BitSight Insights is a new, 30 minute, bimonthly webinar series featuring BitSight data scientists and security researchers and their latest work. In this episode, the team discusses Log4j, key risk findings related to mobile application security, and research priorities for 2022.
Check out our ebook to learn about the latest ransomware events — and how to protect your organization from falling victim to an attack.
A critical vulnerability that allows for unauthenticated remote code execution has been discovered in Apache Log4j 2, an open source Java logging tool. The Apache Software Foundation has identified the vulnerability as CVE-2021-44228.
“34% of companies [in portfolios] we examined had at least one exposed Java-based server. Not all of those use Log4j, but that gives a rough sense of the scale of exposure,” said Ethan Geil, Senior Director, Data and Research.
“34% of companies [in portfolios] we examined had at least one exposed Java-based server. Not all of those use Log4j, but that gives a rough sense of the scale of exposure,” said Ethan Geil, Senior Director, Data and Research.
There are many ways that a bad actor can infiltrate your IT infrastructure and begin sifting through your data. These vulnerable entry points are known as risk vectors and include insecure endpoints, unsupported mobile devices, unpatched systems, and more.
Today, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities, to drive urgent and prioritized remediation of vulnerabilities that are being actively exploited by adversaries.
This directive includes an update to CISA's catalog of “known exploited vulnerabilities,” part of an ongoing effort encourage organizations to reduce risk within their attack surface. BitSight is proud to partner with CISA on these critical efforts.
In the past few weeks, BitSight has conducted research on two of the vulnerabilities in the CISA list: CVE-2021-41773 and CVE-2021-42013. These vulnerabilities were introduced via a recent Apache Server update and highlight the importance of an effective software update and patch management strategy as well as the need for third-party risk management.
This directive includes an update to CISA's catalog of “known exploited vulnerabilities,” part of an ongoing effort encourage organizations to reduce risk within their attack surface. BitSight is proud to partner with CISA on these critical efforts.
In the past few weeks, BitSight has conducted research on two of the vulnerabilities in the CISA list: CVE-2021-41773 and CVE-2021-42013. These vulnerabilities were introduced via a recent Apache Server update and highlight the importance of an effective software update and patch management strategy as well as the need for third-party risk management.
Join Stephen Boyer, BitSight Co-Founder and CTO, and Jake Olcott, VP Communications and Government Affairs at BitSight, as they discuss the latest BitSight research on the SolarWinds breach and provide actionable steps for security professionals to take now and in the crucial days ahead.
In this on-demand webinar, BitSight’s Tom Montroy, Director of Data Science, and Dan Dahlberg, Director of Research will share insights into the rising trend of ransomware and areas you can address to help prevent becoming a victim.
Download BitSight’s on-demand webinar for answers to how SolarWind impacted your network, and how to prevent future attacks.
Facebook and the apps under its umbrella, including Instagram and WhatsApp, were inaccessible for hours on Monday.
In early September, a threat actor leaked nearly 500,000 Fortinet VPN login names and passwords that were allegedly scraped from vulnerable devices last summer. The leaked credentials could allow hackers to access an exposed network to perform data exfiltration, install malware, and perform ransomware attacks. BitSight was able to verify that 98% of the IP addresses in the leaked files were, in fact, running Fortinet VPN servers within the past 12 months.