New year, new methodologies post. In our last post, we chatted about the best way to present multiple regression results, pulled back the curtain on last years Cisco Security Outcomes Study, and gave a sneak preview of this year’s results. Speaking of this year’s results, download Volume 2 of the Security Outcomes Study here. Honestly,…
As much as it feels like 2021 was just 12 extra months tacked onto 2020, there are some cornerstones that I rely on to remind me that 2021 was in fact its very own distinct year. For starters, the Harry Potter and Lord of the Rings film franchises both turned 20 (2001 was a dreamboat…
There was an event recently where a security firm discovered a zero-day vulnerability in Palo Alto Networks’ GlobalProtect VPN. They waited almost a year to disclose the vulnerability to the vendor and exploited this vulnerability in their red-team customers during this time. There were clearly some passionate people arguing both for and against the practice….
Can you feel it? The palpable feeling that we are on the verge of something extremely groundbreaking? Of course you can¹. In your very bones you know it’s almost time for the next edition of Cisco’s Security Outcomes Study. Once again Cyentia has been tasked with throwing some light on the fear, uncertainty, and doubt that plagues our industry. …
Hey, you got multi-party incidents in my extreme events! You got extreme events in my multi-party incidents! Here at Cyentia, we love cooking up analysis of cyber incidents in the service of better risk decisions. We’ve explored multi-party incidents (Ripples Across the Risk Surface) and extreme events (IRIS Xtreme) before. It’s only natural to wonder…
One of the many lessons that COVID-19 has to offer information security practitioners is a fresh appreciation of the importance of supply chains and the pain that occurs when previously taken-for-granted connections are attacked. Last month we released Ripples Across the Risk Surface, our latest report in partnership with RiskRecon. In this report, we explore…
Back in early January (six months ago), I wrote a blog post about the rise of GitHub as a source for published vulnerability exploits. Since then, we’ve launched our Exploit Intelligence Service (EIS), where we aggregate not just GitHub exploits but references to other exploits as well. In this post, I am looking into how…
Nope; that’s not a misspelling. Perhaps we’ll fully solve the persistent problem of human risk in cybersecurity one day, but until then, we’re forced to find ways to salve its effects. And since humans are complicated, that task is also complicated. Which is why I’m pleased to see a company like Elevate Security using a…
If you’ve been in the infosec industry for at least 10 years, you might remember a hubbub in 2010 over someone dubbing security researchers “Narcissistic Vulnerability Pimps” or NVPs. Confession time…that was me. At that time, part of my job was keeping customers informed about developments that altered their cyber risk posture, and I was,…
You’ve probably heard the phrase “Nature vs. Nurture” at some point; it’s one of the oldest topics of debate in psychology circles. In a nutshell, the debate centers on whether who you are is defined by what you’re born with (genes) or by how you’re raised (environment). We can all think of personality quirks we’ve…