Home > News > featured news > No Compensation After a Cyberattack in the Absence of Third-party Policy

No Compensation After a Cyberattack in the Absence of Third-party Policy

Security Brief | February 10, 2020

  • Kaspersky's report revealed that 71% of enterprises with a third party policy reported receiving monetary recompense after an incident, compared to only 22% who did not have regulations in place.

  • Damage from incidents is estimated to cost $2.57m on average, with data breaches among the three costliest problems faced by enterprises.

  • One of the main benefits of implementing third party policies is that they solve issues around accountability.


Kaspersky IT Security Economics report took almost 5,000 business decision-makers willing to share their thoughts on cybersecurity and their firms’ attitudes about cyberthreats.



The results emphasize on the importance of dedicated policies and protocols for third-party contractors working with IT companies.



Does the concern make any sense?


According to Gartner's research, 71% of organizations have more third parties in their network than they had three years ago – and the same amount expect this number to grow in the next three years. For subcontractors to fulfill their work obligations, companies often allow them access to their sensitive data and IT assets.



Kaspersky's survey laid down surprising facts. It showed that only 22% of organizations that do not have specific data usage guidelines for partners and subcontractors received compensation after a supply-chain attack, or incident that affected suppliers they share information with. In comparison, nearly three-quarters (71%) of enterprises that have specific data usage guidelines for partners and subcontractors received compensation after an incident that affected suppliers they share information with.



The results of our survey may seem rather paradoxical with enterprises with special policies saying they have experienced supply chain attacks more often. However, we can suggest that a business with a wider network of third party organizations will pay more attention to this area, which results in implementing specific guidelines.

- Sergey Martsynkyan, Head of B2B Product Marketing, Kaspersky.


The report revealed that 79% of enterprises have special policies in place explaining to partners and suppliers on how to work with shared resources and data, as well as any penalties they may incur.  The concerns do make sense.  According to the survey, damage from incidents is estimated to cost $2.57m on average, with data breaches among the three costliest problems faced by enterprises.Several sophisticated supply chain attacks including ShadowPad were discovered by the researchers.



A vast network of subcontractors may make such data breaches more likely. Besides, organizations with third party policies can more accurately determine the causes of a particular breach.

-Sergey Martsynkyan, Head of B2B Product Marketing, Kaspersky.


 

The report suggests that one of the main benefits of implementing third party policies is that they solve issues around accountability by defining the areas of responsibility for both of the organizations involved. It also increases the chance of receiving compensation from a supplier that becomes an entry point for an attack.



Third-party policies also play well for SMBs. For example, 68% of SMBs with policies in place received compensation compared to 28% of those who did not have policies.



READ MORE: A framework for measuring Infosec as a business function



The Kaspersky report makes the following recommendations:

1. Regularly update your list of all partners and suppliers, as well as the data they can access. Ensure that they only have access to the resources they need to carry out their work. Confirm that organizations that don’t collaborate with your company are excluded and cannot access or use data and assets.
2. Provide all third parties with the requirements they should follow – including compliance and security practices.


3.Kaspersky offers Kaspersky Anti Targeted Attack that can detect advanced attacks that may have gone under the radar of perimeter protection solutions, including supply chain attacks, at an early stage.

 

 

READ MORE: Nine steps to Cybersecurity

About the survey


The Kaspersky Global Corporate IT Security Risks Survey (ITSRS) is a global survey of IT business decision makers, which is now in its 9th year. A total of 4,958 interviews were conducted across 23 countries. Respondents were asked about the state of IT security within their organizations, the types of threats they face and the costs they have to deal with when recovering from attacks. The regions covered include LATAM (Latin America), Europe, North America, APAC (Asia-Pacific with China), Japan, Russia and META (Middle East, Turkey and Africa).



