Blog

2nd February 2023

SOC 2 Physical Security Requirements

You spend all of your time carefully configuring all of your technology and network to make it as difficult as possible for an attacker to compromise you… only for your penetration tester to walk in your front door and walk out with three laptops and a hard drive filled with your confidential data. This is…

26th January 2023

66 months in – what I’ve learned starting a cybersecurity company.

“They said running a small business was going to be easy.” Said no one. This article is written for anyone running a small business. It is not as easy as some folks think. How do I know? I am the founder and CEO of a 18-person cybersecurity consulting company. Over the last 66 months, I’ve…

19th January 2023

Guide to the SOC 2 Confidentiality Trust Services Criteria

You should have listened to that warning your gut made when you decided to pick Messy Mike’s Money Tracker to track your company’s finances. There had to be some reason it was so affordable, right? There was. Today, when you logged in, all of your financial records were missing. The app looked just like it…

12th January 2023

Take a Pass on LastPass

Almost immediately, I realized that I had waited too long. My driver’s license was due to expire near the end of last month, and by the time I got around to making an appointment to get it taken care of, the time slots at the nearby RMV offices were gone. As a matter of fact,…

5th January 2023

Virtual CISO Use Cases

Virtual CISO Use Case (to be avoided): Wait for a breach, THEN hire one. “It’s not a matter of if they’ll get into a car accident, it’s a matter of when.” This is what my Uncle Jim, an insurance broker, told my parents when I turned 16 and started driving. Sure enough, I rear-ended someone…

28th December 2022

Top Fractional CISO Blogs of 2022

“We share information deliberately. While we keep client specific information confidential, we broadly and openly share learnings from client work. We share internal information openly when it does not impinge on the privacy of employees. We make sure that people have the information they need to perform their job.“– Fractional CISO Fundamental 19: Share Deliberately…

21st December 2022

Threat Intelligence: Worry about the Right Things

Parents think about threat intelligence all the time: “what could hurt our kid?” But what exactly do they worry about? No doubt this changes as children age. There was a great article on NPR where the author of “The Paranoid Parents Guide”1 shared two lists. A list of the top 5 things parents worry about….

15th December 2022

Least privilege is key to good cybersecurity.

Last weekend, Mrs. Black and I were enjoying an all too rare dinner out together. Just the two of us at a local restaurant, while the kids were happily at home in the care of their favorite sitter. Towards the end of dinner, I got up and went to the restroom. Two minutes later, and with…

8th December 2022

What is a cybersecurity compliance audit actually like?

“You’re going to be audited by the IRS.” Is not a phrase most people would want to hear – so it makes sense that the word “audit” carries some negative weight. Being “audited” is something most people would normally prefer to avoid. In the cybersecurity compliance world, “audit” is a common common phrase, and a…

1st December 2022

Digital Identity: Not a Conspiracy Theory

Talking about digital identity makes you sound like a conspiracy theorist. The government, banks, health care, and retail companies all have something in common. You. They’ve all collected huge amounts of data about you. Each industry has its specific reasons for collecting this data, but they share a common need to ensure you are who…

22nd November 2022

Don’t trust that flash drive! Cybersecurity risks of removable media.

Thanks to the innocuous nature of removable media, the road to a major cyber attack can be paved with good intentions. George, an employee at AcmeCo, finds a flash drive on the floor of the office building on his way into work, and picks it up. This flash drive occupies his mind as he begins…

17th November 2022

3 takeaways from the FTC’s action against Chegg for lax cybersecurity.

We are in the process of selling our house. We love our home — we have been here for 11 years — but an opportunity presented itself nearby that looks to be an even better fit for the long term. We knew things needed a bit of fixing up before putting the house on the…

10th November 2022

SOC 2 incident response: what’s required for compliance?

For SOC 2, incident response is an absolute must. If you don’t have a well-practiced plan, you’re not compliant, period. Why? To prevent scenarios like this: You get a panicked call from one of your employees at 4 pm on a Friday. “One of our data processing vendors has been hit by a ransomware attack!…

« Previous 1 … 4 5 6 7 8 … 26 Next