The MGM Cyber Attack: A Masterclass in Risk Management

by

Image of a man pulling on a gear device marked high and low risk, and the words “Robust risk management strategies can prevent a cyber attack” in the background.

The MGM Cyber Attack and Lessons in Risk Management

In the ever-evolving landscape of the digital world, cybersecurity has taken center stage. The MGM cyber attack serves as a stark reminder of the constant threat lurking in the shadows of the web. This unfortunate incident, though disconcerting, offers us a valuable lesson in risk management.

It is crucial to learn from these events and take proactive steps to safeguard our digital assets. In this article, we will explore the MGM cyber attack, the lessons it imparts on risk management, and provide practical mitigation steps and solution examples to help organizations

Understanding the MGM Cyber Attack

Before delving into risk management solutions, let’s take a moment to understand what happened during the MGM cyber attack. In September 2023, MGM Resorts suffered a data breach, leading to the exposure of personal information belonging to customers who transacted with MGM Resorts prior to March 2019. This included names, contact information, gender, dates of birth and driver license number. For a limited number of customers, the hackers also accessed Social Security numbers and passport details. According to Bloomberg, the breach stemmed from a social engineering breach of the company’s information technology help desk. MGM’s experience highlights the importance of robust cybersecurity practices.

Read more

Share

OCTAVE Allegro: A Comprehensive Guide to Cybersecurity Risk Assessment

by

Image of people working in a simulated OCTAVE Allegro risk assessment environment showing a man in a dark suit holding a magnifying glass, and a woman working on a laptop.

Introduction

The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Allegro methodology is an effective approach to address the challenges organizations face in today’s fast-paced business landscape. Businesses increasingly face a multitude of risks that can disrupt operations, damage reputation, and lead to significant financial losses. If you add to that the ever-increasing number of cyber threats, organizations must be proactive in identifying and mitigating potential risks.

OCTAVE Allegro offers a robust and adaptable approach for organizations to assess and mitigate cybersecurity risks.

In this article, we will delve into the origins, methodologies, and components of OCTAVE Allegro, and discuss why organizations should consider adopting it for their cybersecurity risk assessment needs. We will also provide clear implementation steps to make the process understandable and achievable for organizations of all sizes.

Section 1: The Origin of OCTAVE Allegro

OCTAVE Allegro is an evolution of the original OCTAVE methodology, which was developed at the Software Engineering Institute (SEI) at Carnegie Mellon University. The SEI introduced OCTAVE in the late 1990s as a comprehensive approach to managing information security risks.

Read more

Share

Third-Party Risk Management Framework

by

Image of a colored circle with the words "Risk Management" at the center surrounded by five sections wth the words "Identify, "Analyze", "Action", "Monitor", and "Control".

Introduction

Small businesses often rely on external partners, suppliers, and vendors to thrive and grow. While these collaborations can be beneficial, they also expose small businesses to third-party risks that can potentially harm their operations, reputation, and bottom line. To mitigate these risks effectively, small businesses need a robust third-party risk management (TPRM) framework. In this article, we will explore the best technology framework for TPRM in a small business environment and discuss why it’s crucial to implement such a system.

What is  A Third-Party  and Third-Party Risk?

The term “third party” refers to any entity or body that a company will collaborate with, do business with, or hire. This includes vendors, contract manufacturers, business partners, suppliers, resellers, agents, distributors, and brokers.

Third-party risk is the potential for a primary organization to suffer a data breach, or be negatively impacted or compromised via connections to external organizations and entities.

Read more

Share

Addressing Significant Gaps in an Organization’s IAM Framework

by

Image of identification technologies symbols and touch screen fingerprint recognition ID system.

A recent risk assessment of an organization’s IT environment revealed significant gaps in the current IAM framework, including ineffective access control policies, weak authentication mechanisms, and insufficient monitoring and auditing procedures.

This could as well be your organization, and here, we suggest recommendations to address these issues.

What is an Identity and Access Management or IAM Framework?

An Identity and Access Management framework is the combination of two information security controls: identity management and access management.

Identity management is the method used to classify a user, group or device on a network with the goal of placing identified resources into categories so that network and security policies can be applied. For example, it checks checks a login attempt against an identity management database.

Access management on the other hand refers to the way an organization determines who or what on a network has the right to connect to a particular resource as determined by factors like job title, tenure, security clearance, and project etc.

Read more

Share

Strengthen Your Business with the CIS Critical Security Controls

by

Image concept icons of mobile devices, credit card, and email, and security icons showing how to protect user accounts, privacy, and cloud storage from cyber attacks with a tool like the CIS Critical Security Controls.

Businesses today are increasingly reliant on technology to manage their operations and data. With this dependence on technology comes a heightened need for robust cybersecurity measures. The Center for Internet Security (CIS) Critical Security Controls, provides a comprehensive framework to enhance cybersecurity and protect your business from a wide range of threats.

In this article, we will explore the significance of these controls, their real-world applications, and how they can help businesses improve their security posture.

The Importance of Cybersecurity

Cybersecurity is a paramount concern for businesses of all sizes and industries. Data breaches, cyber-attacks, and other security incidents can have devastating consequences, including financial losses, damage to reputation, and legal liabilities. As such, companies must implement proactive security measures to safeguard their digital assets and customer information.

Read more

Share

Understanding NIST 800-30: A Guide to Effective Risk Management

by

 

Image showing the essential steps of the core of NIST 800-30: the Risk Management Framework - prepare, categorize, select, implement, assess, authorize, and monitor.

More than ever, organizations must balance a rapidly evolving cybersecurity and privacy threat landscape against the need to fulfill business requirements on an enterprise level. Organizations, both big and small, face a myriad of threats that can compromise sensitive information and disrupt business operations. To tackle these challenges, the National Institute of Standards and Technology (NIST) has developed a comprehensive framework known as NIST 800-30, which provides a structured approach to risk management.

In this article, we will explore the essential components of NIST 800-30 and shed light on how it can help organizations bolster their cybersecurity efforts.

What is NIST 800-30?

NIST 800-30 is a vital document within NIST’s Special Publication 800 series that focuses on risk management. It provides organizations with a structured approach to identify, assess, and manage cybersecurity risks effectively.

This framework empowers organizations to make informed decisions and allocate resources efficiently to protect their information and systems.

Read more

Share
Share
Share