Cyber Attacks, security compliance, Supply Chain Security

The SEC’s New Cyber Rules

Posted on September 12, 2023September 12, 2023 by Or Kadosh

what every ciso needs to know about the new cybersecurity sec rules

12
Sep

What Every Public Company CISO Must Know:

The role of a Chief Information Security Officer (CISO) in public companies has never been more pivotal. With cyber threats escalating in scale and sophistication, the Securities and Exchange Commission (SEC) has rolled out new cyber regulations aimed at safeguarding investors, stakeholders, and the broader market. Given that the amendments took effect on September 5, 2023, it’s crucial for your organization to be informed. While the final rules are quite lengthy, I’ll offer a condensed and digestible version in this blog post to help you understand the key points – so make sure to read on!

The Backdrop:

Back in March 2022, the Commission took the bold step of introducing a suite of regulations. The intent was clear: fortify public company disclosures concerning cybersecurity. This encompassed key areas such as cyber threats, strategic countermeasures, governance structures, and insights into major cyber incidents.

At the time, there were several major trends that led the Commission to take this action. The digital evolution and massive work-from-home shifts, intertwined with the allure of cybercrime monetization and an overarching reliance on third-party tech services like cloud platforms, have stretched cyber risk boundaries. The financial fallout from cyber incidents have also skyrocketed. Given all of this, the Commission’s move to ensure transparency isn’t just timely—it’s imperative.

Though the Commission offered guidance in 2011 and 2018, the standards remained inconsistent. The 2022 regulations were introduced to bring consistency and offer investors clearer insights.

Key Mandates To Be Aware Of:

Skip ahead to 2023, and the SEC’s proposed rules have officially transformed into finalized rules. Here are the essential highlights you should be aware of…

Form 8-K Item 1.05: A pivotal element in the new regulations. Public companies now have the duty to report significant cyber incidents. Reports must, “describe the material aspects of the nature, scope, and timing of the incident, as well as the material impact or reasonably likely material impact of the incident on the registrant, including its financial condition and results of operations.”
Disclosure Timeline: Post a cyber event, companies need to swiftly gauge its significance. If found consequential, a Form 8-K needs to be filed within four business days. However, exceptions do exist. Should the U.S. Attorney General deem a quick disclosure a threat to national or public safety, delays can ensue.
Regulation S-K Item 106: This regulation delves deep. It mandates firms to shed light on their cyber threat assessment, detection, and management strategies. Past incidents that have or might have considerable ramifications also need to be outlined. Plus, it casts the spotlight on how involved the board is in overseeing cyber risks and the prowess of the management in mitigating them.
International Disclosures: The SEC is highlighting that global transparency is crucial. Modifications to Form 6-K and Form 20-F ensure that foreign private entities aren’t left out. Significant cyber events disclosed overseas or required by foreign issuers need to be detailed.

What Lies Ahead:

The new regulations will be operational a month after their Federal Register appearance. For companies, the compliance timelines are split based on the form:

Regulation S-K Item 106 & Form 20-F: Disclosure starts with annual statements for fiscal years ending on or after December 15, 2023.
Form 8-K Item 1.05 & Form 6-K: Compliance starts 90 days post Federal Register publication or by December 18, 2023, except for smaller firms. They have until June 15, 2024.
Finally, when it comes to structured data mandates, the spotlight is on Inline XBRL. The final rules require the cybersecurity disclosures to be presented in Inline eXtensible Business Reporting Language. Entities must tag their disclosures using this format, a year after the kick-off of initial disclosure duties. To simplify what this filing format is for those who may not be aware, it’s a special language for computers that makes it possible to create a single document that’s human and machine readable. So, instead of making two different documents (one for people to read and one for computers to understand), you just make one using Inline XBRL.

Every day we are reminded how crucial cyber resilience is. For CISOs in public companies, aligning with the SEC’s updated cyber regulations is not just about compliance—it’s a commitment to transparency, investor protection, and long-term business sustainability.

Cyber Attacks, security compliance, Supply Chain Security, Vendor Risk Management

The Top 10 Things Every CISO Should Know

Posted on September 1, 2023September 1, 2023 by Or Kadosh

01
Sep

What Every CISO Should Know in 2023 to Protect Their Business

In our rapidly evolving digital age, the role of a Chief Information Security Officer (CISO) has never been more crucial. As a CISO, your role stretches far beyond traditional IT security measures. You are the protector of your organization’s most valuable assets, from intellectual property to customer data. The following insights delve deeper into what every CISO should know in 2023 to ensure they’re at the forefront of safeguarding their business.

1. Grasping the Business

Understanding your business inside out is paramount. The best CISOs fully comprehend the company’s goals, mission, and operational mechanics. Why is this so vital? Because only with this understanding can you adequately prioritize and champion security initiatives. Furthermore, by aligning security measures with business goals, you ensure that security is not viewed as a roadblock but rather an enabler of growth and success.

2. Emphasizing Effective Risk Management

Risk management isn’t just a box to tick; it’s a continual process. This involves constant vigilance—identifying emerging threats, assessing their potential impact, and implementing controls to counteract them. Today’s cyber threats are dynamic, with cybercriminals using sophisticated techniques that change by the minute. Hence, regular risk assessments and updates are non-negotiable. But, just as crucial is the art of communication. The ability to articulate these risks, along with their potential implications to the board and executives, can make the difference between proactive action and reactive damage control.

3. Moving Beyond Compliance

While regulatory compliance is essential, in 2023, it’s merely a starting point. With the ever-evolving threat landscape, relying solely on regulations and standards can render a business vulnerable. It’s like only installing a front door lock while leaving all the windows open. Instead, a proactive approach, involving continuous assessment and adaptation of security measures to the unique needs and threats faced by your organization, is pivotal.

4. Championing Security Awareness

The human factor can often be the weakest link in any security chain. As such, empowering every single employee with the knowledge and tools to act as the first line of defense is vital. This means ongoing training, regular reminders, and cultivating a culture where security is everyone’s business. Remember, from the receptionist to the CEO, everyone can either be an asset or a vulnerability.

