Faraday presents the latest version of their Security Platform for Vulnerability Management Automation

Miami, February 19, 2020 - Faraday is opening 2020 by strengthening their releases using the featured cybersecurity worldwide events calendar, starting next week with BSides and RSAC in San Francisco. As a Blackhat Global Partner, the company will also participate as a sponsor in all BH’s global...

Zero Trust strategy—what good looks like

Zero Trust has managed to both inspire and confuse the cybersecurity industry at the same time. A significant reason for the confusion is that Zero Trust isn’t a specific technology, but a security strategy and arguably the first formal strategy, as I recently heard Dr. Chase Cunningham, Principa...

What Is the DoD’s New Cybersecurity Maturity Model Certification, and What Does It Mean for Defense Contractors?

Citing the threat of compromise of Controlled Unclassified Information CUI within the defense industrial base DIB, along with the high cost of cyber breaches in general, the Office of the Assistant Secretary of Defense for Acquisition has initiated a program for rating the cybersecurity maturity ...

ACSC Releases Updated Essential Eight Maturity Model

The Australian Cyber Security Centre ACSC has released updates to its Essential Eight Maturity Model. The model assists organizations in determining the maturity of their implementation of the Essential Eight—ACSC’s list of the top mitigation strategies to help organizations protect their systems...

Keys to Mature to a Level 4 Threat Hunting Program

Three Commonalities Among Level 4 Threat Hunting Programs Threat hunting programs that have reached level 4 maturity have three commonalities: The have implemented automation wherever possible to scale their effectiveness They have developed threat hunting processes to operationalize how they...

What the Marriott Breach Says About Security

We don't yet know the root causes that forced Marriott this week to disclose a four-year-long breach involving the personal and financial information of 500 million guests of its Starwood hotel properties. But anytime we see such a colossal intrusion go undetected for so long, the ultimate cause ...

Distributing Malware By Becoming an Admin on an Open-Source Project

The module "event-stream" was infected with malware by an anonymous someone who became an admin on the project. Cory Doctorow points out that this is a clever new attack vector: Many open source projects attain a level of "maturity" where no one really needs any new features and there aren't a lo...

How The ATT&CK™ Framework Can Mature Your Threat Hunting Program

The truth about threat hunting is that it’s a process that matures with your security team. The more you learn more about the threat landscape, the more you can operationalize that knowledge. Because of this, it is important to work within a framework that can help you track the growth of your...

Join Microsoft for a security in a day workshop

Let's talk about an integrated security experience. Many of our customers are in various stages of cybersecurity maturity: Initializing Firefighting No formal security program Developing Point solutions/tools for basic controls Pockets of expertise Defining Aligned to frameworks Documented contro...

Illuminating the Path to Digital Maturity

Research By Akamai and Forrester Sheds New Light on Digital Experience Challenges and Opportunities Nearly every business today is striving to create and deliver digital experiences that stand apart. But it's no small task turning those visions into reality. Moreover, there's little room for erro...

Illuminating the Path to Digital Maturity

Research By Akamai and Forrester Sheds New Light on Digital Experience Challenges and Opportunities Nearly every business today is striving to create and deliver digital experiences that stand apart. But it's no small task turning those visions into reality. Moreover,...

The Third Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

The Wrong Way to Pick a Security Vendor

For a number of years, we've worked with and supported our Managed Service Provider MSP partners at Trend Micro and I've seen and heard a lot in that time. Over time, we’ve noticed a few trends when it comes to MSPs choosing a security vendor to partner with, and in an effort to save you some...

Further Advances the State of Cyber Threat Information Sharing into Cyber Threat Management and Response

Healthcare organizations HCOs are not immune to large-scale cyberattacks, as evident by the most recent attacks WannaCry and Petya. In fact, HCOs are an attractive target for hackers because of the immense amount of personally identifiable information housed in their systems. The industry is wide...

Using CIS Controls To Stop Your Network From Falling in With the Wrong Crowd

Earlier this month Kyle Flaherty wrote a post on the Rapid7 Community Blog about how Rapid7 came out on top for coverage of the Center for Internet Security CIS Top 20 Security Controls. In light of recent DDoS events Id like to take a little time to discuss at a high level what the controls are,...

Gary McGraw on BSIMM7 and Secure Software Development

Mike Mimoso talks to Cigital CTO and software security pioneer Gary McGraw about the latest results pulled from the Building Security In Maturity Model BSIMM. The framework measures the secure development activities of some of the world’s largest software companies and enterprises and can be used...

Kaspersky Lab Bug Bounty Program Launches

LAS VEGAS – Kaspersky Lab today at Black Hat USA 2016 announced the launch of a public bug bounty, one of the few offered by a software vendor in the computer security industry. The bounty begins tomorrow on the HackerOne platform, and the first phase will run for six months. The company said tha...

Gary McGraw on Software Security and BSIMM6

Mike Mimoso talks to Cigital’s Gary McGraw about software security and analysis from the sixth version of the Building Security in Maturity Model report. Download: garymcgraw102715.mp3 Music by Chris Gonsalves...

Gary McGraw on the BSIMM4 and How to Avoid Being the Slowest Zebra

Dennis Fisher talks with Gary McGraw of Cigital about the release of the BSIMM4 data, how software security programs have matured in the last four years and how the government has become distracted by cyberwar and is ignoring software security, to its detriment. Download: digitalunderground105...

White House Launches Electric Industry Security Maturity Model Program

The White House has launched a new initiative designed to help companies in the electric power industry measure the maturity of their security programs against a new maturity model. The program is being run in tandem with the Department of Homeland Security and Department of Energy and is meant t...