Spotlight

Disrupt Counterfeit Threats

Counterfeit threats, such as fraudulent ads and look-alike domains, are on the rise especially with the expansion of e-commerce and online consumer-to-business interaction. However, the collection and mitigation of counterfeit activity can be complicated. Prioritizing relationships with platforms and providers along with collect

More featured news

Spotlight

Disrupt Counterfeit Threats

Counterfeit threats, such as fraudulent ads and look-alike domains, are on the rise especially with the expansion of e-commerce and online consumer-to-business interaction. However, the collection and mitigation of counterfeit activity can be complicated. Prioritizing relationships with platforms and providers along with collect

Related News

Network Threat Detection, Platform Security, Software Security

Coro Acquires Network Security Startup Privatise

Businesswire | July 27, 2023

Coro, the modern cybersecurity platform for mid-market organizations, today announced the acquisition of Privatise, an Israeli supplier of network security solutions for in-office and remote work. The acquisition adds critical SASE capabilities to Coro’s all-in-one platform and is part of an aggressive growth strategy, fueled by Coro’s $155M funding over the last 12 months, to expand the capabilities of Coro’s cybersecurity platform both organically and through strategic acquisitions. As the network edge continues to expand, Gartner predicts that by 2025, 80% of enterprises will have adopted a strategy to unify web, cloud services and private application access using a SASE/SSE architecture.** The challenge for mid-market organizations – who have lean IT teams, limited budgets and little to no cybersecurity expertise --is managing the cost and complexity typically associated with SASE implementations. With the Privatise acquisition, Coro now offers a single source of comprehensive security and protection -- all managed through a unified, cloud-based platform -- for any organizational configuration. Coro’s SASE solution includes military grade VPN, Secure RDP, ZTNA, Next Generation Firewall, DNS Filtering, and is fully integrated into Coro’s holistic security architecture, eliminating security gaps caused by siloed approaches to SASE. Whether a company’s assets are cloud first, on-prem, or hybrid, Coro can protect the user, the device they use, the network they connect through, their emails, and the data they access, use and share, all while ensuring compliance with critical supply chain and industry regulations. “Since its founding, Coro has focused on delivering a comprehensive, yet affordable and easy to use cybersecurity solution for mid-market companies,” said Guy Moskowitz, CEO, Coro. “By integrating Privatise’s SASE capabilities into our platform, we offer the industry’s first mid-market solution to deliver cloud-native, seamless and secure access to applications and resources regardless of location or device. We will continue to invest in Coro’s platform, both organically and through acquisition, to help companies strengthen their security posture and improve their operational efficiency.” The Privatise acquisition is the latest milestone in Coro’s growth and momentum. In April, the company announced a $75M funding round from Energy Impact Partners, bringing the total funding raised in the last 12 months to $155M. Coro projects it will grow 300% year-over-year in 2023, extending its extraordinary 300% annual growth record to a 5th year in a row. The Company’s modern approach to cybersecurity – delivering enterprise grade security through a single platform that unifies, simplifies and automates workloads -- has been validated by more than 5000 mid-market customers across every vertical industry. Over the past year, Coro tripled its revenue, customer and employee base, and signed more than 100 new channel partners. About Coro Coro provides modern cybersecurity that unifies comprehensive protection into a single platform. Coro empowers organizations to defend against malware, ransomware, phishing, data leakage, insider threats and email threats across devices, users, and cloud applications. More than 5,000 businesses depend on Coro for protection, unrivaled ease of use, and unmatched affordability. Coro’s cybersecurity platform automatically detects and remediates the many security threats that today's distributed businesses face, without IT teams having to worry, investigate, or fix issues themselves. In addition to Energy Impact Partners, investors in Coro include Balderton Capital, JVP, and Ashton Kutcher’s Sound Ventures.