5. Harnessing the Power of Effective Communication

Clear, concise, and compelling communication can be one of the most potent tools in a CISO’s arsenal. It’s essential to translate the often complex world of security into language that everyone—from the tech newbie to the seasoned board member—can grasp. Regularly updating stakeholders about security postures, potential risks, and ongoing initiatives not only fosters trust but also reinforces the importance of collective vigilance.

Expanding the CISO’s Toolkit in 2023:

But let’s push the envelope further. In addition to the critical pointers above, CISOs in 2023 should be aware of:

6. Embracing the Cloud and Zero Trust:

As businesses transition to cloud infrastructures, understanding cloud security best practices becomes paramount. Moreover, adopting a Zero Trust approach—where every access request is fully authenticated, authorized, and encrypted before granting access—ensures layered defense in a distributed work environment.

7. Machine Learning and AI:

Cybercriminals are leveraging AI; so should you. Incorporating machine learning can help in anomaly detection, identifying potential threats faster than any human could, and enhancing predictive analytics. Findings not only automates assessments and the auditing process for all of your company’s vendors, but we also offer real time updates on your risk posture powered by RiskRecon and Anomali.

8. Regular Penetration Testing:

Gone are the days when an annual penetration test sufficed. Regularly challenging your systems can expose vulnerabilities before cybercriminals exploit them.

9. Incident Response Preparedness:

It’s not about if, but when a breach might occur. Having a well-rehearsed incident response plan ensures rapid containment, minimizing potential damage.

10. Collaborative Security:

Partnering with other businesses, industry groups, and governmental bodies can provide invaluable intelligence and resources. Cybersecurity is a collective endeavor.

In conclusion, being a CISO in 2023 means juggling many balls—compliance, risk management, employee training, effective communication, technological advancements, and more. The threat landscape might be challenging, but with the right approach, tools, and mindset, CISOs can ensure their organizations are robustly defended and primed for growth.

findings tech, security compliance, Supply Chain Security, Vendor Risk Management

Automated Security Assessments: Expectations and Preparation

Posted on May 21, 2023May 21, 2023 by Sharon Amor

What to expect during an automated security assessment and how to prepare for it - findings.co

21
May

Automated security assessments are one of the most talked about features in the supply chain management industry. Organizations have turned to automated solutions to enhance their risk management and supply chain compliance after recognizing the need to eliminate the burdensome and time-consuming task of manually auditing and tracking numerous vendors. It makes sense after all. Who wants to spend hours on end of manual work to audit and chase hundreds of thousands of vendors?

The answer is: no one.

Findings’ comprehensive platform has gone above and beyond to automate risk management and supply chain compliance, saving organizations of all sizes extensive manual work and reducing friction.

Now, let’s break down some things you should expect to see when using the platform that will ultimately help you prepare.

Assessment Logic

When managing assessments in Findings platform, you can create an assessment from scratch with branching logic or upload pre-existing assessments and tweak it to suit your needs. When you create an assessment from scratch, you can create a question with various answer choices. If the answer choices are branching types such as the Radio button, multiply select, or dropdown, you can create a follow-up question based on a certain response chosen.

When it comes to uploading assessments from pre-existing documents, you can edit the subjects and alter the logic to suit the vendor’s needs via our assessment wizard. Once the assessment has been uploaded you can clone, edit and tailor custom it with various app integrations for the associated vendors.

Findings and Remediation:

Imagine the ability to pre-create remediation plans and suggestions. Essentially, rather than sending out an assessment to a vendor and having to review it and write out compliance corrections and suggestions manually, this is pre-prepared before the vendor even begins the assessment. For any answer choice that is not in compliance, you can create a remediation suggested plan for that answer and change the risk level that will affect the vendor’s overall score. When the vendor completes the assessment, they already have a remediation plan ready for them, so that they can bridge the gaps without all the time-consuming back and forth.

Response Repository (NLP):

Our response repository is based on neuro-linguistic programming and is one of the biggest assets our users hold. When a vendor or customer completes an assessment, our system scans the answers and creates a respiratory for similar written questions the next time an assessment is completed. The next time a user completes an assessment, our automated suggested answers pop up and the user can insert the answers based on the relevant match. This saves numerous hours of manual work by having to complete assessments from scratch. Within seconds, your assessment can be completed and you can focus on other essential tasks.

Automated security assessments provided by Findings are perfect for organizations seeking efficient risk management and streamlined supply chain compliance. By automating the assessment process, organizations of all sizes can save valuable time and resources that would otherwise be spent on manual audits and vendor follow-ups. By utilizing the features we offer, organizations can complete assessments quickly and focus on other essential tasks, ultimately improving their overall security posture and supply chain management.

Learn More Today

Cyber Attacks, gdpr, security compliance, Supply Chain Security

Don’t Let Hackers In: Your Company Needs to Enforce 2FA ASAP

Posted on May 5, 2023May 5, 2023 by Or Kadosh

05
May

There’s no denying it – 2FA is a game-changer. Two-factor authentication (2FA) is a security process that requires a user to provide two different factors to verify their identity. It adds an extra layer of security beyond passwords and is an important tool for companies to use to protect their sensitive information and prevent unauthorized access. In this blog post, we will explore the benefits of 2FA and look at some real-world examples of cyberattacks that could have been prevented or mitigated if 2FA had been used.

What is Two-Factor Authentication (2FA)?

2FA is a security process that requires a user to provide two different factors to verify their identity. These factors typically include something the user knows, such as a password or PIN, and something the user has, such as a security token or mobile device. By requiring two different factors, 2FA ensures that only authorized users can access systems and data, helping to prevent unauthorized access and protect against phishing attacks.

