The Biden administration unveiled a package of supply chain and critical infrastructure security initiatives following a meeting at the White House with tech executives and others. Companies such as Google and Microsoft also promised billions in spending on cybersecurity over the next several years.
As a technology and security leader, Laura-Lea Berna is driven to defend gaps. But as a business executive, the VP, IT and CIO of BC Transit has built her career on answering the question "Where's the need?" She discusses her path and role as a mentor to up-and-coming leaders.
The Biden administration is hosting a White House meeting Wednesday with technology, banking, insurance and education executives to focus on cybersecurity and national security issues, such as protecting critical infrastructure from attacks and how to hire more security professionals to meet demand.
Third party risk management process should be part of your overall cybersecurity program. Having the right processes in place will help you identify risk in your third parties and put a remediation plan in place to prevent security incidents before they happen. But implementing a vendor security program is often...
The latest edition of the ISMG Security Report features an analysis of how ransomware attackers share about their inclinations, motivations and tactics. Also featured: The rise of integrity attacks; dispelling vaccine myths.
The U.S. Cybersecurity and Infrastructure Security Agency is creating the Joint Cyber Defense Collaborative to build a national cybersecurity defense strategy based on collaboration between the public and private sectors, CISA Director Jen Easterly said at the Black Hat 2021 conference Thursday.
Managing digital risk and building resilience within your organization requires a comprehensive approach that doesn’t stop where your business ends. One also needs to assess and manage risk related to vendors and other third parties, because any threat to those operations can also impact your business.
The rise in breaches over the past few years & especially during the ongoing pandemic has made it clear that many organizations are overwhelmed and struggling to manage risk. Manual assessments and siloed tools can’t keep up with today’s relentlessly changing risk landscape. Continuous monitoring is the key to...
Evaluating MSSPs? Expel has accumulated a list of questions to ask during the evaluation process.
Here are 12 best questions you should consider asking any potential provider to help you determine which provider is the right fit for your organization.
The Russian-linked group that targeted SolarWinds using a supply chain attack compromised at least one email account at 27 U.S. attorneys' offices in 15 states and Washington, D.C., throughout 2020, according to an update posted by the Justice Department.
Not much time has passed since the last supply chain cyber attacks: SolarWinds, Accellion, Codecov, and now Kaseya. Do you think this will be the last one? We don’t. While you’re probably wondering what can be done to predict or prevent an incident like this in the future, we think the better question is: what can...
In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including the challenges ahead for the new director of the U.S. Cybersecurity and Infrastructure Security Agency and vendor security risk management in the healthcare sector.
This edition of the ISMG Security Report features an analysis of comments from the former head of Britain's GCHQ intelligence agency, Robert Hannigan, on the changing nature of ransomware attacks. Also featured: Disrupting the ransomware-as-a-service business model; supply chain security management tips.
Attackers have been exploiting a zero-day flaw in SolarWinds' Serv-U Managed File Transfer Server and Serv-U Secured FTP software, the security software vendor warns. The company has released patched versions that mitigate the flaw, discovered by Microsoft, and is urging users to update.
Investment banking giant Morgan Stanley is the latest company to report a data breach tied to zero-day attacks on Accellion's legacy File Transfer Appliance - yet another indicator of the sustained impact of supply chain attacks.