Read More

Enterprise Security

OpenAI Announces ChatGPT Enterprise for Business Needs

OpenAI | September 07, 2023

OpenAI unveils ChatGPT Enterprise, which provides businesses with enterprise-grade advanced capabilities. ChatGPT Enterprise offers a brand-new administrator portal with tools to manage how employees utilize ChatGPT within an organization. The launch of ChatGPT Enterprise coincides with intensifying competition in the chatbot domain with companies such as OpenAI, Google, Microsoft, and Anthropic. According to OpenAI, artificial intelligence can enhance numerous aspects of professional lives and increase team creativity and productivity. This represents an important milestone in the development of an AI assistant for the workplace that can help with any task, which is tailored to business needs and protects sensitive information. OpenAI, an industry-leading AI research and deployment organization that conducts research and implements machine learning (ML), announced the introduction of ChatGPT Enterprise. The latest product offers enterprise-grade protection and privacy, extended context windows for processing longer inputs, limitless higher-speed GPT-4 access, customization possibilities, additional data analysis capabilities, and much more. ChatGPT Enterprise introduces an all-new admin portal equipped with essential tools for managing and controlling ChatGPT's usage within a company. These tools include domain verification integrations, single sign-on integrations, and a user-friendly dashboard packed with usage statistics. Employees can leverage ChatGPT to streamline internal processes and construct internal workflow through easily shareable discussion templates. Additionally, businesses have the option to tailor ChatGPT-powered solutions to their specific needs by utilizing credits on OpenAI's API platform. OpenAI’s latest product grants users unrestricted access to an advanced data analysis feature previously known as Code Interpreter. This capability empowers ChatGPT to proficiently analyze data, solve mathematical problems, create charts, and perform a range of other tasks. Both ChatGPT Plus and ChatGPT Enterprise operate on the powerful GPT-4, OpenAI's cutting-edge AI model. However, ChatGPT Enterprise customers enjoy priority access to GPT-4, which boasts twice the speed of the standard GPT-4 model and an expanded context window that accommodates up to 32,000 tokens, equivalent to approximately 25,000 words. The introduction of ChatGPT Enterprise overlaps with intensifying competition in the chatbot sector. OpenAI, Google, Microsoft, and Anthropic are engaged in an intense AI arms competition. In addition to releasing new chatbot applications, their objective is to introduce innovative features that encourage the widespread adoption of generative AI in daily operations. Google and Microsoft, for example, are continuously refining their respective Bard and Bing chatbots with innovative features such as visual search. In the meantime, Anthropic, an AI startup founded by former OpenAI executives, has made a splash with its AI chatbot, Claude 2.