Benefits of Two-Factor Authentication (2FA):

The importance of 2FA cannot be overstated. In today’s digital landscape, cyberattacks are becoming increasingly sophisticated, and it’s becoming more difficult to protect against them. However, by implementing 2FA, companies can significantly reduce the risk of a breach occurring.

There are many benefits to using 2FA to protect sensitive information and prevent unauthorized access. Some of the key benefits include:

Increased Security:

2FA adds an extra layer of security beyond passwords, making it more difficult for attackers to gain access to systems and data. By requiring two different authentication factors, 2FA ensures that only authorized users can access sensitive information, helping to prevent data breaches and other security incidents.

Protection Against Phishing Attacks:

Phishing attacks are a common tactic used by cybercriminals to trick users into revealing their login credentials. 2FA can help protect against phishing attacks by requiring users to provide a second factor of authentication, making it more difficult for attackers to gain access to sensitive information.

Compliance Requirements:

Many regulatory frameworks require the use of 2FA to protect sensitive information. For example, the Payment Card Industry Data Security Standard (PCI DSS) requires merchants who accept credit card payments to use multi-factor authentication for remote access to the cardholder data environment. In addition, some states have passed laws that require companies to implement 2FA in certain situations. For example, the New York State Department of Financial Services (NYDFS) Cybersecurity Regulation requires covered entities to implement multi-factor authentication for access to sensitive data and systems. Internationally, the European Union’s General Data Protection Regulation (GDPR) does not explicitly require companies to implement 2FA, but it does require companies to implement appropriate technical and organizational measures to ensure the security of personal data. The GDPR also requires companies to notify data subjects in the event of a data breach, and 2FA can be an effective means of preventing unauthorized access to personal data. Overall, while there is no universal requirement for companies to implement 2FA, many industries and regulatory bodies recognize its importance in improving security and protecting sensitive data. By implementing 2FA, companies can ensure that they are in compliance with these requirements, helping to avoid potential fines and other penalties.

Trust:

Enforcing 2FA builds trust with customers, who will appreciate the additional security measures in place to protect their data.

Why 2FA isn’t enough sometimes:

The effectiveness of 2FA lies in its deployment, rather than the security measure itself. If any component of the 2FA process is compromised, it can result in a security breach. Traditional methods like phishing and social engineering are now being used to bypass 2FA more and more. As written by Steven J. Vaughan-Nichols, “In short, 2FA can’t stop human stupidity.”

We all know that cybersecurity is no joke. That’s why 2FA is a must-have tool in any company’s arsenal to safeguard their sensitive information and prevent unwanted visitors from sneaking in. By requiring not just one, but two authentication factors, companies can ensure that only those with the key to the kingdom are granted access to their systems and data. This helps keep everything locked up tight, safe from the prying eyes of cybercriminals. Time and time again, it’s proven to be the hero we need to foil malicious attacks and protect our valuable data.

FIND OUT MORE

Cyber Attacks, security compliance, Supply Chain Security

How Security Assessments Help Prevent Breaches

Posted on April 24, 2023April 24, 2023 by Or Kadosh

Findings.co explores how security assessments can help prevent data breaches

24
Apr

Data breaches can cause significant damage to a business, both in terms of financial losses and damage to reputation. In recent years, the number of data breaches reported has increased dramatically, with cybercriminals using increasingly sophisticated methods to gain access to sensitive data. One of the most effective ways to prevent data breaches is by conducting regular security assessments.

A security assessment is a comprehensive evaluation of an organization’s security posture. It involves reviewing all aspects of the organization’s security, including policies, procedures, infrastructure, and personnel. The goal of a security assessment is to identify vulnerabilities and weaknesses that could be exploited by an attacker. There are many types of security assessments, including vulnerability assessments, penetration testing, and risk assessments. Each of these assessments has its own unique methodology, but they all aim to achieve the same goal: to identify vulnerabilities and weaknesses in an organization’s security.

By conducting a security assessment, organizations can identify vulnerabilities before they are exploited by attackers. This allows the organization to take proactive steps to mitigate the risk of a data breach. For example, if a security assessment identifies that the organization’s password policies are weak, the organization can implement stronger policies to prevent unauthorized access.

Another benefit of conducting a security assessment is that it can help organizations comply with industry and regulatory requirements. Many industries have specific regulations that organizations must follow to protect sensitive data. By conducting a security assessment, organizations can ensure that they are meeting these requirements and avoid costly fines and legal action.

Additionally, conducting a security assessment can help organizations identify areas where they need to invest in additional security measures. For example, if a security assessment reveals that the organization’s network infrastructure is outdated, the organization can allocate resources to upgrade the infrastructure to better protect against attacks.

It’s important to note that conducting a security assessment is not a one-time event. Security threats and vulnerabilities are constantly evolving, and organizations must regularly review and update their security measures to stay ahead of attackers.

Why are Security Assessments Important?

Security assessments are essential for preventing data breaches because they help organizations identify vulnerabilities before they are exploited by attackers. By conducting a security assessment, organizations can take proactive steps to mitigate the risk of a data breach.

For example, a vulnerability assessment can identify vulnerabilities in an organization’s software or hardware systems. These vulnerabilities could be used by an attacker to gain unauthorized access to sensitive data. By identifying these vulnerabilities, organizations can take steps to patch or fix them before an attacker can exploit them.

Similarly, a penetration test can simulate an attack on an organization’s systems to identify weaknesses that could be exploited by an attacker. By conducting a penetration test, organizations can identify vulnerabilities and weaknesses in their systems and take steps to improve their security.

Security assessments are also important for helping organizations comply with industry and regulatory requirements. Many industries have specific regulations that organizations must follow to protect sensitive data. By conducting a security assessment, organizations can ensure that they are meeting these requirements and avoid costly fines and legal action.

Examples of Security Assessments in Action:

Now that we’ve explored why security assessments are important, let’s take a look at some examples of how they’ve helped organizations prevent data breaches.breaches.

Example 1: Target Data Breach

In 2013, retail giant Target suffered a massive data breach that compromised the personal and financial information of millions of customers. The breach was caused by a vulnerability in Target’s payment system that was exploited by attackers.

