Blog
CIS Control 09: Email and Web Browser Protections
By Matthew Jerzewski on Wed, 12/11/2024
Web browsers and email clients are used to interact with external and internal assets. Both applications can be used as a point of entry within an organization. Users of these applications can be manipulated using social engineering attacks. A successful social engineering attack needs to convince users to interact with malicious content. A successful attack could give an attacker an entry point...
Blog
How to Secure Your Information on AWS: 10 Best Practices
By Katrina Thompson on Wed, 03/19/2025
About one in three organizations that leverage cloud service providers (CSPs) use Amazon Web Services (AWS), according to November 2024 research from Synergy Research Group. This means two things. One is that when attackers are looking to get the most out of a single exploit, they will likely craft them to target AWS systems. And two, that AWS data security best practices are a timely topic for a...
Datasheet
Cloud Data Security: Implementing Smarter Cloud Security
The trend of mass migration to the cloud brings benefits like lower operating costs, easier deployability, and the flexibility of an elastic environment. However, it’s crucial to understand that the responsibility to secure your cloud infrastructure still falls on your organization.Cloud providers allow organizations to take advantage of their infrastructure, resulting in a shared model for...
Product Video
Watch a Demo of Tripwire Enterprise
Mon, 08/15/2022
Compliance frameworks are notoriously dense and complex, making them difficult to put into action. Compliance is also time-consuming—especially if you’re still attempting manual configuration of your systems, applications, databases and cloud assets. Manual configuration is error-prone and immediately out of date the moment an assessment ends. And a lack of compliance can result in failing audits,...
Product Video
Enterprise Vulnerability Management in the Cloud
Mon, 08/15/2022
See how other organizations have simplified and automated compliance reporting processes, risk scoring and prioritized remediation efforts.
Blog
CIS Control 16: Application Software Security
By Matthew Jerzewski on Wed, 10/23/2024
The way in which we interact with applications has changed dramatically over the years. Enterprises use applications in day-to-day operations to manage their most sensitive data and control access to system resources. Instead of traversing a labyrinth of networks and systems, attackers today see an opening to turn an organization's application against it to bypass network security controls and...
Blog
CIS Control 08: Audit Log Management
By Matthew Jerzewski on Wed, 12/18/2024
Audit logs provide a rich source of data critical to preventing, detecting, understanding, and minimizing the impact of network or data compromise in a timely manner.Collection logs and regular reviews are useful for identifying baselines, establishing operational trends, and detecting abnormalities. In some cases, logging may be the only evidence of a successful attack.CIS Control 8 emphasizes...
Blog
CIS Control 04: Secure Configuration of Enterprise Assets and Software
By Matthew Jerzewski on Wed, 01/29/2025
Key Takeaways for Control 4Most fresh installs of operating systems or applications come with preconfigured settings that are usually insecure or not properly configured with security in mind. Use the leverage provided by multiple frameworks such as CIS Benchmarks or NIST NCP to find out if your organization needs to augment or adjust any baselines to become better aligned with the policies your...
Blog
CIS Control 11: Data Recovery
By Matthew Jerzewski on Wed, 11/27/2024
Data loss can be a consequence of a variety of factors from malicious ransomware to hardware failures and even natural disasters. Regardless of the reason for data loss, we need to be able to restore our data. A data recovery plan begins with prioritizing our data, protecting it while it is being stored, and having a plan to recover data. Key Takeaways for Control 11Prioritize your data and come...
Blog
CIS Control 10: Malware Defenses
By Matthew Jerzewski on Wed, 12/04/2024
With the continuing rise of ransomware, malware defenses are more critical than ever before with regard to securing the enterprise. Anti-Malware technologies have become an afterthought in many organizations, a technology that they’ve always had, always used, and never really thought about. This control serves as a reminder that this technology is as critical as it ever was and lays out the...
Blog
CIS Control 15: Service Provider Management
By Matthew Jerzewski on Tue, 10/29/2024
Enterprises today rely on partners and vendors to help manage their data. Some companies depend on third-party infrastructure for day-to-day operations, so understanding the regulations and protection standards that a service provider is promising to uphold is very important.Key Takeaways from Control 15Identify your business needs and create a set of standards that can be used to grade service...
Blog
How the CIS Controls Can Help You Achieve PCI DSS 3.2 Compliance
By David Bisson on Sun, 08/05/2018
Compliance with version 3.2 of the Payment Card Industry Data Security Standard (PCI DSS) is a must for organizations that handle, process, transmit and store payment card data. But compliance isn’t always easy to establish or maintain. Indeed, there are certain challenges along the way that can make organizations’ compliance with PCI DSS 3.2...
Guide
Cybersecurity for Work-From-Home Tools
This guide covers the biggest challenges securing work-from-home tools and three actionable steps you can take to overcome them.
Product Video
How Tripwire Helped Walgreens Take a Proactive Approach to Security
Mon, 08/15/2022
Walgreens, founded in 1901, is one of the largest pharmacy companies in the U.S., handling online and in-store sales as well as processing the prescription needs of millions of customers. It needed a security solution that would give them an integrated, all-up view into its IT ecosystem. Its Tripwire ExpertOps solution has given the company a much more proactive view and approach to its security...
Blog
CIS Control 18: Penetration Testing
By Matthew Jerzewski on Thu, 10/10/2024
Penetration testing is something that more companies and organizations should be considering as a necessary expense. I say this because, over the years, the cost of data breaches and other forms of malicious intrusions and disruptions are getting costlier. Per IBM Security’s “Cost of a Data Breach Report 2024,” the average cost of a breach has increased 10% year over year, with the healthcare...
Blog
CIS Control 12: Network Infrastructure Management
By Matthew Jerzewski on Wed, 11/20/2024
Networks form a critical core for our modern-day society and businesses. These networks are comprised of many types of components that make up the networks’ infrastructure. Network infrastructure devices can be physical or virtual and include things such as routers, switches, firewalls, and wireless access points. Unfortunately, many devices are shipped from manufacturers with “default”...