Blog

17th March 2022

Don’t be an Attacker’s First Option

Longtime readers of this blog (thank you!) know that for the past several years, I have been coaching the basketball teams of both of my children. When the kids were really little, it was mostly about teaching fundamentals and getting them comfortable with the rules of the game. However, now that my son is playing…

10th March 2022

Gmail vs Outlook for Business Email Security

Gmail vs Outlook We recently had this exchange regarding email security with a client: Client (Microsoft user): We got acquired and now our parent company wants us to move from Microsoft Office 365 to Google Workspace. vCISO and me: Oof, that sounds like a lot of work! But frankly, we’re a little relieved to hear…

3rd March 2022

Are you tracking root logins in AWS?

The root account in AWS is the master key to all of your organization’s cloud-hosted systems, activities, and services. If an attacker gets in: game over. It must be well-protected. A properly configured AWS setup will require very infrequent root logins. Most responsibilities should be doled out to other users with fewer permissions. The root…

24th February 2022

E-commerce Fraud and how your Business can Avoid it

Last week, your business’s e-commerce sales were much higher than forecasted and it seemed that orders would continue to fly in – that is until you received a notification from customer support informing you that there’s been an influx of customer complaints and credit card chargebacks. What could have gone wrong? Was there an issue…

17th February 2022

The Asset of Asset Management

Can you guess what is the most feared day in the Black Family household? If you said, “Any day in which Rob needs to shovel two feet of snow,” we are going to give you partial credit. But no, it’s actually … “library book due day!” We visit our local library frequently. Most times, my…

10th February 2022

Doing the Legwork Once, for Everyone; Thoropass’s Vendor Database

Note: Thoropass was formerly known as Laika. We have updated their name in the content to reflect their new branding, but their old branding is still reflected in the screenshots of their software. Disclosure: After we published the Comparison of SOC 2 Compliance Software Vendors white paper, Thoropass approached us and asked if we’d like…

3rd February 2022

Security’s Chicken and Egg: Operationalizing the Security Maturity Model

It’s a classic case of the chicken and the egg: How do I justify the cost of security tooling when I don’t have a security program? How do I measure my security program if I don’t have security tooling? The Organizational Security Maturity Model (OSMM) was exactly what I needed to communicate information security to…

27th January 2022

Software Composition Analysis: Use it to Clean Out Your Old Code!

Meet Dave, the new CTO at WidgetCo. Dave is having a very bad start to his day, because his company does not do Software Composition Analysis (SCA). Yesterday, Dave asked one of his developers to investigate WidgetCo’s exposure to the very serious “log4shell” vulnerability, and he just came back this morning with this “good news”:…

20th January 2022

How Resilient is Your Business?

Up until about 10 years ago, I played a lot of basketball — three times a week, sometimes more. One day, something went very, very wrong. I don’t know what happened, but I more or less had to drag my right leg off the court at the end of the game. Happily, within just a…

13th January 2022

B2B Customers want cybersecurity compliance: MASV’s TPN Story.

Cybersecurity doesn’t have to be a drag on business, it can be an accelerator that helps companies better serve their customers. MASV (pronounced Massive) is an api-based large file transferring SaaS company that recently completed a unique cybersecurity compliance assessment to help enable its growth. MASV specializes in transferring the massive files that raw 2K,…

6th January 2022

54 months in: what I’ve learned starting a cybersecurity company.

This article is written as advice for aspiring Virtual CISOs (vCISO) – but it will hopefully be relatable and helpful to other small and midsize business leaders. I am long overdue in writing this article (this is the fourth part of a series). I haven’t done one of these in 2 years. In that time…

30th December 2021

Top Fractional CISO Blogs of 2021

With 2021 coming to a close and 51 new blog entries in the books, we are going to engage in our now-annual practice of revisiting the top articles we published this year.

22nd December 2021

What does a bad auditor mean for your business?

Cybersecurity compliance evaluations like SOC 2, ISO 27001, and HIPAA might have one set of standards set by one overseeing organization, but the independent auditors who audit companies for these standards can have drastically different approaches. The result? Programs that are compliant being forced to do extra, meaningless work – or worse – companies that…

« Previous 1 … 8 9 10 11 12 … 26 Next