Following the breach, Target conducted a security assessment to identify the root cause of the attack and prevent future breaches. The assessment identified a number of vulnerabilities in Target’s systems, including weaknesses in the company’s password policies and network segmentation.

Based on the findings of the assessment, Target implemented a number of security measures, including two-factor authentication for remote access, improved password policies, and increased network segmentation. These measures helped to prevent future data breaches at Target.

Example 2: Equifax Data Breach

In 2017, credit reporting agency Equifax suffered a data breach that exposed the personal and financial information of over 140 million customers. The breach was caused by a vulnerability in Equifax’s web application software that was exploited by attackers.

Following the breach, Equifax conducted a security assessment to identify the root cause of the attack and prevent future breaches. The assessment identified a number of vulnerabilities in Equifax’s systems, including weaknesses in the company’s patch management processes and web application security.

Based on the findings of the assessment, Equifax implemented a number of security measures, including improved patch management processes, enhanced web application security, and increased employee training on cybersecurity best practices. These measures helped to prevent future data breaches at Equifax.

Example 3: University of Virginia Data Breach

In 2014, the University of Virginia suffered a data breach that exposed the personal and financial information of over 18,000 current and former employees. The breach was caused by a vulnerability in the university’s payroll system that was exploited by attackers.

Following the breach, the university conducted a security assessment to identify the root cause of the attack and prevent future breaches. The assessment identified a number of vulnerabilities in the university’s systems, including weaknesses in the company’s patch management processes, access controls, and network security.

Based on the findings of the assessment, the university implemented a number of security measures, including improved patch management processes, enhanced access controls, and increased network security. The university also provided additional cybersecurity training to its employees to help prevent future data breaches.

As we’ve seen in these examples, security assessments can be a powerful tool for preventing data breaches. By identifying vulnerabilities and weaknesses in an organization’s security posture, organizations can take proactive steps to mitigate the risk of a data breach. This can include implementing security measures such as two-factor authentication, improved password policies, enhanced patch management processes, and increased employee training on cybersecurity best practices.

In addition to preventing data breaches, security assessments can also help organizations comply with industry and regulatory requirements. By conducting a security assessment, organizations can ensure that they are meeting these requirements and avoid costly fines and legal action.

Ultimately, conducting regular security assessments is essential for any organization that wants to protect its sensitive data from cybercriminals. By taking proactive steps to identify and address vulnerabilities, organizations can help prevent data breaches and protect the privacy and security of their customers and employees.

Automate Your Assessments Today

Cyber Attacks, Privacy, security compliance, Supply Chain Security

The Great Data Breaches: Tales of Cybersecurity Misadventures

Posted on April 11, 2023April 11, 2023 by Or Kadosh

Findings.co talks about the decade's biggest breaches from the past decade.

11
Apr

The Great Data Breaches: Tales of Cybersecurity Misadventures

Data breaches are a nightmare of the digital age that have plagued companies and organizations around the world in recent years. With cybercriminals constantly evolving their tactics, no one is safe from the threat of a data breach. While this list can go on and on we’ve narrowed it down to some of the most well known breaches to date.

Let’s take a look at some of the most notable data breaches that have occurred in the past decade, and the lessons we can learn from them!

Equifax: The One That Got Away

In 2017, Equifax, one of the largest credit reporting agencies, suffered a breach that exposed the personal information of 147 million people, including names, birthdates, Social Security numbers, and other sensitive data. Equifax system administrators discovered that attackers had gained unauthorized access via the Internet to the online dispute portal that maintained documents used to resolve consumer disputes. In a statement released, Equifax writes, “The attack vector used in this incident occurred through a vulnerability in Apache Struts (CVE-2017-5638), an open-source application framework that supports the Equifax online dispute portal web application. Based on the company’s investigation, Equifax believes the unauthorized accesses to certain files containing personal information occurred from May 13 through July 30, 2017.”

(From SEC filing report)

This was a huge blow for the credit industry, as it exposed flaws in the system that allowed unauthorized access to sensitive personal information. It also highlighted the need for companies to invest in cybersecurity measures to protect their customers’ data.

Yahoo: Twice Bitten, Thrice Shy

In 2013 and 2014, Yahoo experienced two separate data breaches and every user who had a Yahoo account was likely affected by its massive hack. The stolen information included names, email addresses, phone numbers, dates of birth, and security questions and answers. The sheer scale of this breach was unprecedented, and many companies lack the ability to collect and store all network activity that could be used to trace a hacker’s steps, making it difficult to investigate data breaches. This was highlighted by the Yahoo breach in 2013 and 2014, where investigators struggled to follow the hackers’ tracks due to a lack of network activity data.

Marriott: A Wake Up Call

In 2018, Marriott International, one of the world’s largest hotel chains, suffered a data breach that exposed the personal information of 500 million customers. In a company statement, Marriott explains that they “learned during the investigation that there had been unauthorized access to the Starwood network since 2014. The company recently discovered that an unauthorized party had copied and encrypted information, and took steps towards removing it. On November 19, 2018, Marriott was able to decrypt the information and determined that the contents were from the Starwood guest reservation database.” The breach at Marriott International exposed the personal information of approximately 500 million customers who made a reservation at a Starwood property. The stolen information included names, mailing addresses, phone numbers, email addresses, passport numbers, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. Some guests’ payment card numbers and expiration dates were also compromised, but they were encrypted using AES-128. This breach was a wake-up call for the hospitality industry, which has traditionally lagged behind other sectors in cybersecurity. It highlighted the importance of designing security measures into products and services from the outset, rather than bolting them on as an afterthought.

