Resources

CIS Controls v8
Blog

CIS Control 14: Security Awareness and Skill Training

By Matthew Jerzewski on Wed, 11/06/2024
Users who do not have the appropriate security awareness training are considered a weak link in the security of an enterprise. These untrained users are easier to exploit than finding a flaw or vulnerability in the equipment that an enterprise uses to secure its network. Attackers could convince unsuspecting users to unintentionally provide access to the enterprise network or expose sensitive...
Compliance
CIS Controls
Live Webinar
Nov
21

Tackling the CIS: One Control at a Time

10:00 - 11:00am CST
Matthew Jerzewski
The Center for Internet Security (CIS) Critical Security Controls (CSC) are a trusted source of truth in the cybersecurity community. Many organizations implement the CIS CSC framework to ensure their cybersecurity programs are functioning at peak effectiveness. The latest iteration, CIS CSC v8.1, was released earlier this year. Join Matthew Jerzewski, Cybersecurity Researcher...
Compliance,
CIS Controls
Free
1 hour
CIS Controls v8
Blog

CIS Control 15: Service Provider Management

By Matthew Jerzewski on Tue, 10/29/2024
Enterprises today rely on partners and vendors to help manage their data. Some companies depend on third-party infrastructure for day-to-day operations, so understanding the regulations and protection standards that a service provider is promising to uphold is very important.Key Takeaways from Control 15Identify your business needs and create a set of standards that can be used to grade service...
Compliance
CIS Controls
CIS Controls v8
Blog

CIS Control 16: Application Software Security

By Matthew Jerzewski on Wed, 10/23/2024
The way in which we interact with applications has changed dramatically over the years. Enterprises use applications in day-to-day operations to manage their most sensitive data and control access to system resources. Instead of traversing a labyrinth of networks and systems, attackers today see an opening to turn an organization's application against it to bypass network security controls and...
Compliance
CIS Controls
Defending-Against-Ransom-DDoS-Attacks
Blog

Defending Against Ransom DDoS Attacks

By Tripwire Guest Authors on Wed, 10/23/2024
DDoS attacks have become an annoyance most companies assume they may have to deal with at some point. While frustrating, minor website disruptions from small-scale hacktivist campaigns rarely create substantial business impacts. However, a particularly insidious DDoS spinoff has emerged over the past decade – one aimed at blackmail.This evolutionary milestone stems from what's called Ransom DDoS ...
Cybersecurity
Incident Detection & Investigation
Security Configuration Management
CIS Controls v8
Blog

CIS Control 17: Incident Response Management

By Matthew Jerzewski on Wed, 10/16/2024
We all know that it is a question of when you will be compromised and not if you will be compromised. It is unavoidable. The goal of CIS Control 17 is to ensure that you are set up for success when that inevitable breach occurs. If an organization is neither equipped nor prepared for that potential data breach, they are not likely to succeed in responding to the threat.Key TakeawaysOne takeaway...
Compliance
CIS Controls
Incident Detection & Investigation
CIS Controls v8
Blog

CIS Control 18: Penetration Testing

By Matthew Jerzewski on Thu, 10/10/2024
Penetration testing is something that more companies and organizations should be considering as a necessary expense. I say this because, over the years, the cost of data breaches and other forms of malicious intrusions and disruptions are getting costlier. Per IBM Security’s “Cost of a Data Breach Report 2024,” the average cost of a breach has increased 10% year over year, with the healthcare...
Compliance
CIS Controls
Common Phishing Attacks and How to Protect Against Them
Blog

Common Phishing Attacks and How to Protect Against Them

By Kirsten Doyle on Wed, 09/11/2024
Phishing is a malicious attempt to deceive individuals into divulging sensitive information such as usernames, passwords, credit card numbers, or other personal data. These attacks are typically carried out by masquerading as a trustworthy entity in electronic communications. Phishing can take many forms and has evolved to become more sophisticated, making it imperative for individuals and...
Vulnerability & Risk Management
Cybersecurity
Incident Detection & Investigation
This Senate Bill Could Improve Voting Machine Security
Blog

This Senate Bill Could Improve Voting Machine Security

By PJ Bradley on Wed, 09/11/2024
The upcoming election has brought up conversations about the security of our voting infrastructure. While recent developments have somewhat shifted attention toward more visceral threats such as "death threats against county clerks, polling-place violence, and AI-fueled disinformation," the protection of voting machine security is still a pressing concern.Securing electronic voting infrastructure...
Cybersecurity
Incident Detection & Investigation
Security Configuration Management
Low-Hanging Fruits Vs. Those at the Top of the Tree: Cybersecurity Edition
Blog

Low-Hanging Fruits Vs. Those at the Top of the Tree: Cybersecurity Edition

By Joe Pettit on Tue, 07/16/2024
Companies often go for high-end cybersecurity solutions because dealing with complex problems looks impressive. The appeal of fancy tech and advanced security challenges gives them a sense of achievement and a chance to show off their skills - and says they're serious about staying ahead of cyber crooks.However, this isn't always the best strategy. Many significant risks arise from simple...
Cybersecurity
Incident Detection & Investigation
IT Security Operations & Asset Discovery
Security Configuration Management
Guide

