Blog

15th June 2023

What Pokémon Cards can teach us about Cybersecurity

For the second weekend in a row, I am sitting near lots of people playing Pokémon. That’s correct. Pokémon, the Japanese card game launched in 1996 and, as my 12-year-old son would happily tell you, a game that is still going strong three decades later. So much so, in fact, that we are here at…

8th June 2023

CMMC Compliance Explained: Protecting Sensitive U.S. Government Information

For most businesses, cyber attacks threaten their employees, customers, and their bottom line. For contractors to the United States Government, cyber attacks threaten national security. In 2015, attackers breached KeyPoint Government Solutions, granting them the credentials needed to access and exfiltrate personally identifiable information of 4.2 million current and former government clearance holders from the…

25th May 2023

Adopting a Security-first SDLC Approach

He just wanted a job. Or so said a self-described penetration tester who compromised the hosting platform Packagist to replace abandoned PHP modules with ones he controlled. He didn’t deploy any malicious code, just a note that he was looking for a job. His compromise could have pushed malicious code to the over 500 million…

18th May 2023

Cybersecurity Comes With a Price

Thump, Thump, Clang! Uh oh, there was clearly something wrong with the car. So I took it to the dealer to have a look. They found a bunch of typical stuff in need of attention – brake pads, tires, etc. But they also discovered a problem with the subframe; the right rear trailing arm had…

11th May 2023

ISO 27001 ISMS Requirements

You’ve heard its name in the breeze and in hushed whispers. A certification to rival SOC 2, HIPAA, perhaps even FedRAMP. Your sales team wants it, your customers want you to have it. That’s right! All the way from Geneva, Switzerland, it’s ISO 27001! ISO 27001 is the cool kid of the cyber security certifications…

9th May 2023

Fractional CISO Named one of Inc. Magazine’s Best Workplaces for 2023

Fractional CISO has been named to Inc. magazine’s annual Best Workplaces list. Featured in the May/June 2023 issue, which hits newsstands on May 16, 2023, and prominently featured on Inc.com, the list is the result of a comprehensive measurement of American companies that have excelled in creating exceptional workplaces and company culture, whether operating in…

4th May 2023

Do you need a cyber range in your security program?

Shockingly, organizations don’t tend to enjoy having their environments breached even by people who have the best of intentions. Take high-school student Bill Demirkapi, who identified a number of issues with Blackboard and Follett’s edtech systems. After failing to be taken seriously by the education companies, he used his ill-gotten access to send a push…

27th April 2023

Internal Audits – Keep your Cybersecurity Plates Spinning!

Plate spinning is a balancing act! While it’s hard to get a single plate started, the real difficulty is keeping them all going at once. You have to regularly check-in on the plates you started earlier – or else disaster! A good cybersecurity program will have a mix of controls, some are automated, set in…

20th April 2023

Are you Measuring Continuing Risk?

Regular readers may remember that we bought a new house last year. You’ll be pleased to learn that as recommended, I ran a short-term (48-hour) radon test in the basement. Radon, in case you missed that day in middle school science class, is a colorless, odorless, tasteless, and radioactive gas – a health hazard. And…

13th April 2023

So your company needs a cybersecurity program…

Building a cybersecurity program is a challenging and time-consuming project, especially if you have a workload full of engineering or IT responsibilities. Of course, it’s even more time-consuming if you don’t already have the cybersecurity knowledge needed to just start working on it. This is a project that many companies hire new, specialized full-time employees or…

6th April 2023

SOC 2 Cloud Security Requirements

Carefully secure your cloud environment – or risk ending up on prospective customers’ No Fly Lists! The cloud has been a boon for businesses, giving many organizations access to convenient, scalable, and cost-effective computing power – without the hassle of building and maintaining an on-site data center! The cloud has also been a boon for…

30th March 2023

Personally Identifiable Information Guide: It’s not personal, it’s business!

“It’s not personal…it’s just business.” I had just received notice of yet another data breach involving my “Personally Identifiable Information” or PII. From the perspective of the big company, you were just one of millions whose data was lost. From my perspective, it felt personal. On the other side of the coin is my concern…

23rd March 2023

3 Lessons Cybersecurity Pros can Learn from Other Careers

Sometimes, it only takes one question to change your life forever. “Why don’t you try cybersecurity instead?” My path towards my cybersecurity career started about 12 years ago. I was at a college orientation day when, after finding out that my major was computer science, one of the advisors approached me and asked me that. …

« Previous 1 2 3 4 … 22 Next