Read More

Enterprise Security, Platform Security, Software Security

Safe Security Joins MITRE Engenuity's Center for Threat-Informed Defense

Prnewswire | July 06, 2023

Safe Security, the AI-Driven Cyber Risk Management company, announced today that it has joined the Center for Threat-Informed Defense (Center), operated by MITRE Engenuity, as a Research Sponsor. This partnership will enhance the organization's ability to develop resources to protect against cyberattacks through its unique approach to public interest collaborative research and development (R&D). "We are proud to announce our partnership with the Center as a research sponsor and are excited to share our expertise to drive cybersecurity innovation," said Vidit Baxi CISO and Co-founder at Safe Security. "The Center promotes the co-development of new tools, techniques, and strategies to address challenges in today's highly vulnerable ecosystem. This program allows us to contribute and support global community engagement efforts in understanding and communicating cyber risk. Alongside industry members, we can better articulate and mitigate cyber risks, prioritize specific threat-informed actions to prevent breaches, ultimately contributing to the advancement and improvement of cyber defense." In 2019, MITRE Engenuity was established as a subsidiary of the MITRE Corporation amid a noticeable shift in R&D investments moving towards the private sector. Recognizing that vital industry investments may become overwhelmed in the conceptual phase without proper guidance, the subsidiary aims to ensure effective implementation through nurturing and radical collaboration. Operating within the dynamic cybersecurity landscape, MITRE Engenuity brings together experts, organizations, and investors in a non-competitive environment to foster generational impact for the public good. SAFE's research collaboration will build on the MITRE ATT&CK® framework, forming the foundation for a threat-informed defense approach to counter the latest techniques leveraged by today's most advanced threat actors. The Center also works to provide defenders with a deep understanding of adversary tradecraft and advances in developing countermeasures to prevent, detect, and mitigate modern threats by identifying trends in attacker behavior that can inform the threat intelligence community. Using its AI-fueled cyber risk cloud of clouds platform for predicting and preventing cyber breaches, SAFE evaluates the efficacy of cyber controls by automatically mapping common vulnerabilities and exposures (CVEs) and cyber controls across the kill chain using the MITRE ATT&CK and D3FEND frameworks. This approach enables CISOs to visualize and assess cybersecurity. Predictive data models co-developed with MIT empower CISOs to translate the bits and bytes of cyber risk into dollars and cents, allowing them to communicate these risks to the board effectively and all risk stakeholders. SAFE delivers a data-driven, real-time solution for measuring, managing, and mitigating cyber risk. It gives organizations an aggregated view of enterprise security risk by collating disparate cyber signals for single visibility across their attack surface, technology, people, and third parties. SAFE is dedicated to working with the Center in its continuous efforts to make meaningful contributions to the cybersecurity community, enabling organizations to move from a reactive state to a predictive posture to understand the likelihood of different cyber risk scenarios. "The Center for Threat-Informed Defense serves as a hub for top-tier security teams worldwide to collaborate on identifying and resolving the most pressing challenges confronting cyber defenders," said Jonathan Baker, Co-Founder and Director of the Center for Threat-Informed Defense. "We are thrilled to have Safe Security on board as we strengthen our collective understanding of adversary behaviors and our ability to thwart cyber attacks." About The Center for Threat-Informed Defense The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The center's mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the center builds on MITRE ATT&CK, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the center operates for the public good, outputs of its research and development are available publicly and for the benefit of all. For more information, contact ctid@mitre-engenuity.org. About Safe Security Safe Security is the leader in cyber risk management SaaS platforms. It has redefined cyber risk measurement and management with its real time, data-driven approach that empowers enterprise leaders, regulators, and cyber insurance carriers to understand cyber risk in an aggregated and granular manner. Using SAFE's predictive AI-driven data models, co-developed with MIT, customers are now empowered to translate the bits and bytes of cyber risk into dollars and cents so that they can prioritize their cyber investments to most effectively mitigate their risk and understand the return on security investments. Having raised over $100M, Safe is growing over 200% year over year, consecutively for the last three years and serves some of the largest global enterprises.

Read More

Network Threat Detection, Platform Security, Software Security

Coro Acquires Network Security Startup Privatise

Businesswire | July 27, 2023

Coro, the modern cybersecurity platform for mid-market organizations, today announced the acquisition of Privatise, an Israeli supplier of network security solutions for in-office and remote work. The acquisition adds critical SASE capabilities to Coro’s all-in-one platform and is part of an aggressive growth strategy, fueled by Coro’s $155M funding over the last 12 months, to expand the capabilities of Coro’s cybersecurity platform both organically and through strategic acquisitions. As the network edge continues to expand, Gartner predicts that by 2025, 80% of enterprises will have adopted a strategy to unify web, cloud services and private application access using a SASE/SSE architecture.** The challenge for mid-market organizations – who have lean IT teams, limited budgets and little to no cybersecurity expertise --is managing the cost and complexity typically associated with SASE implementations. With the Privatise acquisition, Coro now offers a single source of comprehensive security and protection -- all managed through a unified, cloud-based platform -- for any organizational configuration. Coro’s SASE solution includes military grade VPN, Secure RDP, ZTNA, Next Generation Firewall, DNS Filtering, and is fully integrated into Coro’s holistic security architecture, eliminating security gaps caused by siloed approaches to SASE. Whether a company’s assets are cloud first, on-prem, or hybrid, Coro can protect the user, the device they use, the network they connect through, their emails, and the data they access, use and share, all while ensuring compliance with critical supply chain and industry regulations. “Since its founding, Coro has focused on delivering a comprehensive, yet affordable and easy to use cybersecurity solution for mid-market companies,” said Guy Moskowitz, CEO, Coro. “By integrating Privatise’s SASE capabilities into our platform, we offer the industry’s first mid-market solution to deliver cloud-native, seamless and secure access to applications and resources regardless of location or device. We will continue to invest in Coro’s platform, both organically and through acquisition, to help companies strengthen their security posture and improve their operational efficiency.” The Privatise acquisition is the latest milestone in Coro’s growth and momentum. In April, the company announced a $75M funding round from Energy Impact Partners, bringing the total funding raised in the last 12 months to $155M. Coro projects it will grow 300% year-over-year in 2023, extending its extraordinary 300% annual growth record to a 5th year in a row. The Company’s modern approach to cybersecurity – delivering enterprise grade security through a single platform that unifies, simplifies and automates workloads -- has been validated by more than 5000 mid-market customers across every vertical industry. Over the past year, Coro tripled its revenue, customer and employee base, and signed more than 100 new channel partners. About Coro Coro provides modern cybersecurity that unifies comprehensive protection into a single platform. Coro empowers organizations to defend against malware, ransomware, phishing, data leakage, insider threats and email threats across devices, users, and cloud applications. More than 5,000 businesses depend on Coro for protection, unrivaled ease of use, and unmatched affordability. Coro’s cybersecurity platform automatically detects and remediates the many security threats that today's distributed businesses face, without IT teams having to worry, investigate, or fix issues themselves. In addition to Energy Impact Partners, investors in Coro include Balderton Capital, JVP, and Ashton Kutcher’s Sound Ventures.