What Experts Have to Say About Choosing the Right Cybersecurity Frameworks

Frameworks like the Center for Internet Security (CIS) Controls, MITRE ATT&CK and the National Institute of Standards and Technology (NIST) Cybersecurity Framework give organizations clear, step-by-step methodologies for protecting their sensitive data, leveraging a wealth of industry knowledge to take the guesswork out of your security program.While these cybersecurity frameworks aren’t mandatory...
Cybersecurity
Compliance
CIS Controls
NIST
Insider Threats Maintain a Rising Trend
Blog

Insider Threats Maintain a Rising Trend

By Katrina Thompson on Tue, 05/14/2024
“When the cat’s away, the mouse will play,” the old adage goes. Filings to anti-fraud non-profit Cifas would support that claim, as Insider Threat Database (ITD) reports rose by 14% this past year and are largely attributable to hard-to-monitor work-from-home employees mixed with “increasing financial pressures.” The report details further incidents...
Cybersecurity
Incident Detection & Investigation
Security Configuration Management
Enhancing Endpoint Security with Advanced Host-Based Intrusion Detection Capabilities
Blog

Enhancing Endpoint Security with Advanced Host-Based Intrusion Detection Capabilities

By Tripwire Guest Authors on Tue, 04/23/2024
In 2023, companies lost about $4.45 million on average because of data breaches. As cyber threats advance, securing endpoints is more important than ever. An advanced Host-based Intrusion Detection System (HIDS) provides a sturdy remedy to improve endpoint security. By monitoring and examining system responses and device status, HIDS identifies and...
Cybersecurity
Incident Detection & Investigation
Oops, Malware! Now What? Dealing with Accidental Malware Execution
Blog

Oops, Malware! Now What? Dealing with Accidental Malware Execution

By Dilki Rathnayake on Tue, 04/02/2024
On an ordinary day, you're casually surfing the web and downloading some PDF files. The document icons seem pretty legitimate, so you click without a second thought. But, to your surprise, nothing happens. A closer look reveals that what you believed to be a harmless PDF was, in fact, an executable file. Panic sets in as your settings lock up, and...
Cybersecurity
Incident Detection & Investigation
Datasheet

What Makes Fortra’s Tripwire Different

Are you weighing your options between integrity management solutions? Evaluating, purchasing, and deploying new software is hard work, especially when you get down to the granular details of understanding which solutions have which capabilities and matching those capabilities to your organization’s particular needs. In an industry buzzing with ever-changing terminology and a profusion of vendors...
Vulnerability & Risk Management
Cybersecurity
Compliance
File Integrity & Change Monitoring
Incident Detection & Investigation
Industrial Control Systems
IT Security Operations & Asset Discovery
Managed Security Services
Security Configuration Management
Federated Learning for Cybersecurity: Collaborative Intelligence for Threat Detection
Blog

Federated Learning for Cybersecurity: Collaborative Intelligence for Threat Detection

By Tripwire Guest Authors on Mon, 03/18/2024
The demand for innovative threat detection and intelligence approaches is more pressing than ever. One such paradigm-shifting technology gaining prominence is Federated Learning (FL). This emerging concept harnesses the power of collaborative intelligence, allowing disparate entities to pool their insights without compromising sensitive data. A...
Cybersecurity
Incident Detection & Investigation
Businessman hand using antivirus symbol to block a cyber attack represented by symbols
Blog

The Importance of Host-Based Intrusion Detection Systems

By Steven Sletten on Wed, 03/13/2024
What Is a Host-Based Intrusion Detection System (HIDS)? A host-based intrusion detection system, or HIDS, is a network application that monitors suspicious and malicious behavior, both internally and externally. The HIDS’ job is to flag any unusual patterns of behavior that could signify a breach. By bringing this activity to the team’s attention,...
Cybersecurity
Incident Detection & Investigation
Security Configuration Management
Resolving Top Security Misconfigurations: What you need to know
Blog

Resolving Top Security Misconfigurations: What you need to know

By Jeff Moline on Mon, 01/22/2024
One of the most common factors that can lead to cybersecurity incidents is a security misconfiguration in software or application settings. The default settings that come with the implementation of these tools and solutions are often not configured securely, and many organizations do not invest the time and resources into ensuring that they are. ...
Cybersecurity
Compliance
CIS Controls
NIST
Security Configuration Management
Guide to Creating a Robust Website Security Incident Response Plan
Blog

Guide to Creating a Robust Website Security Incident Response Plan

By Joseph Chukwube on Mon, 12/18/2023
Earlier this year, the SEC proposed a new set of rules on cybersecurity governance, which would require public companies to make appropriate disclosures of cyber risks and management procedures. Although the amendments target the financial sector, it is one more evidence of the fact that cybersecurity is no longer a backburner component of business...
Cybersecurity
Incident Detection & Investigation
Operational Resilience: What It Is and Why It's Important
Blog

Operational Resilience: What It Is and Why It's Important

By Nick Hogg on Wed, 12/13/2023
Frankly stated, operational resilience is your ability to climb the mountain, no matter the weather. Businesses now need more than a good security structure to weather the storms of AI-driven threats, APTs, cloud-based risks, and hyper-distributed environments. And more importantly, operational resilience in 2024 requires a paradigm shift....
Cybersecurity
File Integrity & Change Monitoring
Incident Detection & Investigation