Risk Identification/Classification/Mitigation

The advisory never mentions Russia – or any other country or hacking group – by name, but the language is notable because previous cybersecurity advisories put out in the wake of the Russian military build up and invasion have been careful to emphasize that there were no “specific or credible threats” driving their warnings.

Here are five steps for doing threat modeling right.

By investing in behavioral detection, integrating threat intel with red and blue teams, sharing knowledge, and verifying and validating detections, companies can build very successful threat detection programs.

New CISA report on the manufacturing sector said while many companies may need to automate to offset worker shortages, they also need to invest in cybersecurity talent so they can more effectively manage the factories of the future.

MITRE ATT&CK doesn’t replace the NIST framework and others like it, but it does give security teams insight into how the bad guys operate.

The U.S. Federal Trade Commission released guidance on AI in April. Today’s columnist, David Balaban of Privacy-PC, says government regulation could likely hold back the technology’s progress.

Rather than limit focus to indicators of compromise, CERT's new director, Greg Touhill said government needs "to do a better job of making sure that what information we share has contextual elements, and is timely."

For decades, anyone analyzing network traffic concentrated on external network traffic, known as north-south traffic, through the perimeter via firewalls.  Although firewalls evolved to better analyze this traffic, two primary trends emerged: 1) cloud adoption was causing the perimeter to become more porous, even to the point of extinction, and 2) as attackers gained sophistication, […]