Target: The Target of Cybercrime

In 2013, Target, a major U.S. retailer, experienced a breach that affected 110 million customers. This was one of the earliest and most widely publicized data breaches. Prior to this event, cybersecurity was not given the same level of attention as it is today. The professional practices that many businesses implemented in response to this event likely prevented numerous data breaches from occurring. The breach began when a third-party contractor for Target, Fazio Mechanical Services, fell victim to a spear phishing attack. The hackers then used the stolen credentials to access Target’s corporate network and install malware on Target’s POS devices. Target’s security team received a notice for a generic threat but did not act on the warning. The breach wasn’t detected until three days later, and the US Department of Justice uncovered the scope of the danger on December 12th. The hackers gained access to data including full names, phone numbers, email addresses, payment card numbers, and credit card verification codes. This breach was a turning point in the battle against cybercrime, as it demonstrated that even the biggest companies were vulnerable to attack. It also highlighted the need for companies to invest in cybersecurity measures and to take a proactive approach to threat detection and response.

Capital One: A Capital Mistake

In 2019, Capital One experienced a breach after an outside individual obtained unauthorized access to personal information of about 100 million US customers and 6 million Canadian customers. Capital One explained that they discovered this security incident after the configuration vulnerability was reported to Capital One by an external security researcher through their Responsible Disclosure Program on July 17, 2019. The accessed information included personal information collected from credit card applications, such as names, addresses, and self-reported income, as well as customer status data, credit scores, and transaction data from 23 days in 2016-2018. Additionally, the individual obtained about 140,000 Social Security numbers and 80,000 linked bank account numbers of secured credit card customers. This incident underscores the importance of securing sensitive financial data and having strong cybersecurity policies, including employee training and regular security audits.

eBay: Buy and Beware

In 2014, eBay experienced a massive data breach that affected all 145 million users at that time. The hackers were able to access encrypted passwords and personal details of customers, including names, email addresses, phone numbers, and physical addresses. As a result, eBay was forced to ask all of its users to change their passwords in a surprising turn of events. In many instances, hackers may unscramble encrypted passwords and then use automated softwares that logs into thousands of popular social media sites and banking accounts. At the time, eBay faced extreme criticism for its slow response and poor communication with affected customers following the massive data breach. This incident highlights the importance of swift action and proactive communication with customers in the aftermath of a data breach. Even more importantly, it was a lesson in the importance of password hygiene and the need for companies to implement strong password policies, such as two-factor authentication.

(from eBay’s website)

Anthem: The Healthcare Hack

In 2015, Anthem, one of the largest health insurance companies in the U.S., announced that it suffered a breach that exposed the personal information of 80 million customers, including names, birthdates, Social Security numbers, and other sensitive data. How did it happen? According to the investigative report, the Anthem data breach began in February 2014 when a user in one of the company’s subsidiaries opened a phishing email containing harmful content. This led to the download of malicious files and remote access to the user’s computer, as well as dozens of other systems within the Anthem enterprise, including the company’s data warehouse. The attacker was able to move laterally across Anthem systems and escalate privileges, ultimately compromising at least 50 accounts and 90 systems. This resulted in access to approximately 78.8 million unique user records after querying the data warehouse. This breach was a stark reminder of the importance of securing sensitive healthcare data, which is highly sought after by cybercriminals. It also highlighted the need for companies to invest in cybersecurity measures and to take a proactive approach to threat detection and response.

Microsoft Exchange: The Latest Threat

In 2021, Microsoft Exchange email servers were attacked, affecting 60,000 companies worldwide. The hackers were able to exploit four zero-day vulnerabilities, which allowed them to gain unauthorized access to emails from small businesses to local governments. They took advantage of a few coding errors over three months to take control of vulnerable systems. Once they gained access, they could request data, deploy malware, use backdoors to gain access to other systems, and ultimately take over the servers. Many people assumed that the requests were legitimate because they looked like they came from the Exchange servers themselves. Although Microsoft was able to patch the vulnerabilities, owners of individual servers that didn’t update their systems would still be vulnerable to the exploit. Because the systems weren’t on the cloud, Microsoft couldn’t immediately push a patch to fix the issues. In July 2021, the Biden administration, along with the FBI, accused China of the data breach. Microsoft followed suit and named a Chinese state-sponsored hacker group, Hafnium, as the culprit behind the attack.

These are just a few of the largest data breaches in the past decade, and there have been many others affecting a range of industries and types of organizations. The lessons we can learn from these breaches are clear: companies need to take cybersecurity seriously and implement robust security measures to protect their customers’ data. By staying informed and investing in the latest cybersecurity technologies, we can help to prevent the next big data breach.

Findings Can Help You

Cyber Attacks, security compliance, Supply Chain Security

March Data Breach Round-Up

Posted on April 3, 2023April 3, 2023 by Or Kadosh

findings shares the top breaches that happened in March 2023

03
Apr

As we move forward, it’s becoming increasingly clear that even large corporations aren’t safe from cyber attacks. From Chick-fil-A and Dole Food Company to Acer and Procter & Gamble, the number of companies that have suffered data breaches continues to grow. Today, I’ll delve into some of the latest confirmed data breaches from March, and examine what they could mean for both these businesses and their customers. With personal data security on the line, it’s time to brace yourself for a rollercoaster ride into the realm of cybercrime!

Attention all Chick-fil-A lovers! Unfortunately, Chick-fil-A has sent a notice to customers about a data security incident that may have involved their personal information. The company has taken measures to prevent unauthorized activity and engaged a national forensics firm to investigate the issue. Based on their investigation, it was discovered that unauthorized parties launched an automated attack against Chick-fil-A’s website and mobile application between December 18, 2022, and February 12, 2023, using account credentials obtained from a third-party source. The information that may have been involved includes name, email address, Chick-fil-A One membership number, mobile pay number, QR code, masked credit/debit card number, and the amount of Chick-fil-A credit on the account, as well as the month and day of the birthday, phone number, and address if saved to the account. Unauthorized parties were only able to view the last four digits of the payment card number. Chick-fil-A recommends affected customers change their password immediately and choose a strong, unique password.

