Governance is the Center of the Universe

We all know by now that granting access to our sensitive applications introduces all sorts of “what-ifs” in an organization. What if my accounts payable admin, disgruntled and upset, decides to abuse her access to my payment system to funnel funds outside of the company? Or what if she decides to plug in her USB…

Third and Fourth Party Risk Management: Access-as-a-Risk

By now, we all know that vendor engagement is key to business sustainability. Organizations cannot focus on their core business without outsourcing non-critical functions to third parties. From a 20,000 foot view, third party management becomes an operational activity governed through contracts, engagement analyses and effective risk management. Where organizations fall short is in implementing…

CVSS Scoring: Why your Smart Refrigerator does not need to be Patched (Yesterday)

Is a CVSS score of 10, really a 10 in your environment? Vulnerability Risk Management is a work in progress for most organizations. Having dealt with many customers in this space, we have seen it all – the mature folks who utilize asset management to define ownership to multiple remediation teams – all the way…

Stop Them in their Tracks: A Cyber Kill Chain Approach

I first heard this concept at a cyber risk conference in New York…  A hacker entity has 1 shot to infiltrate your network, but you have 7 opportunities to stop them. Those seven opportunities refer to the Cyber Kill Chain. Patented by Lockheed Martin, the Cyber Kill Chain® is an intelligence-driven computer network defense framework…