Doug Clare

A growing percentage of cybersecurity incidents against businesses are the result of initial compromises against third parties, allowing malicious actors to gain access through a trusted relationship, move laterally and escalate privileges, and ultimately attain their target. This risk is highlighted in a new report by the U.S. Chamber of Commerce and underscores t…

As TPRM or third-party risk management grows in importance, so does cybersecurity risk assessment as part of it. The latest Assessment of Business Cyber Risk (ABC) report from the US Chamber of Commerce and FICO discusses four steps for improving third-party cybersecurity risk management. These steps can help businesses in the US and other countries not only meet regu…

It’s a great question, and needs to be asked. Cyber scores and ratings have been around for some time now, gaining steady momentum over the last five years. That said, the market for security risk assessment scores and ratings remains nascent, with a double-digit CAGR that will likely continue into the foreseeable future. With new data protection and privac…

Fraud and data breaches have always had a close, if destructive, relationship. As the US transitioned to hard-to-counterfeit EMV payment card technology several years ago, criminals flocked to card not present (CNP) fraud, often combining identity fragments and card numbers stolen in breaches to make illicit purchases online. Five years later, data breaches and downst…

FICO and the U.S. Chamber of Commerce have produced our second quarterly Assessment of Business Cybersecurity Risk — think of it as the FICO Score for the nation’s cybersecurity risk. For the first quarter of 2019, the National Risk Score is 687, holding steady from the fourth quarter of 2018. The National Risk Score is a revenue-weighted average of the FICO^® Cyber R…

It can be a wake-up call for an organization to obtain its cyber risk score and learn it is not as prepared for a data breach as it thought it was. In the U.S. for example, the Chamber of Commerce and FICO have launched a quarterly Assessment of Business Cyber Risk that looks at whole industries, through a roll-up of the FICO^® Cyber Risk Score. As companies learn thei…

TPRM stands for third-party risk management, and it’s an absolutely vital concept in cybersecurity. Today, nearly every vendor or partner you do business with poses a potential security threat to your business. You can have the best cybersecurity in the world, but if your vendor suffers a breach, your data, your customers and your reputation are at risk. New regulati…

It’s an understatement to say that 2018 was a year of blockbuster data breaches: Facebook, Marriott, Ticketmaster and British Airways, to name just a few. As mega-breaches have become the norm, the crescendo of clamor can no longer be ignored; the reality of the true state of threats (immense) and companies’ preparedness (inconsistent, at best) is setting in. Thus,…

October 2018 marks the 15th annual National Cybersecurity Awareness Month, and today, FICO is making big news: we have teamed with the U.S. Chamber of Commerce to help all American businesses be more aware of, and better manage, their cybersecurity risk. The first step in managing risk is quantifying it — and that’s exactly what the Assessment of Business Cybersecuri…

Welcome to the final blog in the series recapping Cyber Risk, Cyber Ratings and Cyber Risk Transfer at FICO World 2018, and my conversation with the session’s three panellists: Josh Ladeau, CISSP, Global Head of Cyber, Aspen Insurance Sasha Romanosky, Policy Researcher, RAND Corporation Dr. Mingyan Liu, Professor and Incoming Chair of Electrical Engineering…

As I recently blogged, “Clearly, there’s a big disconnect between what companies perceive to be their strengths and the reality on the ground.” Now it’s time to move on to the reality of evolving cyber threats, and the important role of risk-scoring technology in cyber risk measurement. Again, I’ll draw on the session Cyber Risk, Cyber Ratings and Cyber Risk Transfer …

“What gets measured gets managed” has got to be near the top of the business world’s Top 10 list of favorite quotes. It’s a go-to quote because it’s true — and I can’t think of a more applicable area than enterprise cybersecurity risk. With few exceptions, notably the FICO Enterprise Security Score (ESS), cyber risk is not being measured in rational, effective ways.…