Blog

30th December 2021

Top Fractional CISO Blogs of 2021

With 2021 coming to a close and 51 new blog entries in the books, we are going to engage in our now-annual practice of revisiting the top articles we published this year.

22nd December 2021

What does a bad auditor mean for your business?

Cybersecurity compliance evaluations like SOC 2, ISO 27001, and HIPAA might have one set of standards set by one overseeing organization, but the independent auditors who audit companies for these standards can have drastically different approaches. The result? Programs that are compliant being forced to do extra, meaningless work – or worse – companies that…

16th December 2021

One Size Fits Nobody

Once again, basketball season is upon us. With it comes the sound of shoes squeaking, balls bouncing, nets swishing, and rims rattling beneath the force of ferocious dunks. Well… maybe not the dunks, since I’m actually talking about my third-grade daughter’s team, of which I am the coach. This year, the girls are behind where…

14th December 2021

Log4Shell Logo

I have been surprised how the Log4Shell vulnerability has not made it in the mainstream press more. This is one of the most serious vulnerabilities I have seen in my career. When I talk to my non-tech friends and family members, they haven’t heard of Log4Shell or Log4j. One of the successes of the Heartbleed…

11th December 2021

Serious vulnerability: Log4J

We sent the following notice to all Fractional CISO clients yesterday. We are sending this notice to all Fractional CISO clients to inform them about an extremely critical zero-day vulnerability that requires immediate attention – right now, not on Monday. This vulnerability is pervasive, Internet-facing, and easily exploitable by anybody with limited hacking experience. What’s…

9th December 2021

What are the best Google Workspace security settings?

Which of these scenarios sounds scarier: If you’re a Google business, hopefully you picked the second option! While business email compromises are always bad, Google Workspace’s functionality as an online office suite and document storage solution puts a lot more data at risk. Email, file storage, document collaboration, calendar, sites, even video conferencing – if…

23rd November 2021

3 Advanced Incident Response Tabletop Exercise Scenarios

Incident response tabletop exercises are a great way to safely practice your cybersecurity Incident Response plan before a real emergency strikes. Just prepare a few scenarios, and then have your team role play how they would use the plan to guide their response. The simple act of talking through a few incident response tabletop exercise…

18th November 2021

What Your MSP Doesn’t Know, Can Hurt You

Last month, I flew down to Florida with my parents, brother, and our respective wives, to attend my cousin’s wedding. The trip down was uneventful and the wedding was terrific. But as the weekend was coming to a close, it occurred to me that I had not come up with any good stories for my…

11th November 2021

AWS CISO Stephen Schmidt and his “Cybersecurity Airbag” defense tools.

AWS CISO Stephen Schmidt is a man that thousands of modern businesses should be paying attention to, but are likely not. He’s the Chief Information Security Officer of Amazon Web Services (AWS), the platform that untold thousands companies have built their core products on. When your business is so tightly linked to another company’s service,…

4th November 2021

Why you should use a Cloud Backup Service.

A new version of this post can be found here: https://fractionalciso.com/always-follow-the-backup-rule-of-three/ Meet Tim. Tim is the head data security manager at a reasonably sized tech company and is responsible for managing hundreds of gigabytes of data every day. This data includes client analytics, supply chain management information, operational cost, business emails, essentially every piece of…

28th October 2021

Communicate Better with the Organizational Security Maturity Model

Use the Organizational Security Maturity Model as a guide for meaningful discussions with your executive team and Board of Directors. Start with the embodied concepts to paint the bigger picture, then fill in details with the six key talking points to help leadership understand where the organization as a whole is now, and where they need it to be. Use the simplified version to keep maturity concepts fresh as you give the executive team and Board updates.

21st October 2021

Don’t Mess with your DNS!

Plumbing is great when it works happily in the background. When it doesn’t, you better have someone like Kumar on speed dial. The same can be said for DNS (Domain Name System), the directory that tells Internet infrastructure how to route traffic.

14th October 2021

How to create an AWS Sandbox for your business.

When I was a kid, my dad built a sandbox in the backyard for my brother and me to play in. We used it for a lot of things, like devising desert combat strategies for our green army men, and then finding creative ways to sacrifice them to our Return of the Jedi sand pit…

« Previous 1 … 9 10 11 12 13 … 26 Next