While we all love fresh produce, it’s important to remember that cybersecurity is vital to ensuring that we can continue to enjoy our favorite fruits and veggies. Fresh produce provider, Dole Food Company, has confirmed that employee information was accessed by threat actors during a February ransomware attack. The number of employees affected was not disclosed, but Dole employs approximately 38,000 people worldwide. The company said the attack was sophisticated, but limited in impact on operations. However, Dole was forced to shut down production plants across North America and was unable to fulfill orders for a week, leading to complaints from customers. In response to the attack, Dole engaged cybersecurity experts and notified law enforcement. The incident has been disclosed in an annual report filed with the US Securities and Exchange Commission. The company very nicely explained the damage that a cyber attack can cause a company. In the report they write, “our information technology networks and systems, some of which rely on third-party service providers, may be vulnerable to service disruptions or system failures due to causes including intentional hacking, security breaches, intrusions, malware, denial of service attacks, phishing, or other cybersecurity attacks, as well as natural disasters, catastrophic events, power outages, or human error or malfeasance. If we are unable to prevent or adequately respond to and resolve these disruptions or failures, our operations may be impacted and any unauthorized access to, or acquisition of, customer, employee, or other confidential information could result in adverse consequences such as reputational damage, premature termination or reduction of existing contracts, reduction of operating revenue, remediation costs, ransomware payments, litigation, and/or penalties under various laws and regulations. Our customers could also refuse to continue to do business with us and prematurely terminate or reduce existing contracts, resulting in a significant reduction of our operating revenue.” This further shows that everyone in the supply chain is ultimately affected by cyber attacks.

The FBI just put the cuffs on the supposed mastermind behind a notorious cybercriminal hub that boasted stolen data from Congress members and countless other individuals. The founder of the BreachForums website, Conor Brian Fitzpatrick, has been arrested and charged with operating a hacking forum and marketplace for cybercriminals. Fitzpatrick, 20, allegedly created BreachForums in March 2022 to buy, sell and trade hacked or stolen data and other contraband, including personally identifying information, bank account details, and social security numbers. According to reports, Fitzpatrick is believed to have played a role as a mediator or intermediary for unlawful deals and personally offered access to legitimate breached databases using a credit-based system run by the online platform. The site’s various sections included “Cracking,” “Leaks,” and “Tutorials.” The FBI and the Department of Health and Human Services Office of Inspector General have conducted a disruption operation that caused BreachForums to go offline. Fitzpatrick’s alleged victims included millions of U.S. citizens and hundreds of U.S. and foreign companies, organizations, and government agencies. Deputy Attorney General Lisa O. Monaco has announced another successful crackdown on the cybercrime underworld, stating that the BreachForums platform – much like its predecessor RaidForums – facilitated the trade of stolen data between hackers and willing buyers. She warns all those involved in shady dealings on the dark web that they should take note: Law enforcement agencies are determined to dismantle these illicit forums and prosecute their administrators in U.S. courts. So if you’re operating in the shadows, you better watch out!

On March 20th, Ferrari confirmed that Ferrari S.p.A., its wholly-owned Italian subsidiary, was recently contacted by a threat actor with a ransom demand related to certain client contact details. Twitter user Troy Hunt shared the breach letter sent to customers. Ferrari writes, “we regret to inform you of a cyber incident at Ferrari, where a threat actor was able to access a limited number of systems in our IT environment.” While the company explains that no no payment information or details of Ferrari cars owned or ordered had been stolen, hackers still accessed customers’ names, addresses, email addresses and telephone numbers. Let’s keep on dreaming about our favorite Italian sports cars and hope that Ferrari’s cybersecurity measures are strengthened to prevent any future incidents.

After suffering at least two other hacking incidents in 2021, Acer, a Taiwanese electronics and computer manufacturer, has allegedly fallen victim to a ransomware attack, and the ransomware group, REvil, is claiming responsibility. The cybercriminals are demanding a staggering $50 million, the highest ransom on record to date. Acer is well-known for its laptops, desktops, and monitors, and employs around 7,000 people worldwide. The investigation is still ongoing, however Acer did confirm it suffered a breach. “We have recently detected an incident of unauthorized access to one of our document servers for repair technicians. While our investigation is ongoing, there is currently no indication that any consumer data was stored on that server,” the company told PCMag in a statement. In another statement made to BleepingComputer, the company explained, “Acer routinely monitors its IT systems, and most cyberattacks are well defensed. Companies like us are constantly under attack, and we have reported recent abnormal situations observed to the relevant law enforcement and data protection authorities in multiple countries. We have been continuously enhancing our cybersecurity infrastructure to protect business continuity and our information integrity.” It’s extremely important that companies continue to stay up to date with cybersecurity regulations and best practices.

Oh boy, it seems like GoAnywhere just can’t catch a break! This supposedly secure web file transfer solution has been at the center of a string of breaches, and the hits just keep on coming. Let’s take a closer look, shall we?

In early February, Fortra – a company that offers GoAnywhere as a secure managed file transfer (MFT) product – announced that it had identified a zero-day vulnerability in the system. This vulnerability could allow attackers to remotely execute code on vulnerable systems, and it was actively being exploited. The news was first reported by journalist Brian Krebs, and it set off a chain reaction of breaches affecting multiple companies.

One of the latest victims to come forward is Procter & Gamble, a consumer goods company that confirmed it was impacted by the GoAnywhere incident. The company’s GoAnywhere MFT platform was compromised, and an unauthorized third party was able to obtain some information about P&G employees. Fortunately, financial and social security information was not accessed, but some data was stolen. It’s believed that the Clop ransomware gang may be behind the attack, as they previously claimed to have stolen files from over 130 organizations.

And now, Crown Resorts – Australia’s largest gambling and entertainment company – has also fallen victim to the GoAnywhere breaches. Their secure file-sharing server was breached using a zero-day vulnerability, and a ransomware group has claimed to have illegally obtained a limited number of Crown files. Crown Resorts is just the latest in a long list of victims, including CHS, Hatch Bank, Rubrik, the City of Toronto, Hitachi Energy and Saks Fifth Avenue.

