Blog
Managing Financial Crime Risks in Digital Payments
By Chester Avey on Thu, 02/01/2024
The emergence of innovative Financial Technology (FinTech) has spearheaded rapid growth in the digital payments sector. In recent years, global payment revenues exceeded valuations of $2.2 trillion, with a steady Compound Annual Growth Rate (CAGR) expected in the next five years.
There is no denying the convenience benefits that the digital...
Blog
Addressing Client-Side Risks in PCI DSS 4.0
By Josh Davies on Mon, 07/15/2024
It seems like such a short time ago that the Security Standards Council released the newest version of the Payment Card Industry Data Security Standard (PCI DSS). It has been a full year, and version 4.0 is now in effect. Industries that adhere to the Standard were given the year to implement the new changes. The Standard includes limited exceptions for specific requirements, classifying them as...
Product Video
Watch a Demo of Tripwire Enterprise
Mon, 08/15/2022
Compliance frameworks are notoriously dense and complex, making them difficult to put into action. Compliance is also time-consuming—especially if you’re still attempting manual configuration of your systems, applications, databases and cloud assets. Manual configuration is error-prone and immediately out of date the moment an assessment ends. And a lack of compliance can result in failing audits,...
Blog
What you need to know about PCI 4.0: Requirements 1, 2, 3 and 4.
By David Bruce on Tue, 06/14/2022
The Payment Card Industry Security Standards Council has released its first update to their Data Security Standard (PCI DSS) since 2018. The new standard, version 4.0, is set to generally go into effect by 2024, but there are suggested updates that are not going to be required until a year after that. This, of course, creates a couple of problems...
Blog
What Is the ISA/IEC 62443 Framework?
By Michael Betti on Mon, 11/04/2024
Cybersecurity threats to manufacturing and process plants come from a wide range of attack vectors, including supply chain, logistics, enterprise computing, remote connections, operator stations, programmable logic controllers, distributed control systems (DCSs), smart sensors, and new smart devices. Internet of Things (IoT) technologies offer greater connectivity and endless applications, but...
Guide
Threat Prevention is Foundational
How proper foundational controls help block today’s advanced threats
Blog
PCI DSS 4.0 is Here: What you Need to Consider
By David Bruce on Tue, 04/26/2022
The Payment Card Industry Data Security Standard (PCI DSS) is a benchmark with tenure in the industry, with the first version being introduced in 2004. The PCI DSS was unique when it was introduced because of its prescriptive nature and its focus on protecting cardholder data. Cybersecurity is a changing landscape, and prescriptive standards must be...
Blog
Understanding Managed Service Providers (MSPs): Choosing the Right Provider
By Jim Whiting on Wed, 08/21/2024
The demand for robust security, transparency, and accountability is at an all-time high, and many businesses are relying on managed service providers (MSPs) to manage their IT infrastructure, ensure data security, or provide seamless operational support. Concurrently, MSPs must continuously innovate and differentiate their offerings to meet the growing needs of businesses.The wide range of MSPs...
Blog
Delivering Electrons, Generating Data Lakes, and the Security & Privacy Considerations of Running a Modern Industrial Organization
By Editorial Staff on Thu, 09/30/2021
In this episode, Patrick Miller, Founder of Ampere Industrial Security, discusses what utilities and other industrial companies need to consider when it comes to the goldmines of data they're collecting from their machines and customers. He also explains why security and privacy needs to be incorporated in these operations by design.
https://open...
Blog
Sextortion Scams – How They Persuade and What to Watch for
By Martina Dove on Wed, 07/10/2024
"Sextortion" scams represent some of cybercriminals' most brazen attempts to extract money from unwitting victims. These extortion techniques rely on fear and shame to get targets to pay up. Similar to individualized ransomware attacks, if the party refuses to pay the demand, public exposure will follow.As these attacks target individuals rather than companies, it is important for all employees to...
Blog
CIS Control 11: Data Recovery
By Matthew Jerzewski on Wed, 11/27/2024
Data loss can be a consequence of a variety of factors from malicious ransomware to hardware failures and even natural disasters. Regardless of the reason for data loss, we need to be able to restore our data. A data recovery plan begins with prioritizing our data, protecting it while it is being stored, and having a plan to recover data. Key Takeaways for Control 11Prioritize your data and come...
Blog
WaterISAC: 15 Security Fundamentals You Need to Know
By Stefanie Shank on Wed, 01/24/2024
2023 saw two concerning attacks on public water systems, highlighting the fragility and risk to utility systems. In Pennsylvania, malicious hackers breached the Municipal Water Authority of Aliquippa system the night after Thanksgiving. The criminals were making a political statement: the technology used to manage water pressure was developed by...
Blog
10 Database Security Best Practices You Should Know
By Katrina Thompson on Mon, 04/29/2024
Statista shows a near doubling of data compromises between last year (3,205) and the year before (1,802). Cybercriminals go where the data goes, and there is more need than ever for effective database security measures.
These tactics differ from network security practices, which rely heavily on software solutions and even employee best practices....
Blog
Design & Implementation of OEM ICS Cybersecurity Frameworks: The Good, The Bad, and The Ugly
By Editorial Staff on Sun, 07/05/2020
The cyber threat landscape today continues to pose a myriad of unique challenges. This is especially the case for industrial organizations due to factors such as aging equipment, poor design or implementation, skills gaps and a lack of visibility. These shortcomings are exacerbated by the mean time to breach detection, which continues to hover above...
Blog
30 Ransomware Prevention Tips
By Guest Authors on Tue, 04/11/2023
Dealing with the aftermath of ransomware attacks is like Russian roulette. Submitting the ransom might seem like it’s the sole option for recovering locked data. Ransomware also continues to evolve as a threat category within the past year, with old names like REvil rearing their heads and new players like Black Basta emerging in 2022. Malicious...
Blog
Why Is Cyber Resilience Essential and Who's Responsible for It?
By Zoë Rose on Tue, 05/07/2024
In the first installment of our series on cyber resilience, we discussed what being a resilient organization means. In this installment, we'll explore why organizations need to consider how to become resilient, who's responsible for achieving this, and the processes organizations must have to prioritize actions and effectively spend their budgets.
...
Blog
Silent Heists: The Danger of Insider Threats
By Kirsten Doyle on Thu, 12/19/2024
When thinking about cybersecurity, we envision malicious actors working in dark basements, honing their tools to invent cunning new ways to breach our defenses. While this is a clear and present danger, it's also important to understand that another hazard is lurking much closer to home - the insider threat.These attacks have devastated entities in all sectors, with severe repercussions. These...
Blog
Developing an Effective Change Management Program
By John Salmi on Tue, 11/08/2022
Change detection is easy. What is not so easy, is reconciling change. Change reconciliation is where most organizations stumble. What was the change? When was it made? Who made it? Was it authorized? The ability to answer these questions are the elements that comprise change management.Historically, the haste of accomplishing a task consisted of a...
Blog
Verizon’s 2019 Payment Security Report – Not Just for PCI
By Anthony Israel-Davis on Tue, 12/03/2019
If you are responsible for cybersecurity or data protection in your organization, stop what you are doing and read this report. Actually, first, go patch your servers and applications and then read this report. Much like Verizon’s Data Breach Investigations Report (DBIR), the Payment Security Report (PSR) is a must-read for security professionals. While it focuses on the PCI DSS standard and...