Blog

9th March 2023

What Insider Threat Actually Looks Like

Who should you be more afraid of compromising your company’s security? 1. A dude wearing a hoodie who’s loitering outside with a laptop. 2. Gary in IT. (Hint: The answer is Gary.) An intense-looking hacker wearing a hoodie and banging out command-line instructions on a laptop makes for good entertainment, but skews our ability to…

2nd March 2023

4 Lessons from the CircleCI Breach

‘Twas the night before Christmas, and all through the business, no security professionals were sleeping. Not even the CISO… The holidays are a happy season for many. For cybersecurity professionals, they have become times of anxiety. Not because of the holidays themselves, but because cyber criminals have learned that launching their attacks while security teams…

16th February 2023

Your Cybersecurity Needs a Fitness Plan

I began skiing when I was 12. I grew up in Florida, but we would come up north occasionally to visit my aunt and uncle and they would take me, my brother, and our cousins out on the slopes. I loved it and I kept skiing for many years after that. But eventually, wear, tear,…

9th February 2023

Why you need a Quantitative Cybersecurity Risk Assessment

You are presented with two arguments about who is going to win the Super Bowl this weekend. Which sounds more persuasive and informative to you? “The Philadelphia Eagles have a medium chance of winning!” “The Kansas City Chiefs have a 57% chance of winning!” Obviously, the second statement is more meaningful than the first. The…

2nd February 2023

SOC 2 Physical Security Requirements

You spend all of your time carefully configuring all of your technology and network to make it as difficult as possible for an attacker to compromise you… only for your penetration tester to walk in your front door and walk out with three laptops and a hard drive filled with your confidential data. This is…

26th January 2023

66 months in – what I’ve learned starting a cybersecurity company.

“They said running a small business was going to be easy.” Said no one. This article is written for anyone running a small business. It is not as easy as some folks think. How do I know? I am the founder and CEO of a 18-person cybersecurity consulting company. Over the last 66 months, I’ve…

19th January 2023

Guide to the SOC 2 Confidentiality Trust Services Criteria

You should have listened to that warning your gut made when you decided to pick Messy Mike’s Money Tracker to track your company’s finances. There had to be some reason it was so affordable, right? There was. Today, when you logged in, all of your financial records were missing. The app looked just like it…

12th January 2023

Take a Pass on LastPass

Almost immediately, I realized that I had waited too long. My driver’s license was due to expire near the end of last month, and by the time I got around to making an appointment to get it taken care of, the time slots at the nearby RMV offices were gone. As a matter of fact,…

5th January 2023

Virtual CISO Use Cases

Virtual CISO Use Case (to be avoided): Wait for a breach, THEN hire one. “It’s not a matter of if they’ll get into a car accident, it’s a matter of when.” This is what my Uncle Jim, an insurance broker, told my parents when I turned 16 and started driving. Sure enough, I rear-ended someone…

28th December 2022

Top Fractional CISO Blogs of 2022

“We share information deliberately. While we keep client specific information confidential, we broadly and openly share learnings from client work. We share internal information openly when it does not impinge on the privacy of employees. We make sure that people have the information they need to perform their job.“– Fractional CISO Fundamental 19: Share Deliberately…

21st December 2022

Threat Intelligence: Worry about the Right Things

Parents think about threat intelligence all the time: “what could hurt our kid?” But what exactly do they worry about? No doubt this changes as children age. There was a great article on NPR where the author of “The Paranoid Parents Guide”1 shared two lists. A list of the top 5 things parents worry about….

15th December 2022

Least privilege is key to good cybersecurity.

Last weekend, Mrs. Black and I were enjoying an all too rare dinner out together. Just the two of us at a local restaurant, while the kids were happily at home in the care of their favorite sitter. Towards the end of dinner, I got up and went to the restroom. Two minutes later, and with…

8th December 2022

What is a cybersecurity compliance audit actually like?

“You’re going to be audited by the IRS.” Is not a phrase most people would want to hear – so it makes sense that the word “audit” carries some negative weight. Being “audited” is something most people would normally prefer to avoid. In the cybersecurity compliance world, “audit” is a common common phrase, and a…

1 2 3 … 20 Next