cybersecurity

Can AI Improve Third-Party Risk Management (TPRM)

By / Blog / ,

AI can enhance Third-Party Risk Management (TPRM) by automating security questionnaires, enabling continuous monitoring, and providing real-time risk assessments.

Discussed during a CISO Series episode, experts highlighted the importance of integrating AI to better understand and manage cumulative risks from vendors, moving away from traditional checkbox exercises. Agile risk assessments, predictive analytics, and marrying threat intelligence with compliance data were seen as critical advancements. Concerns about false positives and accountability remain, emphasizing that while AI augments decision-making, it should not supplant human oversight.

https://cisoseries.com/can-ai-improve-third-party-risk-management-tprm/

NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat

By / Blog / ,

CISA, NSA, FBI, and international partners issued a Cybersecurity Advisory on “Fast Flux,” highlighting it as a national security threat. Fast flux obscures malicious server locations via rapidly changing DNS records, complicating detection and blocking. Organizations and ISPs are urged to adopt multi-layered detection and mitigation strategies, particularly through Protective DNS services, to safeguard national security and critical infrastructure.

https://www.cisa.gov/news-events/alerts/2025/04/03/nsa-cisa-fbi-and-international-partners-release-cybersecurity-advisory-fast-flux-national-security

Proposals Published on the UK Cyber Security and Resilience Bill, Sam Edwards, Natalie Donovan

By / Blog / , ,

UK's Cyber Security and Resilience Bill details released, aiming to strengthen cybersecurity for critical infrastructure by enhancing existing NIS regulations from 2018. Key updates include expanding the scope to Managed Service Providers (MSPs) and data centers, imposing security duties, refining incident reporting to a two-stage structure, empowering regulators, and requiring the ICO to publish strategic priorities. The Bill aligns with EU's NIS2 for improved protection against cyber threats but does not adopt all NIS2 changes, notably omitting management liability.

https://thelens.slaughterandmay.com/post/102k7bo/proposals-published-on-the-uk-cyber-security-and-resilience-bill

5 Questions CISOs Should Ask Third-Party Vendors

By / Blog / , ,

CISOs must evaluate third-party vendors to mitigate risks, especially as recent data breaches highlight vulnerabilities. Key questions to ask include:

  1. What is the vendor’s overall security program?
  2. What is their security development process?
  3. What are their supply chain practices?
  4. Are their privacy and data protection practices compliant?
  5. Is the vendor insured, and under what terms?

These questions help ensure robust data protection while integrating third-party services. CISOs should be central in vendor selection to prevent potential breaches.

https://www.infosecurity-magazine.com/blogs/5-questions-cisos-should-ask/

What NIS2 Implementation Means for Enterprises [Q&A]

By / Blog / ,

NIS2 mandates enhanced cybersecurity for EU businesses and those interacting with them, focusing on risk management and compliance. It expands previous regulations to new sectors and demands stronger defenses against cyber threats. Challenges include varying readiness levels among organizations and the need for compliance to avoid penalties. Key strategies for alignment include auditing partners, consistent domain management, and fostering a security-focused culture. The impact on business partnerships is still emerging, with upcoming penalties likely prompting stricter security evaluations among partners.

https://betanews.com/2025/04/02/what-nis2-implementation-means-for-enterprises-qa/

How CISOs Can Use Identity to Advance Zero Trust

By / Blog /

CISOs must prioritize identity security to advance zero trust strategies amid rising identity-based cyberattacks. With breaches increasingly involving valid credentials, a shift from perimeter-based to identity-focused security is critical. Key controls include privilege management (least privilege, secrets management, just-in-time access), access management (adaptive authentication, SSO, MFA), and identity governance (visibility, compliance, automated reviews). Implementing these practices requires a structured roadmap to ensure they work harmoniously, enhancing resilience against evolving threats. The focus is on continuous identity verification for effective risk management.

https://www.csoonline.com/article/3951888/how-cisos-can-use-identity-to-advance-zero-trust.html

This Security Control Is So Good We Don’t Even Have to Turn It On (LIVE in Clearwater, FL)

By / Blog /

TLDR: Live podcast in Clearwater features David Spark, Christina Shannon, and Jim Bowie discussing effective security controls, training strategies, CISO challenges, and the impact of personal digital lives on work security. Topics include security awareness, engaging employees, dealing with high-pressure environments, and the importance of risk understanding in cybersecurity. Emphasis on continuous training, engagement, and management's role in supporting cybersecurity staff to reduce stress and burnout.

https://cisoseries.com/security-control-is-so-good-we-dont-even-have-to-turn-it-on/

Phishing-as-a-Service (PhaaS)

By / P /

PhaaS: Cybercrime model offering phishing tools, infrastructure, and support for attackers. Lowers barrier to entry, enables widespread phishing campaigns. Users rent services, growth in cyber threats.

Scroll to Top