It’s safe to say that the GoAnywhere breaches have had a huge impact on multiple industries, and it’s important for companies to take extra precautions when it comes to data security. Stay vigilant, folks!

In recent years, cybercrime has affected not only small businesses but also large corporations. This blog post examined several data breaches that occurred in March 2023, including those affecting Chick-fil-A, Dole Food Company, Ferrari, and Acer. These breaches have impacted the personal information of customers and employees, leading to potential risks such as identity theft and fraud. With these incidents in mind, it is crucial for individuals and companies to prioritize cybersecurity measures and remain vigilant against cyber threats.

SEE HOW FINDINGS CAN HELP YOUR BUSINESS

security compliance, Trade Compliance

How Compliance Impacts Your Sales-Cycle Success

Posted on March 14, 2023March 14, 2023 by Or Kadosh

findings.co discusses why your sales cycle success depends on compliance

14
Mar

From GDPR, ISO, and HIPAA to NIST, organizations must now comply with a complex patchwork of global, regional, and national laws and regulations.

Sales teams are often focused on meeting their targets and may not think about the compliance risks that can impact sales cycles and the business on the whole. Compliance refers to the laws, rules, and regulations that a company must follow to conduct business legally and ethically.

However, compliance should be top of mind for sales teams, as regulatory compliance failures can lengthen the time it takes to close a deal, increase costs, and create new risks. The two are often interconnected because compliance regulations can impact how a company sells and how long it takes to close a sale. Failure to comply with these regulations can result in legal and financial consequences.

Sales Cycles: How Long Should They be?

A shorter sales cycle is important for two main reasons. With the business world being highly competitive, companies need to be able to move quickly to win new business. Second, a shorter sales cycle allows companies to optimize their marketing ROI and accelerate revenue. Above all, a shorter sales cycle enhances customer satisfaction and brand loyalty.

Recent trends show sales cycles are getting longer and more complex. In a survey conducted in 2021 by Korn Ferry, 52 percent of B2B buyers said the sales cycle is now longer than ever before.

One of the major factors that can impact sales cycles is regulatory compliance.

Regulatory Compliance Risks

From hefty fines that run up to millions of dollars to damage to brand reputation, non-compliance with cybersecurity regulations can land companies in deep trouble.

Here are some statistics that show the consequences of non-compliance that in turn, can affect sales cycles:

In the last quarter of 2022 alone, data breaches across the world exposed 15 million records
According to IBM’s 2022 report, a data breach can cost companies a whopping $4.1 million
279 days is the average time it takes for a company to identify the breach
Companies affected by a data breach lose $1.42 million worth of business

Sales cycles can be impacted by compliance in several ways:

Increased due diligence: Compliance regulations may require companies to conduct more extensive due diligence on potential customers, which can lengthen the sales cycle.
Documentation requirements: Compliance regulations may require companies to provide detailed documentation and information about their products or services, which can also lengthen the sales cycle.
Contract negotiations: Compliance regulations may require specific language or clauses in contracts, which can prolong negotiations and impact the sales cycle.
Approval processes: Compliance regulations may require approval from multiple stakeholders, such as legal or regulatory departments, which can add time to the sales cycle.

Regulations often create additional steps in the sales process, which can increase the time it takes to close a sale. Companies that prioritize compliance, however, may ultimately benefit from increased trust and confidence from customers and regulators, which can lead to longer-term business success. Above all, non-compliance with cybersecurity regulations affects business continuity, productivity, and client relationships, leading to longer sales cycles and canceled contracts.

Partners, vendors, and customers may see the affected company as an unreliable one following a breach. In some cases, they may resort to legal action, further impacting brand reputation and sales.

Ensuring Sales Cycle Success With Regulatory Compliance

It is important for organizations to be aware of the specific compliance requirements that apply to them.

Studies show that extensive use of data loss prevention, encryption, and threat intelligence sharing can reduce data breach costs significantly, allowing a business to bounce back quickly.

Here are some steps you can take to ensure regulatory compliance and optimize the sales cycle:

Establish and maintain a documented privacy management system
Conduct regulatory risk assessments
Implement controls to mitigate privacy risks
Monitor and review the effectiveness of the privacy management system
Communicate information about the organization’s privacy management program to employees, customers, and other stakeholders.

Automate Compliance

One of the most effective ways to ensure regulatory compliance and accelerate sales cycles is to invest in automation. At Findings.co, we offer an innovative solution that provides enterprises with 360-degree audited monitoring of the supply chain and automated control verification.

This cuts overheads and the time required to showcase your privacy and security compliance, speeding up your sales cycles, productivity, and business revenue.

Schedule a demo to learn more about our compliance solutions.

Cyber Attacks, security compliance, Supply Chain Security

Why Security Assessments Are Essential

Posted on March 6, 2023March 6, 2023 by Or Kadosh

06
Mar

Security Assessments and Why They Are Essential

Security assessments are essential tools for businesses of all sizes.

They provide an important way to identify and address any vulnerabilities in networks, systems, and applications, to protect the business from potential cyber threats. This blog post will discuss the importance of security assessments and how businesses can incorporate them into their security strategy.

Why Are Security Assessments Important?

Security assessments are important for businesses because they objectively evaluate the security of their networks, systems, and applications.

They can identify potential security flaws, weak points, and risk areas and help businesses develop plans to address any vulnerabilities.

Additionally, security assessments help businesses understand the current security landscape and identify gaps in their security measures.

This can be an invaluable process for businesses, as it can help them determine any additional security measures that need to be implemented to ensure that their networks, systems, and applications remain safe and secure.

By reviewing and assessing current security measures, businesses can ensure that their policies and procedures are optimal for their organization and that their systems are as safe and secure as possible. It can also help evaluate the effectiveness of existing security measures

Types of Security Assessments

There are a variety of different types of security assessments.

