In The News

New research from Bitsight indicates the BlueKeep vulnerability could prove more serious than EternalBlue, the vulnerability that was exploited by the WannaCry attacks.

The recently discovered BlueKeep flaw has the potential to be as destructive or even worse than EternalBlue–the basis of the WannaCry ransomware–and it’s critical for organizations to patch any affected systems now to avoid a dire scenario, new research advises. Researchers at Bitsight evaluated the potential effect of the worm-friendly BlueKeep, and said it’s likely only a matter of time before someone exploits the vulnerability for widespread damage.

CEOs and board members are increasingly under the microscope when it comes to managing cyber risk. The financial, legal, and regulatory impact that cyber incidents can have upon organizations have transformed what was once an “IT problem” into a whole of company challenge.

According to the disclosure timeline revealed by vpnMentor, the breach was discovered on May 27 and the Pyramid Hotel Group notified on May 28. The vulnerability was fixed on May 29, so the response was a quick and efficient one. That comes as cold-comfort to Jake Olcott, the vice president of government affairs at Bitsight. Olcott, who has previously served as legal advisor to the Senate Commerce Committee and counsel to the House of Representatives Homeland Security Committee, says that while other sectors such as finance have been focused on measuring and monitoring third-party cyber risk, "the hospitality sector does not face the same regulatory pressures." Incidents such as this need to act as a wake-up call to the entire travel and hospitality sector according to Olcott. "They're going to have to take a closer look at these issues," he warns, "or face reputational and economic damage..."

All sorts of engines that we use, for example services of cyber rating companies, such as Bitsight, which we cross-reference with intelligence. This an advantage we have over many companies, because good intelligence is expensive and difficult. The organization gets service for free or for a nominal payment, and is told what its level of risk is, and how it will change.

Debbie Umbach is the Vice President of Marketing at Bitsight Technologies, the pioneer of and leader in security ratings, where she is responsible for the Company’s global marketing strategy and corporate communications. Founded in 2011, Bitsight built its Security Ratings Platform to continuously analyze vast amounts of external data on security issues and behaviors in order to help organizations manage third party risk, underwrite cyber insurance policies, benchmark performance, conduct M&A due diligence and assess aggregate risk.

Read Bitsight's article, "Auditing and Monitoring Suppliers", in Raconteur's Business Risk Report, published in The Sunday Times on April 28, 2019.

With such a lack of maturity rampant in vendor risk management, it should come as no surprise that only 44% of organizations report on third-party risk to their executives and boards on a regular basis. So says a report by Bitsight, which also found that one in five respondents think boards do not understand their approaches to third-party risk management.

“We still don’t have a clear idea of what cyberwar actually looks like,” said Jake Olcott, vice president at Bitsight, a cyber risk adviser. “That is one of the struggles in this case. No one has said this was an all-out cyberwar by Russia.”

Countless Congressional hearings, 48 state data privacy laws and GDPR and mega breaches like the discovery of data on 500 million Facebook users just keep happening. Why? In this episode of the podcast, Paul is joined by experts from the firm Bitsight and BigID to discuss why we can’t seem to stop the breaches.

A new global study has been conducted by Bitsight and the Centre for Financial Professionals (CeFPro), looking into the financial sector and their views on third-party cyber risks in the industry. The report was officially released early this month.

“Managing third-party cyber risk has rapidly become the No. 1 concern for businesses,” said Jake Olcott, vice president of communications and government affairs, at Bitsight, which produces security ratings. 

Some 97% consider cyber risk to be an important or critical issue, and 78% of those surveyed would refuse a partnership with a company that had poor cybersecurity performance, according to a new survey of 129 financial service professionals by security-rating firms Bitsight and the Center for Financial Professionals.

A Bitsight and Center for Financial Professionals (CeFPro) joint study “Third-Party Cyber Risk for Financial Services: Blind Spots, Emerging Issues & Best Practices” sheds light on how financial institutions are addressing challenges associated with third-party cyber risk.