CISOs: Approach the board with precision, simplicity

Executives from PepsiCo, Mandiant and Texas Children's Hospital honed the art of approaching the board. Their techniques leave stakeholders asking, "Do you need anything?"

By Samantha Schwartz • Oct. 11, 2021

The Water Cooler: 4 IT execs on their first incident response steps

The first step to recovery is planning ahead. But during a crisis, how leadership prioritizes resources and actions from the get-go can determine mitigation.

By Katie Malone , Roberto Torres • Oct. 1, 2021

Explore the Trendline➔

IT Security

Security strategies benefit from nimbleness as companies respond to high-profile vulnerabilities and support internal talent gaps.

By CIO Dive staff

With remote work, any employee could be an insider threat. How is CISA mitigating the risk?

Companies can use a new self-assessment tool from CISA to generate reports on their tolerance and capabilities for preventing insider threats. 

By Samantha Schwartz • Sept. 30, 2021

How hackers are making the leap from cloud to the software build processes

Almost all deployed third-party container applications have known vulnerabilities, research from Palo Alto Networks' Unit 42 found.

By Samantha Schwartz • Sept. 29, 2021

How to build software supply chain transparency

The Biden administration wants more transparency in the software supply chain. Will private industry join in?

By Samantha Schwartz • Sept. 22, 2021

Enterprises plan major investments as remote work escalates security risk: report

Companies are struggling to manage security as the work-from-home model moves from an emergency stopgap to a more permanent environment. 

By David Jones • Sept. 22, 2021

Boards rethink incident response playbook as ransomware surges

Corporate boards are no longer rubber-stamping assurances from CIOs or CISOs but are bringing in outside experts, asking more questions and preparing for the risk of personal liability.

By David Jones • Sept. 16, 2021

InfoSec teams under pressure to compromise security for productivity: report

Younger workers are fueling a backlash against corporate security policies designed to protect companies from malicious attacks, a study from HP Wolf Security shows.

By David Jones • Sept. 9, 2021

Tech CEOs to invest billions in cybersecurity support

The Biden administration has to strike a balance between honoring big tech's capitalism while pushing it to a higher standard for the sake of national security.

By Samantha Schwartz • Aug. 26, 2021

Men more likely to engage in risky online behavior: report

Male employees are three times as likely to click on phishing emails, raising questions about gender-based behaviors that open companies to compromise.

By David Jones • Aug. 24, 2021

It's time to bridge the gap between security and development

More than 80% of developers knowingly release applications with insecure code, but experts say security and development don't have to be at odds.

By Brian Eastwood • Aug. 10, 2021

Decade-old router flaw allows cross-network access, Tenable finds

Threat actors are actively exploiting the vulnerability, which impacts millions of devices across 11 countries and raises questions about the extent of undiscovered supply chain weaknesses.

By David Jones • Updated Aug. 10, 2021

1 in 4 security teams report to CIOs, but would benefit from CISO leadership: survey

Companies get more buy-in for risk assessments and alignment with business goals when cybersecurity reporting centers on the CISO, ISACA found.

By Samantha Schwartz • July 27, 2021

Engineers need cybersecurity training, too

Companies will undergo a shift in cyber culture, eventually combining the data engineers and network security professionals use to search for vulnerabilities.

By Samantha Schwartz • July 22, 2021

In modernization, security is a barrier and an incentive

Performance issues, training users on new systems and bandwidth costs represent hurdles to cloud transformation, according to an IBM survey.

By Katie Malone • July 21, 2021

IT defenses fail to prevent ransomware attacks: report

While 54% of organizations conduct anti-phishing training, 24% of ransomware attacks used phishing as the point of entry, a Cloudian survey found.

By Katie Malone • July 20, 2021

Want to quickly recover from ransomware? Plan ahead

Security teams need to understand how the business will work when an attacker limits access to its systems.

By Katie Malone • July 15, 2021

Kaseya: What's known (and unknown) about the ransomware attack

The historic ransomware attack against the remote-monitoring provider leaves a number of outstanding questions. 

By David Jones • July 12, 2021

Kaseya wrestles with service restoration following supply chain attack

The company is working with federal officials to recover from a ransomware attack that Kaseya said impacted up to 1,500 downstream customers.

By David Jones • July 6, 2021

Cost of ransomware: CISO exits, staff layoffs and unaccounted losses

Two-thirds of organizations incurred significant disruptions due to ransomware, a Cybereason survey found.

By Samantha Schwartz • June 21, 2021

CISOs, CIOs see heightened mobile security threat amid shift to hybrid

Mobile devices are difficult to secure because of a combination of untrusted personal apps and data stored on the same device, one security expert said.

By David Jones • June 16, 2021

Rethinking the perimeter: How to bring confidential data workloads to the public cloud

Despite its porous nature and generally reactive stance to threats, a network perimeter still deflects the vast majority of attacks.

By Dan Petrozzo • June 14, 2021

Bad actors hide in everyday IT tools, complicating detection

Security tools automatically block certain threats, yet there's often a larger intrusion detection teams and services need to weed out.

By Samantha Schwartz • June 10, 2021

What to consider before paying a ransom

Amid rampant attacks, businesses have a choice: pay or suffer.

By Samantha Schwartz • June 7, 2021

Compromised cloud costs companies $6.2M annually, study finds

Attackers heavily target Microsoft 365 and Google Workspace accounts using brute force or phishing attacks, according to Ponemon Institute research.

By David Jones • May 27, 2021