David Fitch

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

Be informed. Take a read at Cybersecurity and Infrastructure Security Agency latest bulletin.

9

1 Comment

It’s time to define a new cyber risk equation. One that rethinks what’s possible and defies old obstacles. Here’s a look at how we’re reframing our best-in-class portfolio. See more on our product page.

3

Forward-thinking organizations see #cybersecurity compliance as a strategic advantage. ✨ This article offers insights on maintaining compliance and enhancing security, covering key regulations like #GDPR and #HIPAA to help you build a more resilient organization.

9

Super excited about this session! AI, the risks and value proposition plus data governance will certainly be topics of great interests for all security professionals.

17

1 Comment

With new threats emerging on a near-constant basis fueled by geopolitical tensions, shifting regulations and the rapid integration of new technologies, including AI, the risk landscape has become even more complicated. Take a read on our research, published just in time for RSA Conference. EY #cybersecurity, #cyber Ayan Roy, Varun Sharma, CISSP, Tapan Shah, Monica Sagrario, Christine Ermatinger, Nicole Koopman, Daniel Mellen, Kyle Harvey, Douglas Clifton, William Fryberger, Emma Tucker, Lisa Buenzli Peterson

27

Together with Microsoft we at EY have worked to create a framework that serves as a guide for companies on their journey toward responsible #AI. Learn about establishing guidelines for your organization in this white paper. Daniel Mellen, Ayan Roy, Brian DePersiis, William Fryberger, Tapan Shah, Chris Mikucki, Kyle Harvey, Payal Thakkar, Varun Sharma, CISSP, Scott Smith, Nana Ahwoi

15

Current state of MITRE ATT&CK: the essential tool to support the Intrusion Kill Chain Prevention Strategy.: Rick Howard discusses MITRE ATT&CK with Frank Duff, Amy Robertson, and Rick Doten #cyber #cybersecurity #cybersecurityjobs #innovation #management #informationsecurity #technology #cyberjobs

1

With new threats emerging on a near-constant basis fueled by geopolitical tensions, shifting regulations and the rapid integration of new technologies, including AI, the risk landscape has become even more complicated. Take a read on our research, published just in time for RSA Conference. EY, #cybersecurity, #cyber Ayan Roy, Varun Sharma, CISSP, Tapan Shah, Monica Sagrario, Christine Leong, Nicole Koopman, Daniel Mellen, Kyle Harvey, James Phillippe, Douglas Clifton, William Fryberger, Emma Tucker, Lisa Buenzli Peterson

10

1 Comment

Don’t just tick compliance boxes. Make cybersecurity a part of your daily operations. Learn how in our free e-book, where we give you guidance on scheduling critical cybersecurity functions and building a stronger security program.

3

CVE Delay at NIST is causing a crisis with a major slowdown in populating the NVD. Updates to the CVE scoring process and resource constraints are creating a backlog, impacting open source tools and VPM programs relying on CVE metrics. While NIST struggles, vendors like Qualys are stepping up, offering valuable risk analysis tools that go beyond Severity/CVE scores. Even though Qualys doesn't cover company-specific threats extensively, they excel in including industry-oriented ones. This approach proves more comprehensive than just relying on CVE Scores. Understanding the exposure a company faces from the "known exploited vulnerabilities catalog" is crucial. Exploits leveraging these vulnerabilities can make significant headlines for larger companies. For more insights on the NIST vulnerability backlog and Qualys's response, check out these links: https://lnkd.in/eSgVHcrg https://lnkd.in/eFtN2PEM https://lnkd.in/enindptC https://lnkd.in/e_3rCSUY

2

What steps can an organization take to establish better data management? This article outlines four steps to take to protect Data.

5

Ken Frantz and I are excited to be teaming with John Frazzini Christopher Hetner and the entire X-Analytics (SSIC) team to bring meaningful and contextualized cyber risk quantification to boards, management committees and cyber executives. Stop guessing and start acting with the confidence data driven decision making can give you. #becausepeoplematter #bpm #xanalytics

25

1 Comment

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

Interesting article on CSO Online featuring insight from my colleague, Dan Mellen, on #AI Governance and #cybersecurity certifications. As Dan discusses, we prioritize people with hands-on technical experience to guide our clients. #GenAI

5