Risk Management: Page

How organizations can learn from cloud security breaches

Research shed light on cloud security breaches. It's time to learn from the past and mitigate these attacks in the future with strong cloud security and posture management.

By Jon Oltsik • Dec. 6, 2023

7 useful hardware pen testing tools

Penetration testers use a variety of hardware to conduct security assessments, including a powerful laptop, Raspberry Pi, Rubber Ducky and more.

By Rob Shapland • Nov. 7, 2023

Collaborate with third parties to ensure enterprise security

Third-party risk is a major threat today, as evidenced in numerous recent breaches. Organizations must work with partners to ensure their data is protected properly.

By Jack Poller • Oct. 31, 2023

CISA, NSA, FBI publish phishing guidance

In its guidance, CISA focused on two primary goals of phishing attacks: obtaining login credentials, often via social engineering, and installing malware on target systems.

By Alexander Culafi • Oct. 19, 2023

speculative risk

Speculative risk is a type of risk the risk-taker takes on voluntarily and will result in some degree of profit or loss.

By Rahul Awati, Ben Cole • Oct. 17, 2023

risk-based authentication (RBA)

Risk-based authentication (RBA) is an authentication method in which varying levels of stringency are applied to a system’s authentication process based on the likelihood that access to that system could result in its compromise.

By Rahul Awati • Oct. 6, 2023

compliance as a service (CaaS)

Compliance as a service (CaaS) is a cloud service that specifies how a managed service provider (MSP) helps an organization meet its regulatory compliance mandates.

By Ben Lutkevich • Oct. 4, 2023

Using the FAIR model to quantify cyber-risk

The Factor Analysis of Information Risk methodology helps organizations frame their cyber-risk exposure as a business issue and quantify it in financial terms. Learn how FAIR works.

By Paul Kirvan , Alissa Irei • Oct. 3, 2023

Bossware explained: Everything employees should know

There isn't a productivity-related metric that bossware doesn't track, so companies need clear goals for employee monitoring to cut through the noise.

By Ben Lutkevich • Sept. 26, 2023

3 phases of the third-party risk management lifecycle

Contractors and other third parties can make systems more vulnerable to cyber attacks. The third-party risk management lifecycle helps ensure outside vendors protect your data.

By Karen Kent • Sept. 26, 2023

total risk

Total risk is an assessment that identifies all the risk factors associated with pursuing a specific course of action.

By Katie Terrell Hanna • Sept. 19, 2023

critical infrastructure

Critical infrastructure is the collection of systems, networks and public works that a government considers essential to its functioning and safety of its citizens.

By Gavin Wright • Aug. 29, 2023

crisis management

Crisis management is the application of strategies designed to help an organization deal with a sudden and significant negative event, while maintaining business continuity.

By Brien Posey, Nick Barney • Aug. 9, 2023

8 vulnerability management tools to consider in 2023

Vulnerability management tools help organizations identify and remediate system and application weaknesses and more. Choose your tool -- or tools -- carefully.

By Karen Kent • Aug. 4, 2023

Intersection of generative AI, cybersecurity and digital trust

The popularity of generative AI has skyrocketed in recent months. Its benefits, however, are being met with cybersecurity, digital trust and legal challenges.

By Goh Ser Yoong • July 28, 2023

Security hygiene and posture management: A work in progress

Security hygiene and posture management may be the bedrock of cybersecurity, but new research shows it is still decentralized and complex in most organizations.

By Jon Oltsik • July 26, 2023

How to avoid LinkedIn phishing attacks in the enterprise

Organizations and users need to be vigilant about spotting LinkedIn phishing attacks by bad actors on the large business social media platform. Learn how to foil the attempts.

By Ashwin Krishnan • July 26, 2023

Cyber insurers adapting to data-centric ransomware threats

Cyber insurance carriers and infosec vendors weigh in on how the shift in ransomware tactics is affecting policies and coverage, presenting challenges for enterprises.

By Arielle Waldman • July 20, 2023

How to map security gaps to the Mitre ATT&CK framework

Mapping security gaps to the Mitre ATT&CK framework enables SOC teams to prioritize, remediate and eliminate vulnerabilities before malicious actors exploit them.

By Packt Publishing, Kyle Johnson • July 10, 2023

Get started: Threat modeling with the Mitre ATT&CK framework

The Mitre ATT&CK framework may seem daunting at first, but it is a key tool that helps SOC teams conduct threat modeling. Learn how to get started.

By Kyle Johnson • July 10, 2023

Enterprise risk management should inform cyber-risk strategies

Cyber-risk doesn't exist in a vacuum. By understanding the broader enterprise risk management landscape, CISOs can make decisions that best serve the business.

By Jerald Murphy • July 7, 2023

network intrusion protection system (NIPS)

A network intrusion protection system (NIPS) is an umbrella term for a combination of hardware and software systems that protect computer networks from unauthorized access and malicious activity.

By Paul Kirvan • July 7, 2023

Cyber-risk quantification benefits and best practices

It's not enough to know cybersecurity threats exist. More importantly, companies must understand cyber-risks in ways stakeholders can measure and discuss.

By Jerald Murphy • June 19, 2023

Risk assessment vs. threat modeling: What’s the difference?

Risk assessments and threat modeling each address potential risks. But they play distinct roles in how they help companies protect systems and data.

By Michael Cobb • June 15, 2023

Benefits of risk-based vulnerability management over legacy VM

Risk-based vulnerability management not only offers a proactive way to identify vulnerable assets, but it also helps prevent alert fatigue and improve patch prioritization.

By Ravi Das • June 12, 2023