Read More

Enterprise Security

OpenAI Announces ChatGPT Enterprise for Business Needs

OpenAI | September 07, 2023

OpenAI unveils ChatGPT Enterprise, which provides businesses with enterprise-grade advanced capabilities. ChatGPT Enterprise offers a brand-new administrator portal with tools to manage how employees utilize ChatGPT within an organization. The launch of ChatGPT Enterprise coincides with intensifying competition in the chatbot domain with companies such as OpenAI, Google, Microsoft, and Anthropic. According to OpenAI, artificial intelligence can enhance numerous aspects of professional lives and increase team creativity and productivity. This represents an important milestone in the development of an AI assistant for the workplace that can help with any task, which is tailored to business needs and protects sensitive information. OpenAI, an industry-leading AI research and deployment organization that conducts research and implements machine learning (ML), announced the introduction of ChatGPT Enterprise. The latest product offers enterprise-grade protection and privacy, extended context windows for processing longer inputs, limitless higher-speed GPT-4 access, customization possibilities, additional data analysis capabilities, and much more. ChatGPT Enterprise introduces an all-new admin portal equipped with essential tools for managing and controlling ChatGPT's usage within a company. These tools include domain verification integrations, single sign-on integrations, and a user-friendly dashboard packed with usage statistics. Employees can leverage ChatGPT to streamline internal processes and construct internal workflow through easily shareable discussion templates. Additionally, businesses have the option to tailor ChatGPT-powered solutions to their specific needs by utilizing credits on OpenAI's API platform. OpenAI’s latest product grants users unrestricted access to an advanced data analysis feature previously known as Code Interpreter. This capability empowers ChatGPT to proficiently analyze data, solve mathematical problems, create charts, and perform a range of other tasks. Both ChatGPT Plus and ChatGPT Enterprise operate on the powerful GPT-4, OpenAI's cutting-edge AI model. However, ChatGPT Enterprise customers enjoy priority access to GPT-4, which boasts twice the speed of the standard GPT-4 model and an expanded context window that accommodates up to 32,000 tokens, equivalent to approximately 25,000 words. The introduction of ChatGPT Enterprise overlaps with intensifying competition in the chatbot sector. OpenAI, Google, Microsoft, and Anthropic are engaged in an intense AI arms competition. In addition to releasing new chatbot applications, their objective is to introduce innovative features that encourage the widespread adoption of generative AI in daily operations. Google and Microsoft, for example, are continuously refining their respective Bard and Bing chatbots with innovative features such as visual search. In the meantime, Anthropic, an AI startup founded by former OpenAI executives, has made a splash with its AI chatbot, Claude 2.