Common types of assessments include penetration testing, vulnerability scanning, and application security testing.

Penetration testing is a process of attempting to exploit any vulnerabilities in a system to gain access and gain further access to the system.
In contrast, vulnerability scanning is a process that identifies any potential security flaws or weaknesses in a system.
Application security testing is a process of testing the security of an application by analyzing the system for any potential security flaws or weaknesses.

Security assessments can also be tailored to specific needs, such as cloud security assessments focusing on the security of cloud-based systems and applications.

Why do it?

Security assessments are essential for businesses of all sizes, large and small, as they are critical in identifying and remedying potential vulnerabilities in networks, systems, and applications.

By conducting such assessments, businesses can create a comprehensive security strategy to help them keep their systems secure and protected from potential cyber threats.

Furthermore, such assessments can also provide valuable insights into potential areas of improvement, allowing businesses to remain one step ahead of any potential security risks.

You Need Automation

By automating your assessments, you can save time and money that would otherwise be spent on manual data entry and analysis.

Automation also makes it easier to quickly assess large amounts of data, which is especially helpful when dealing with complex problems or large datasets.

With automated assessment, you can also ensure more accurate and reliable results, as the software eliminates the potential for human error. Additionally, automated assessment can provide valuable insights into the data that can be used to inform your decision-making.

With Findings, digitize your assessments with ZERO effort and automate your assessment response in seconds – learn more about how Findings can help here

security compliance, Trade Compliance

Why Should You Care About Your Compliance Posture?

Posted on February 27, 2023February 27, 2023 by Or Kadosh

Findings explains why businesses should care about their compliance postures.

27
Feb

In general, compliance means following rules made by an authority body. In practice, it means creating a program that has security controls in place to protect the confidentiality, integrity and availability of data.

Your business and customer data is valuable to cybercriminals who may use it for malicious reasons or personal gain. They could be acting on behalf of the state or an aggressive competitor interested in your trade secrets, technical data or internal communications. Or they may be motivated by money, which they make by selling your customers’ data on the dark web or holding it for ransom.

Why is Regulatory Compliance Important?

The risk of non-compliance with cybersecurity regulations is too big to take lightly. PCI DDS breaches cost companies a minimum of $5,000 and a maximum of $100,000 per month in fines. Fines per HIPAA violation range from $100 to $50,000. If you do business in California, the state’s data privacy law – California Consumer Privacy Act (CCPA) – will apply to you provided you handle more than 50,000 consumers’ data or have an annual gross revenue of at least $25 million. Under the law, you could be fined up to $7,500 for sharing or processing certain types of employee information without their consent.

Harsh punitive action apart, the bad publicity that accompanies data breaches can create a trust deficit among customers and make your competitors suddenly look a lot more attractive than you. Intentional or unintentional exposure of your employees’ information due to ineffective controls or training may also cause them distress.

What Goes Into Maintaining a Strong Compliance Posture?

You’d have to create strong defensive measures for all the places where your data lives, such as systems, networks, smart devices, routers and the cloud. Here’s where industry standards and government regulations on cybersecurity come in. While there are many, not all may apply to your industry. So, the first step in creating a strong compliance posture is to identify the cybersecurity regulations you need to comply with and the cybersecurity frameworks you can adopt to reduce your cybersecurity risk.

You’ll then have to appoint a person to manage your cybersecurity program and stay updated with compliance requirements. Large organizations have Chief Information Security Officers (CISOs), but in a medium-sized or small company, the IT Manager, CTO or COO performs this role, usually in consultation with a cybersecurity company.

The individual is in charge of assessing risks and vulnerabilities, and implementing technical controls based on applicable cybersecurity regulations or a cybersecurity framework (e.g NIST, ISO/IEC 27001 or PCI DSS) with added technical controls to meet those regulations. They will also be responsible for implementing, in collaboration with other leaders, non-technical controls such as cybersecurity policies, procedures, audits and training, which are equally important to compliance.

Cybersecurity requirements change. New threats emerge. The controls you have now may not stack up against new laws and evolving threats. Regularly assessing your security controls is necessary to identify security gaps due to any new risks that have emerged and enforce changes required to continue maintaining a robust compliance posture. If things appear complicated, a cybersecurity company or attorney specializing in cybersecurity compliance will prove to be a valuable ally by providing clarity on laws and recommendations on risk management.

Cyber Attacks, security compliance, Supply Chain Security

The SEC’s New Cyber Rules

Cyber Attacks, security compliance, Supply Chain Security, Vendor Risk Management

The Top 10 Things Every CISO Should Know

findings tech, security compliance, Supply Chain Security, Vendor Risk Management

Automated Security Assessments: Expectations and Preparation

Cyber Attacks, security compliance, Supply Chain Security

How Security Assessments Help Prevent Breaches

Cyber Attacks, Privacy, security compliance, Supply Chain Security

The Great Data Breaches: Tales of Cybersecurity Misadventures

The Great Data Breaches: Tales of Cybersecurity Misadventures

Equifax: The One That Got Away

Yahoo: Twice Bitten, Thrice Shy

Marriott: A Wake Up Call

Target: The Target of Cybercrime

Capital One: A Capital Mistake

eBay: Buy and Beware

Anthem: The Healthcare Hack

Microsoft Exchange: The Latest Threat

Cyber Attacks, security compliance, Supply Chain Security

March Data Breach Round-Up

security compliance, Trade Compliance

How Compliance Impacts Your Sales-Cycle Success

Cyber Attacks, security compliance, Supply Chain Security

Why Security Assessments Are Essential

Security Assessments and Why They Are Essential

Why Are Security Assessments Important?

Types of Security Assessments

Why do it?

You Need Automation

security compliance, Trade Compliance

Why Should You Care About Your Compliance Posture?

Why is Regulatory Compliance Important?

What Goes Into Maintaining a Strong Compliance Posture?

Welcome to Findings

Payment

Thank you for signing up!

Thank you for signing up!