Blog

3rd March 2022

Are you tracking root logins in AWS?

The root account in AWS is the master key to all of your organization’s cloud-hosted systems, activities, and services. If an attacker gets in: game over. It must be well-protected. A properly configured AWS setup will require very infrequent root logins. Most responsibilities should be doled out to other users with fewer permissions. The root…

24th February 2022

E-commerce Fraud and how your Business can Avoid it

Last week, your business’s e-commerce sales were much higher than forecasted and it seemed that orders would continue to fly in – that is until you received a notification from customer support informing you that there’s been an influx of customer complaints and credit card chargebacks. What could have gone wrong? Was there an issue…

17th February 2022

The Asset of Asset Management

Can you guess what is the most feared day in the Black Family household? If you said, “Any day in which Rob needs to shovel two feet of snow,” we are going to give you partial credit. But no, it’s actually … “library book due day!” We visit our local library frequently. Most times, my…

10th February 2022

Doing the Legwork Once, for Everyone; Laika’s Vendor Database

Disclosure: After we published the Comparison of SOC 2 Compliance Software Vendors white paper, Laika approached us and asked if we’d like to collaborate with them on content creation. They gave us a demo of their program. While we did not discover them in-time for last year’s white paper, we are considering including them in…

3rd February 2022

Security’s Chicken and Egg: Operationalizing the Security Maturity Model

It’s a classic case of the chicken and the egg: How do I justify the cost of security tooling when I don’t have a security program? How do I measure my security program if I don’t have security tooling? The Organizational Security Maturity Model (OSMM) was exactly what I needed to communicate information security to…

27th January 2022

Software Composition Analysis: Use it to Clean Out Your Old Code!

Meet Dave, the new CTO at WidgetCo. Dave is having a very bad start to his day, because his company does not do Software Composition Analysis (SCA). Yesterday, Dave asked one of his developers to investigate WidgetCo’s exposure to the very serious “log4shell” vulnerability, and he just came back this morning with this “good news”:…

20th January 2022

How Resilient is Your Business?

Up until about 10 years ago, I played a lot of basketball — three times a week, sometimes more. One day, something went very, very wrong. I don’t know what happened, but I more or less had to drag my right leg off the court at the end of the game. Happily, within just a…

13th January 2022

B2B Customers want cybersecurity compliance: MASV’s TPN Story.

Cybersecurity doesn’t have to be a drag on business, it can be an accelerator that helps companies better serve their customers. MASV (pronounced Massive) is an api-based large file transferring SaaS company that recently completed a unique cybersecurity compliance assessment to help enable its growth. MASV specializes in transferring the massive files that raw 2K,…

6th January 2022

54 months in: what I’ve learned starting a cybersecurity company.

This article is written as advice for aspiring Virtual CISOs (vCISO) – but it will hopefully be relatable and helpful to other small and midsize business leaders. I am long overdue in writing this article (this is the fourth part of a series). I haven’t done one of these in 2 years. In that time…

30th December 2021

Top Fractional CISO Blogs of 2021

With 2021 coming to a close and 51 new blog entries in the books, we are going to engage in our now-annual practice of revisiting the top articles we published this year.

22nd December 2021

What does a bad auditor mean for your business?

Cybersecurity compliance evaluations like SOC 2, ISO 27001, and HIPAA might have one set of standards set by one overseeing organization, but the independent auditors who audit companies for these standards can have drastically different approaches. The result? Programs that are compliant being forced to do extra, meaningless work – or worse – companies that…

16th December 2021

One Size Fits Nobody

Once again, basketball season is upon us. With it comes the sound of shoes squeaking, balls bouncing, nets swishing, and rims rattling beneath the force of ferocious dunks. Well… maybe not the dunks, since I’m actually talking about my third-grade daughter’s team, of which I am the coach. This year, the girls are behind where…

14th December 2021

Log4Shell Logo

I have been surprised how the Log4Shell vulnerability has not made it in the mainstream press more. This is one of the most serious vulnerabilities I have seen in my career. When I talk to my non-tech friends and family members, they haven’t heard of Log4Shell or Log4j. One of the successes of the Heartbleed…

« Previous 1 … 3 4 5 6 7 … 20 Next