Read More

Enterprise Security, Platform Security, Software Security

Safe Security Joins MITRE Engenuity's Center for Threat-Informed Defense

Prnewswire | July 06, 2023

Safe Security, the AI-Driven Cyber Risk Management company, announced today that it has joined the Center for Threat-Informed Defense (Center), operated by MITRE Engenuity, as a Research Sponsor. This partnership will enhance the organization's ability to develop resources to protect against cyberattacks through its unique approach to public interest collaborative research and development (R&D). "We are proud to announce our partnership with the Center as a research sponsor and are excited to share our expertise to drive cybersecurity innovation," said Vidit Baxi CISO and Co-founder at Safe Security. "The Center promotes the co-development of new tools, techniques, and strategies to address challenges in today's highly vulnerable ecosystem. This program allows us to contribute and support global community engagement efforts in understanding and communicating cyber risk. Alongside industry members, we can better articulate and mitigate cyber risks, prioritize specific threat-informed actions to prevent breaches, ultimately contributing to the advancement and improvement of cyber defense." In 2019, MITRE Engenuity was established as a subsidiary of the MITRE Corporation amid a noticeable shift in R&D investments moving towards the private sector. Recognizing that vital industry investments may become overwhelmed in the conceptual phase without proper guidance, the subsidiary aims to ensure effective implementation through nurturing and radical collaboration. Operating within the dynamic cybersecurity landscape, MITRE Engenuity brings together experts, organizations, and investors in a non-competitive environment to foster generational impact for the public good. SAFE's research collaboration will build on the MITRE ATT&CK® framework, forming the foundation for a threat-informed defense approach to counter the latest techniques leveraged by today's most advanced threat actors. The Center also works to provide defenders with a deep understanding of adversary tradecraft and advances in developing countermeasures to prevent, detect, and mitigate modern threats by identifying trends in attacker behavior that can inform the threat intelligence community. Using its AI-fueled cyber risk cloud of clouds platform for predicting and preventing cyber breaches, SAFE evaluates the efficacy of cyber controls by automatically mapping common vulnerabilities and exposures (CVEs) and cyber controls across the kill chain using the MITRE ATT&CK and D3FEND frameworks. This approach enables CISOs to visualize and assess cybersecurity. Predictive data models co-developed with MIT empower CISOs to translate the bits and bytes of cyber risk into dollars and cents, allowing them to communicate these risks to the board effectively and all risk stakeholders. SAFE delivers a data-driven, real-time solution for measuring, managing, and mitigating cyber risk. It gives organizations an aggregated view of enterprise security risk by collating disparate cyber signals for single visibility across their attack surface, technology, people, and third parties. SAFE is dedicated to working with the Center in its continuous efforts to make meaningful contributions to the cybersecurity community, enabling organizations to move from a reactive state to a predictive posture to understand the likelihood of different cyber risk scenarios. "The Center for Threat-Informed Defense serves as a hub for top-tier security teams worldwide to collaborate on identifying and resolving the most pressing challenges confronting cyber defenders," said Jonathan Baker, Co-Founder and Director of the Center for Threat-Informed Defense. "We are thrilled to have Safe Security on board as we strengthen our collective understanding of adversary behaviors and our ability to thwart cyber attacks." About The Center for Threat-Informed Defense The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The center's mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the center builds on MITRE ATT&CK, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the center operates for the public good, outputs of its research and development are available publicly and for the benefit of all. For more information, contact ctid@mitre-engenuity.org. About Safe Security Safe Security is the leader in cyber risk management SaaS platforms. It has redefined cyber risk measurement and management with its real time, data-driven approach that empowers enterprise leaders, regulators, and cyber insurance carriers to understand cyber risk in an aggregated and granular manner. Using SAFE's predictive AI-driven data models, co-developed with MIT, customers are now empowered to translate the bits and bytes of cyber risk into dollars and cents so that they can prioritize their cyber investments to most effectively mitigate their risk and understand the return on security investments. Having raised over $100M, Safe is growing over 200% year over year, consecutively for the last three years and serves some of the largest global enterprises.

Read More

More featured news