Security News

Wing Security recently announced that basic third-party risk assessment is now available as a free product. But it raises the questions of how SaaS is connected to third-party risk management...

There has been a significant decrease in vulnerabilities found in target applications - from 97% in 2020 to 83% in 2022 - an encouraging sign that code reviews, automated testing and continuous integration are helping to reduce common programming errors, according to Synopsys. The report details three years of data derived from tests run by Synopsys Security Testing Services, with targets made up of web applications, mobile applications, network systems and source code.

In the complex and fast-moving world of cybersecurity-meets-regulations, working with third parties requires diligent third-party risk management oversight to monitor data management and processes. Improving InfoSec risk management can provide insights into how data is handled, the security safeguards in place to protect that data, potential security weaknesses, and better adherence to the multitude of data, security, and privacy regulations.

Although more than 72% of companies indicate they have an Insider Risk Management program in place, the same companies experienced a year-over-year increase in data loss incidents of 32%, and 71% expect data loss from insider events to increase in the next 12 months. With insider incidents costing organizations $16M per incident on average, and CISOs stating that insider risks are the most challenging type of threat to detect, the report is a clear call to action for the security industry to 'do better' and help professionals solve this challenge.

TechRepublic Premium Offshore work policy It's common practice for companies to use offshore employees or contractors in order to offload work to specialized individuals or reduce costs associated with certain tasks and responsibilities. This can free up staff to focus on more complex and valuable initiatives, and also ensure 24×7 operations for companies which rely upon on-call staff and subject-matter .....

The reasons for the lack of investment into Third Party Risk Management are the same that we consistently hear - lack of time, lack of money and resources, and it's a business need to work with the vendor. Step 3 - Continuously combine threat exposure findings with the questionnaire exchange #. Security ratings alone don't work.

The number one thing enterprises need to do is get back to basics and focus on what builds the foundation to robust asset risk management - and that is visibility and understanding of risk. Asset risk management is paramount to an effective zero trust architecture.

Coalfire released its fourth annual Securealities Penetration Risk Report which analyzes enterprise and cloud service providers internal and external attack vectors, application development and mobile app security, social engineering and phishing, and PCI- and FedRAMP-specific findings, with data segmented by industry and company size. Long-term data shows that cyber risk significantly shifts year over year based on company size, vertical market, and many other factors.

As attackers rely on a range of automated offensive testing tools to scan their targets' attack surfaces and propagate inside their network, a purely reactive defensive stance based on detection and response is increasingly likely to be overwhelmed by an attack. The logical tactical move is to emulate attackers' TTPs and behaviors beforehand by integrating attack simulation tools to continuously validate the impermeability of the attack surface as a whole, the efficacy of security controls, as well as access management and segmentation policies, etc.

The number of organizations that will be either unable to afford cyber insurance, be declined cover, or experience significant coverage limitations is set to double in 2023, according to Huntsman Security. This Help Net Security video uncovers why so many organizations are losing cyber insurance as an important risk management tool.