The Cyentia Institute is seeking multiple sponsors to support R&D efforts leading to the publication of a meta-study of MITRE ATT&CK tactics and techniques. Details on this call are provided below. If interested, please reach out to [email protected]. What’s the goal of the study? More and more cybersecurity industry reports include statistics around commonly detected…
We’re thrilled to partner with Arete in this first major installment of new research focused on ransomware trends, and the financial exposure faced by past and future victims: Mitigating Ransomware’s Impact. This portion of the data contains nearly 1,300 completed ransomware engagements, including demands and payments totaling $797.7M and $218.4M, respectively. We explore specifics on…
Our recent report Mitigating Ransomware’s Impact, produced in partnership with Arete, provides a convenient excuse to reflect on ransomware developments in recent years. Old school readers may remember some of our first blog posts (a three-part series, circa July 2017) were about ransomware. In them, Wade and Jay performed some meta-analysis on payment rates, demand…
Years ago when I first started at Cyentia, I was going over some analysis with the great Jay Jacobs and had produced a scatter plot. The points didn’t show a clear trend but Jay suggested “drop a geom_smooth in there and see if there is a trend”. I scoffed. I sneered. “A non-parametric smoothed regression?…
The Exploit Prediction Scoring System (EPSS) is an open, data-driven effort for estimating the likelihood (probability) that software vulnerabilities will be exploited in the wild. We achieve that by collecting ground-truth information about which and how often vulnerabilities are being exploited in the wild and comparing that with attributes of each vulnerability. I’ve been involved…
One of my first tasks as a cybersecurity researcher was analyzing results from surveys TruSecure (later Cybertrust then Verizon) conducted in the aftermath of major internet worm events of the early 2000s. While the focus wasn’t on third-party risk or supply chain risk, those themes became very apparent to me from examining the open-ended “comments”…
New year, new methodologies post. In our last post, we chatted about the best way to present multiple regression results, pulled back the curtain on last years Cisco Security Outcomes Study, and gave a sneak preview of this year’s results. Speaking of this year’s results, download Volume 2 of the Security Outcomes Study here. Honestly,…
As much as it feels like 2021 was just 12 extra months tacked onto 2020, there are some cornerstones that I rely on to remind me that 2021 was in fact its very own distinct year. For starters, the Harry Potter and Lord of the Rings film franchises both turned 20 (2001 was a dreamboat…
There was an event recently where a security firm discovered a zero-day vulnerability in Palo Alto Networks’ GlobalProtect VPN. They waited almost a year to disclose the vulnerability to the vendor and exploited this vulnerability in their red-team customers during this time. There were clearly some passionate people arguing both for and against the practice….
Can you feel it? The palpable feeling that we are on the verge of something extremely groundbreaking? Of course you can¹. In your very bones you know it’s almost time for the next edition of Cisco’s Security Outcomes Study. Once again Cyentia has been tasked with throwing some light on the fear, uncertainty, and doubt that plagues our industry. …