There was an event recently where a security firm discovered a zero-day vulnerability in Palo Alto Networks’ GlobalProtect VPN. They waited almost a year to disclose the vulnerability to the vendor and exploited this vulnerability in their red-team customers during this time. There were clearly some passionate people arguing both for and against the practice….
Can you feel it? The palpable feeling that we are on the verge of something extremely groundbreaking? Of course you can¹. In your very bones you know it’s almost time for the next edition of Cisco’s Security Outcomes Study. Once again Cyentia has been tasked with throwing some light on the fear, uncertainty, and doubt that plagues our industry. …
Hey, you got multi-party incidents in my extreme events! You got extreme events in my multi-party incidents! Here at Cyentia, we love cooking up analysis of cyber incidents in the service of better risk decisions. We’ve explored multi-party incidents (Ripples Across the Risk Surface) and extreme events (IRIS Xtreme) before. It’s only natural to wonder…
One of the many lessons that COVID-19 has to offer information security practitioners is a fresh appreciation of the importance of supply chains and the pain that occurs when previously taken-for-granted connections are attacked. Last month we released Ripples Across the Risk Surface, our latest report in partnership with RiskRecon. In this report, we explore…
Back in early January (six months ago), I wrote a blog post about the rise of GitHub as a source for published vulnerability exploits. Since then, we’ve launched our Exploit Intelligence Service (EIS), where we aggregate not just GitHub exploits but references to other exploits as well. In this post, I am looking into how…
Nope; that’s not a misspelling. Perhaps we’ll fully solve the persistent problem of human risk in cybersecurity one day, but until then, we’re forced to find ways to salve its effects. And since humans are complicated, that task is also complicated. Which is why I’m pleased to see a company like Elevate Security using a…
If you’ve been in the infosec industry for at least 10 years, you might remember a hubbub in 2010 over someone dubbing security researchers “Narcissistic Vulnerability Pimps” or NVPs. Confession time…that was me. At that time, part of my job was keeping customers informed about developments that altered their cyber risk posture, and I was,…
You’ve probably heard the phrase “Nature vs. Nurture” at some point; it’s one of the oldest topics of debate in psychology circles. In a nutshell, the debate centers on whether who you are is defined by what you’re born with (genes) or by how you’re raised (environment). We can all think of personality quirks we’ve…
Bottom line up front: The Security Outcomes Study – our first collaboration with Cisco – just hit the shelves. We surveyed over 4,800 IT and security professionals to measure the increase in probability of (reported) success along several security program outcomes associated with strong (reported) adherence to various security practices. In other words, what actually…
We recently released our 6th joint research report in the “Prioritization to Prediction” series with Kenna Security. I’d like to walk through one chart from that report with you in this short blog post and share my perspective on why I think this is one of the most important pieces of research we’ve published yet….