Resources

Guide

Insider Insights for the PCI DSS 4.0 Transition

Is your organization ready for the new PCI DSS 4.0 Standard? To help you make the journey easier and more straightforward, Fortra’s Tripwire gathered strategic implementation advice from top industry insiders.Get detailed guidance on overcoming the challenges posed by each of the PCI DSS 4.0 requirements. Hear from CISOs, cybersecurity analysts,...
Guide

Essential PCI DSS v4.0 Transition Checklist

The proliferation of online transactions isn’t the only reason the PCI Council created the new 4.0 standard. Recent years have also seen increasingly sophisticated methods among cybercriminals, a surge in cloud use, and the rise of contactless payments. This spurred the need for an updated set of PCI DSS requirements, which were released in March...
Guide

What Experts Have to Say About Choosing the Right Cybersecurity Frameworks

Frameworks like the Center for Internet Security (CIS) Controls, MITRE ATT&CK and the National Institute of Standards and Technology (NIST) Cybersecurity Framework give organizations clear, step-by-step methodologies for protecting their sensitive data, leveraging a wealth of industry knowledge to take the guesswork out of your security program.While...
Guide

PCI DSS Resource Toolkit

Use this toolkit to gain a deeper understanding of where you stand with regards to your PCI DSS compliance program and the transition to PCI DSS 4.0. Establishing PCI DSS compliance goes beyond technical tools and processes: It also requires a shift in thinking about compliance as a cybersecurity process. Lean on advice from compliance experts to help you make consistent progress toward your goals...
Guide

Getting in Control of Financial Services Cybersecurity Regulations

Organizations in the financial sector are all too aware that their industry continues to be one of the top targets for cyber criminals. Among financial services and insurance organizations, the leading cause of breaches is system intrusion. That’s why so many cybersecurity compliance regulations have sprung up to ensure systems are kept hardened against attack. This guide covers the main...
Blog

3AM Ransomware Attackers Pose as IT Support to Compromise Networks

Cybercriminals are getting smarter. Not by developing new types of malware or exploiting zero-day vulnerabilities, but by simply pretending to be helpful IT support desk workers.Attackers affiliated with the 3AM ransomware group have combined a variety of different techniques to trick targeted employees into helping them break into networks.It works like this.First, a company employee finds their...
Blog

Dead Man’s Scripts: The Security Risk of Forgotten Scheduled Tasks in Legacy Systems

There are ghosts in the machine.Not the poetic kind. I mean literal, running-code-with-root-access kind. The kind that was set up ten years ago by an admin who retired five jobs ago. The kind that still wakes up every night at 3:30 a.m.; processes something no one remembers, and then quietly vanishes into the system logs. Until, of course, something goes wrong—or someone takes advantage of it...
Blog

Report Reveals BEC Cryptocurrency Scams Rose by 344%

APWG's Q4 2024 Phishing Activity Trends Report, published March 19th, revealed that more than eight in ten Business Email Compromise (BEC) attacks last quarter were sent by attackers favoring Google's free webmail service. By comparison, only 10% used Microsoft's free email web app, Outlook.com.The report, published quarterly, is a product of the phishing incidents reported to the APWG annually by...
Blog

Strengthening Cybersecurity Incident Response Part 2: From Detection to Recovery

Cyber incidents are always going to be present. Regardless of whether you’re working for a startup or a corporation, malicious software can target you and your business. This is why it’s important to work closely with cybersecurity incident response teams and have such protocols in place.The lifecycle of a cybersecurity incident starts way before it happens with good preparation. However, the...
Blog

Latest PCI DSS Standards: Use Third Parties – But at Your Own Risk

Third parties have long been the hidden heroes of the payment card industry, providing specialized, streamlined support to merchants looking to host a website or spin up an app. But that convenience is not without a cost.According to PCI DSS 4.0 compliance standards, although merchants are free to use third parties, the responsibility for any incurred security liability will be all theirs. When a...
Blog

The Cost of Ransomware: Shutdowns & Extortion

Ransomware is no longer in its heyday. Evolving, AI-driven cybersecurity tools and global law enforcement efforts have seen to that. But that doesn’t mean ransomware is no longer a threat. In fact, in some ways, the danger is greater than ever. While ransomware attacks are less common than they used to be, the consequences of those that succeed are more severe. Earlier this year, the Ponemon...
Blog

Information Security Risk Management (ISRM) Boosts Compliance by Undermining Configuration Drift

Compliance is a “ticket to entry” for businesses today, and information security risk management (ISRM) makes sure organizations hang on to their ticket. In this blog, we’ll review how ISRM helps organizations not only get compliant but stay compliant.And how Tripwire makes that process automatic.Compliance is a Core Cost of Doing Business TodayWithout adhering to industry-standard data privacy...
Blog

Mastering Cybersecurity Incident Communication Part 1: A Proactive Approach

Cybersecurity threats are no longer a matter of "if" but "when." While companies invest heavily in technical defenses, one important aspect often gets overlooked — communication.How an organization communicates during a cybersecurity incident determines the speed and effectiveness of its response, as well as the level of trust it maintains with stakeholders.Here, we’ll walk through the...
Blog

Monitoring Applications vs. Operating Systems: Why It Matters

In today’s dynamic IT environments, securing and maintaining the integrity of your systems is critical. Fortra’s Tripwire Enterprise is a robust tool designed to help organizations ensure compliance and security by continuously monitoring the configuration and behavior of their IT assets.When deploying Tripwire, a common question arises: should you prioritize monitoring applications, operating...
Blog

What Is a Security Operations Center (SOC)?

Data breaches continue to cost organizations millions of dollars each year, with costs rising steadily. According to IBM's 2024 Cost of a Data Breach Report, the average cost of a data breach has surged to $4.88 million globally, reflecting the increasing complexity and sophistication of cyberattacks. In the United States, this figure is even higher, averaging $9.8 million per breach, and the...
Blog

New Law Could Mean Prison for Reporting Data Leaks

The Turkish government is proposing a controversial new cybersecurity law that could make it a criminal act to report on data breaches. The new legislation proposes penalties for various cybersecurity-related offences. But they key one which has people concerned is this:"Those who carry out activities aimed at targeting institutions or individuals by creating the perception that there has been a...
Blog

Advice for Exponential Organizations: Intersecting Agile and Incident Response

While Exponential Organizations (ExOs) are transforming industries beyond the tech space, that doesn’t mean that they are not susceptible to an increasing number of cyber threats. As ExOs harness innovative and cutting-edge technologies to drive transformative growth, the ability to respond effectively and proactively to cyber incidents becomes increasingly vital. Recent statistics from the 2024...
Blog

Defending Against Ransom DDoS Attacks

DDoS attacks have become an annoyance most companies assume they may have to deal with at some point. While frustrating, minor website disruptions from small-scale hacktivist campaigns rarely create substantial business impacts. However, a particularly insidious DDoS spinoff has emerged over the past decade – one aimed at blackmail.This evolutionary milestone stems from what's called Ransom DDoS ...
Blog

CIS Control 17: Incident Response Management

We all know that it is a question of when you will be compromised and not if you will be compromised. It is unavoidable. The goal of CIS Control 17 is to ensure that you are set up for success when that inevitable breach occurs. If an organization is neither equipped nor prepared for that potential data breach, they are not likely to succeed in responding to the threat.Key TakeawaysOne takeaway...