whether defenders are winning

Columbia University researcher and longtime security practitioner Jason Healey will present at Black Hat USA a new framework to determine defensive advantage.

By Alexander Culafi • Aug. 6, 2024

How blockchain can support third-party risk management

Third-party risk is of significant and growing concern to today's businesses. Explore how blockchain technology could transform third-party risk management for the better.

By Jonathan Prewitt, Jeremy A. Sheridan • Aug. 2, 2024

What is GDPR? Compliance and conditions explained

The General Data Protection Regulation (GDPR) is legislation that updated and unified data privacy laws across the European Union (EU).

By Scott Robinson, Rich Castagna, Tréa Lavery • July 29, 2024

5 key capabilities for effective cyber-risk management

Faced with relentless cyberattacks, organizations need to shore up their cyber-risk management programs by updating legacy tools and checking out new vendor options.

By David Vance • July 29, 2024

How the Change Healthcare attack may affect cyber insurance

UnitedHealth's Change Healthcare attack continued to show the devastating aftermath of supply chain attacks. Experts say it could change contingent language for future policies.

By Arielle Waldman • July 29, 2024

AT&T data breach: What’s next for affected customers?

Another breach has affected millions of people -- this time it is AT&T customers. Learn more about this AT&T breach and what to do if you were part of this attack.

By Amanda Hetler • July 24, 2024

How to implement an attack surface management program

Keeping attackers away from corporate assets means keeping constant vigilance over the organization's attack surface. An attack surface management program can help.

By Michael Cobb • July 24, 2024

What is exposure management?

Exposure management is a cybersecurity approach to protecting exploitable IT assets.

By Kyle Johnson • July 22, 2024