Risk Identification/Classification/Mitigation

Inspired by my co-host, Jason Albuquerque, we get our hands dirty and discuss the challenges of cyber risk management. Why is cyber risk management so elusive and what can we do to solve it? In part 2, we get our hands dirty by walking through ways to quantify cyber risks in business terms. What risks are truly worth mitigating vs. accepting or ...

Inspired by my co-host, Jason Albuquerque, we get our hands dirty and discuss the challenges of cyber risk management. Why is cyber risk management so elusive and what can we do to solve it? In part 1, we discuss the challenges of cyber risk management and quantification. Do risk scores really work? What do CEOs and Boards really need to unders...

The new PCI DSS standard puts more focus on application security, with more tools, testing and documentation required of developers.

The next version of the PCI DSS will likely mean more work for pen testers and give them more leeway in conducting tests, but it also puts them under greater scrutiny. Here’s what’s new in PCI DSS 4.0.

Google has strengthened its OpenSK open-source security key program with the introduction of the first quantum resilient FIDO2 security key implementation leveraging a unique ECC/Dilithium hybrid signature schema that could defend against standard and quantum attacks, The Hacker News reports.

The advisory never mentions Russia – or any other country or hacking group – by name, but the language is notable because previous cybersecurity advisories put out in the wake of the Russian military build up and invasion have been careful to emphasize that there were no “specific or credible threats” driving their warnings.

Here are five steps for doing threat modeling right.