Our team just returned from SiRAcon ’23 where the conference theme was “Measuring Extremes.” If you’re unfamiliar with SiRAcon, it’s an annual event organized by the Society of Information Risk Analysts, featuring speakers and networking opportunities for information risk enthusiasts of all stripes. One of the sessions we led focused on Tail Value at Risk…
We at Cyentia Institute had the opportunity to analyze data from millions of attack path assessments conducted by XM Cyber over the last year. I’d like to share a chart from the report we published from that analysis because it touches on a theme I love exploring in cybersecurity management: prioritizing remediation. Choke Points: From…
“You know when you make a copy of a copy, it’s not as sharp as the original.” – Doug Kinney (Michael Keaton), Multiplicity Cyentia recently released our second report in collaboration with SecurityScorecard titled “Close Encounters of the Third (and Fourth) Party Kind.” Yeah, yeah – I know that’s an obvious tee-up for a quote…
While working on volume 2 of the Investigative Cybercrime Series, Reining In Ransomware, we were curious about the functionality of the most common ransomware strains. The thinking went like this: if we can identify what they do, then we can use the frequency info from actual cases to weight those actions and find key protections…
The Cyentia Institute is seeking multiple sponsors to support R&D efforts leading to the publication of a meta-study of MITRE ATT&CK tactics and techniques. Details on this call are provided below. If interested, please reach out to [email protected]. What’s the goal of the study? More and more cybersecurity industry reports include statistics around commonly detected…
Our recent report Mitigating Ransomware’s Impact, produced in partnership with Arete, provides a convenient excuse to reflect on ransomware developments in recent years. Old school readers may remember some of our first blog posts (a three-part series, circa July 2017) were about ransomware. In them, Wade and Jay performed some meta-analysis on payment rates, demand…
Years ago when I first started at Cyentia, I was going over some analysis with the great Jay Jacobs and had produced a scatter plot. The points didn’t show a clear trend but Jay suggested “drop a geom_smooth in there and see if there is a trend”. I scoffed. I sneered. “A non-parametric smoothed regression?…
The Exploit Prediction Scoring System (EPSS) is an open, data-driven effort for estimating the likelihood (probability) that software vulnerabilities will be exploited in the wild. We achieve that by collecting ground-truth information about which and how often vulnerabilities are being exploited in the wild and comparing that with attributes of each vulnerability. I’ve been involved…
One of my first tasks as a cybersecurity researcher was analyzing results from surveys TruSecure (later Cybertrust then Verizon) conducted in the aftermath of major internet worm events of the early 2000s. While the focus wasn’t on third-party risk or supply chain risk, those themes became very apparent to me from examining the open-ended “comments”…
New year, new methodologies post. In our last post, we chatted about the best way to present multiple regression results, pulled back the curtain on last years Cisco Security Outcomes Study, and gave a sneak preview of this year’s results. Speaking of this year’s results, download Volume 2 of the Security Outcomes Study here. Honestly,…