Blog Posts

Should I use Continuous Vulnerability Assessment?

When it comes to protecting your organization from cyber threats, one of the most important decisions you will make is whether or not to use continuous vulnerability assessment. A vulnerability assessment is a process of identifying, quantifying, and prioritizing (by using a risk management framework) the vulnerabilities in an organization's IT systems, applications and infrastructure.

Read More
soc, outsource, vendor, cybersecurity, defense Christian Grupp soc, outsource, vendor, cybersecurity, defense Christian Grupp

Do I need an outsourced SOC (Security Operations Center)?

When it comes to cybersecurity, one of the most important decisions a company can make is whether or not to outsource their Security Operations Center (SOC). An SOC is responsible for monitoring and analyzing a company's security systems to identify and respond to potential threats. While some companies choose to handle their SOC in-house, others opt to outsource this critical function to a third-party provider. There are pros and cons to both options, and ultimately, the decision of whether or not to outsource an SOC will depend on the unique needs and circumstances of your organization.

Read More

How do I select someone to do vulnerability assessments?

When it comes to selecting a vendor to perform vulnerability assessments, there are a few key factors to consider. First and foremost, it's important to understand the difference between a vulnerability assessment and a penetration test. A vulnerability assessment is a non-intrusive evaluation of your organization's systems, networks, and applications to identify and assess any vulnerabilities that could be exploited by an attacker. A penetration test, on the other hand, is a simulated attack on your systems, networks, and applications to test the effectiveness of your security controls.

Read More
pentest, cybersecurity, red team, offense Christian Grupp pentest, cybersecurity, red team, offense Christian Grupp

How do I select a Penetration Tester?

When it comes to selecting a penetration testing vendor, there are several factors to consider. Before beginning the selection process, it's important to have a clear understanding of the scope of the assessment and the specific objectives you hope to achieve. This will help you identify the right type of vendor and ensure that they have the necessary capabilities to meet your needs.

Read More
risk assessment, risk, cybersecurity Christian Grupp risk assessment, risk, cybersecurity Christian Grupp

How do I perform my first Risk Assessment?

Performing your first risk assessment can be a daunting task, but it is an essential step in securing your organization's sensitive information and assets. A risk assessment is the process of identifying, analyzing, and evaluating potential threats to your organization and determining the likelihood of those threats occurring. By completing a risk assessment, you can identify vulnerabilities in your organization's security posture and take steps to mitigate those risks. In this blog post, we will go over the steps you need to take to perform your first risk assessment.

Read More

What is a bug bounty program? And why consider implementing one?

A bug bounty program is a system in which a company or organization offers rewards to individuals who discover and report vulnerabilities in their software or systems. These programs have become increasingly popular in recent years as a way for companies to improve their cybersecurity posture and protect against cyber threats.

Read More
supply chain, risk, cybersecurity Christian Grupp supply chain, risk, cybersecurity Christian Grupp

What does "supply chain risk" mean in cybersecurity?

Supply chain risk in cybersecurity refers to the potential vulnerabilities and threats that exist within the various entities and processes that make up the supply chain of a company's technology and information systems. This can include everything from the vendors and manufacturers of hardware and software, to the logistics companies that transport and store the products, to the service providers and third-party contractors that manage and maintain the systems.

Read More

If I use a payment processor like Stripe or Square, how does PCI-DSS apply to me?

When it comes to accepting credit card payments online, merchants have a number of options to choose from, including popular payment processors like Stripe and Square. These companies offer a range of features and benefits that can make it easier for businesses to process payments and manage their finances. However, it's important to note that even if you're using a payment processor, you're still subject to the same security standards as other merchants. One of the most important of these standards is the Payment Card Industry Data Security Standard (PCI-DSS).

Read More