Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

"I understand the pitfalls of cyber security, but my boss just won't support me with the budget I need.” Does this sound familiar to you as a CISO? I have 3 pieces of advice for you: Speak their language I like to say that CISOs are from Mars, while CEOs and board members are from Venus. It’s because they don't speak the same language. You might go to your board and say, “I installed Akamai Prolexic.1.4.4.3.1./24 subnet to mitigate an SYN flood attack.”

Here are 3 tips for founders and CEOs to have a work-life balance: As a founder/CEO, there are always 500 more things you could do at the end of the day, the next day, and the day thereafter. So you’ve to ask questions like:“What can I do that will deliver 10x results?”“What can I do to move the needle the most?”“What areas will the results be the same unless I get involved?” Before each day starts, I ask myself, “What are the top few things I need to accomplish?”

Here’s why you should check a company’s overall cyber security health before acquiring it: You could be doing a great job protecting your company. But then, if you merge with a business with holes and attackers are already inside it, their problem becomes your problem. So you need to build a rigorous methodology and a playbook to assess the security of your target during the M&A diligence. Here’s how you can do it.

Vulnerability scans test for different misconfigurations and report the vulnerabilities. But they have 2 big drawbacks: You need to get consent from a company before you do a vulnerability scan on them. You may get a very rigorous readout from a vulnerability scan. But then a sleep-deprived IT administrator misconfigured the system, making your report irrelevant. On the other hand, security ratings don’t need anybody’s consent and provide continuous, real-time monitoring.

“My company has cyber insurance. Isn’t that enough to protect us?” NO. Cyber insurance will help you cover the damages but won’t protect you from being hacked in the 1st place or recover as soon as possible if you’re attacked. In fact, a lot of progressive cyber insurance companies today also provide preventative care tools (like SecurityScorecard). They know the importance of having an entire cybersecurity toolset rather than just having insurance.

We charge 0$ for additional login at SecurityScorecard. Here's why: One of our company values is customer-centricity. So we asked ourselves: "What's best for the customer?" What's best for customers is to give logins to as many people in the organization as possible. We want every team in the organization to benefit from the insights provided by the SecurityScorecards, including: This way, everybody knows the risk of entering into a proof of concept engagement or signing a contract with a vendor or service provider.

Stop using questionnaires to assess the risk of your business partners. Here's why: Suppose you want to hire a marketing firm to help grow your company. To assess the risk, you send them a 20-page questionnaire asking about 2-factor authentication, data encryption, etc. Even if they have a 2-factor authentication in place, e.g., you still have to ask for their company policy to verify. Not only does that result in mountains of paperwork.

Vulnerability scans and penetration tests are not enough. Here are 2 reasons why.

At SecurityScorecard, we're collecting data from 12 different countries. Here's why: Some countries, industries, and organizations are beginning to deploy deception technologies to misrepresent their security hygiene. If you're trying to gather information on the Chinese infrastructure from outside, e.g., your data set will appear sparse because China blocks the view. But if you collect information from outside and inside of China and triangulate the different discrepancies, you get a more accurate representation.

At SecurityScorecard, we're collecting close to 70 billion security issues per week. Here's how: Worldwide data collection Our goal is to non-intrusively pick up enough data signals from every company worldwide to form an opinion on their cyber hygiene and vulnerability. Malware Sinkholing Working with law enforcement, our R&D team is Our security analysts are looking at the underground criminal communication for poor patching cadence and hygiene indicators.