8 security and risk management trends to watch: Gartner

The pandemic is still shaping security architecture and long-term decisions. In response, businesses are creating cyber mesh architectures and consolidating products.

By Samantha Schwartz • Oct. 19, 2021

The public needs to understand what's at stake with cyberattacks, DHS adviser says

The Colonial Pipeline cyberattack was a "crisis of communication" between the company and consumers, Homeland Security Adviser Suzanne Spaulding said.

By Samantha Schwartz • Oct. 15, 2021

Explore the Trendline➔

Risk Management

Now, public companies have to detail their cybersecurity risk management in annual filings, raising awareness on what many cyber experts already knew — security issues are business issues. 

By Cybersecurity Dive staff

How to secure the enterprise against REvil-style attacks

There is no way to fully protect against advanced attacks such as zero-day vulnerabilities or nation-state threats — responding quickly is critical to minimizing damage.

By Chris Silva • Oct. 12, 2021

War room preparation key to ransomware response, experts say

Companies need to assemble stakeholders ahead of an attack and be ready for potential fallout from litigation, reputational risk and operations disruption. 

By David Jones • Oct. 11, 2021

What's under the hood of a medical device? Software bill of materials hits inflection point

President Joe Biden's executive order calls for SBOMs, and the FDA wants to require premarket submissions to have an inventory of third-party device components. AdvaMed is concerned the data could be exploited by hackers.

By Greg Slabodkin • Oct. 11, 2021

Why CEOs become communication chiefs after a cyberattack

When ransomware hit, the CEOs of Colonial Pipeline and Accellion paused their day-to-day duties. Their immediate new roles? Communication.

By Samantha Schwartz • Oct. 7, 2021

Mandiant CEO: 3 threats that changed cybersecurity in 2020

CISOs getting comfortable in a more operational role were met with unprecedented cyberattacks — implants, zero days and ransomware — within the last year and a half.

By Samantha Schwartz • Oct. 6, 2021

Insider threat environment faces challenges amid changing corporate landscape

As remote work becomes permanent and employee turnover rises, companies face additional challenges in protecting sensitive data, according to a panel discussion at Mandiant Cyber Defense Summit.

By David Jones • Oct. 6, 2021

NIST urges supply chain to include cyber in risk management

Industries that rely heavily on technology are the best at incorporating cyber in their supply chain risk management plans, according to NIST's Jon Boyens.

By Samantha Schwartz • Oct. 5, 2021

Healthcare workers concerned with cybersecurity amid burnout and pandemic woes

Nearly three-quarters of healthcare professionals are concerned that patient health information is being sent through unsecured tools, according to a new survey from hospital communications firm Spok.

By Shannon Muchmore • Oct. 1, 2021

Digitization costs manufacturing plants 'the luxury of isolation,' changing risk management

OT organizations transition from site-level best practices to overall best practices, and move plant operations into an enterprise SOC.

By Samantha Schwartz • Oct. 1, 2021

With remote work, any employee could be an insider threat. How is CISA mitigating the risk?

CISA released a self-assessment tool which organizations can use to generate reports on their tolerance and capabilities for preventing insider threats. 

By Samantha Schwartz • Sept. 30, 2021

Remote work had little effect on employees' password habits: report

Employees are still reusing credentials, as vendors explore a passwordless future, according to a report from LastPass' Psychology of Passwords.

By Samantha Schwartz • Sept. 24, 2021

Enterprises plan major investments as remote work escalates security risk: report

Companies face significant challenges in managing security as the work-from-home model moves from an emergency stopgap to a more permanent environment. 

By David Jones • Sept. 22, 2021

Is there too much transparency in cybersecurity?

Between information sharing, software accountability, or incident response and disclosures, companies have to find the disclosure sweet spot.

By Samantha Schwartz • Sept. 21, 2021

What to know about software bill of materials

The Biden administration wants more transparency in the software supply chain. Will private industry join in?

By Samantha Schwartz • Sept. 20, 2021

Companies must develop operational plan for ransomware recovery

In the face of more frequent and sophisticated attacks, companies need to identify their most critical assets and work to limit cyberattack fallout.

By David Jones • Sept. 17, 2021

Companies confident in cybersecurity despite growing threats: report

There's a perception of "safety in numbers," Beazley's survey found. "Time will tell if such high levels of confidence are well placed."

By Samantha Schwartz • Sept. 16, 2021

Boards rethink incident response playbook as ransomware surges

Corporate boards are no longer rubber-stamping assurances from CIOs or CISOs but are bringing in outside experts, asking more questions and preparing for the risk of personal liability.

By David Jones • Sept. 15, 2021

How companies can defend against credential theft

Unique passwords are the best defense against credential stuffing. But users, unless forced to act differently, will stick with what makes access easy.

By Sue Poremba • Sept. 14, 2021

InfoSec teams under pressure to compromise security for productivity: report

Younger workers are fueling a backlash against corporate security policies designed to protect companies from malicious attacks, a study from HP Wolf Security shows.

By David Jones • Sept. 9, 2021

What ransomware negotiations look like

Fear can overwhelm the decision of whether to pay a ransom. But in negotiations, companies have to take a backseat.

By Samantha Schwartz • Sept. 9, 2021

Are you ready for the second wave of digital transformation?

In the second wave of digital transformation, understanding Insider Risk is more important than ever.  

Sept. 7, 2021

Behind the Firewall: What to do if your vendor has a security incident

A vendor with a checkered past with security incidents is not automatically disqualified from future contracts. Rather, there is a playbook for due diligence.

By Naomi Eide , Samantha Schwartz • Sept. 3, 2021

IT-OT crossover relitigates who is responsible for ICS security

If companies can effectively combine their IT and OT SOCs, they could be better equipped to uncover a fuller view of the kill chain.

By Samantha Schwartz • Sept. 2, 2021