Blog

15th September 2022

Cybersecurity is a team sport, so who are the players?

It’s back to school time (parents, try to conceal your understandable excitement). For my 11-year-old son, the best part about going back to school is playing cello in our town’s middle school orchestra, a spot he earned over the summer despite (pardon me while I brag) being a sixth grader in competition with 7th and 8th…

8th September 2022

Open Source Dependencies: Built Like a House of Cards

The world of modern software is built like a house of cards. Software development in the modern age is heavily reliant on open source libraries and tooling. Open source code projects are often built upon layers of dependencies – a broad engineering term for the libraries or collections of code that a larger project reuses….

7th September 2022

Fractional CISO’s Security Scoring Tool

At Fractional CISO, we use a handful of third-party tools to help improve our clients’ cybersecurity posture. One such tool is Black Kite, a cyber risk monitoring and threat intelligence platform. In particular, Black Kite’s scans help us identify vulnerabilities in our clients’ systems and their vendors’ systems. We use this information to prioritize, plan,…

1st September 2022

Cybersecurity Game Theory in Incident Response

A panicked employee walks into your office and tells you that several of your systems have been locked up by ransomware. What happens next? What should you do? What will the attacker do? An example of this happened last year during the Kasaya attack. Malicious actors targeted the remote system management software Kasaya in hopes…

25th August 2022

Communication, not computers, is the key cybersecurity leadership skill.

CFO: You’re asking for a security budget increase of 20% from last year and we’ve already reached our ratio on technology spend. CISO: …but our budget was cut 30% the year before due to other strategic projects and we haven’t addressed some key gaps… CFO: We didn’t have any security issues last year though and…

18th August 2022

Nudge your way to better Cybersecurity

Our local post office parking lot was under construction for many months. I have no idea what they were working on and it would not be notable except… … it used to be super-convenient to mail letters* there. [*Yes, those physical paper things. What can I say, I have a certain nostalgia for an age gone…

11th August 2022

The Makeup of a Great SOC 2 Risk Assessment

Not all risk assessments are created equal. Some are low and others are high. Yeah, that’s really helpful. Right? Risk assessments are so crucial to information security that the American Institute of Certified Public Accountants (AICPA) requires them from every single company seeking SOC 2 compliance. SOC 2 Risk Assessments fall primarily under the Security…

4th August 2022

Browser password managers – flawed security, by design!

This article addresses a very serious and pervasive business data risk, so let’s get right to it: The default password management features available in Chrome, Firefox, and Edge browsers only provide the appearance of secure password storage. In reality, they provide absolutely no meaningful protection for stored user passwords. Business leaders take note: if your…

28th July 2022

Congrats to Kulsoom Matin! 2022 vCISO Cybersecurity Scholarship Winner

Congratulations to Kulsoom Matin of Pakistan on being awarded Fractional CISO’s 2022 vCISO Cybersecurity Scholarship! Kulsoom came to the United States in 2015 to study at the University of Houston. Around this time, she was the victim of a data breach and began to learn about cybersecurity. Now, she is pursuing a Master’s in Cybersecurity…

21st July 2022

Don’t Flip-Flop on Defense-in-Depth!

We just returned from our annual vacation on Cape Cod. It’s always been an ideal place to relax and recharge. This year was no exception, thanks in no small part to seven days of picture-perfect weather. But it wasn’t entirely stress free. That’s because on the very first day, my right flip-flop broke. I know, I know,…

7th July 2022

Applying Mazda’s “Gram Strategy” to Cybersecurity and Risk Management

Imagine being sixteen years old, gassing up your mothers old Chevy Cavalier and seeing a sleek smurf-blue roadster zip past the gas station. Time stops. You immediately fall in love with it. Time starts again, and you disappointedly climb into your mom’s clunker and sullenly drive yourself home. You spend the next twenty years thinking…

30th June 2022

Guide to the SOC 2 Security Trust Services Criteria

Even a choose-your-own-adventure book has a certain structure to it. Sure, you might be making your own way through the book, but there are still plot points, challenges, and decisions the author will include along every path. SOC 2, being the choose-your-own-adventure cybersecurity compliance standard, is similar in this regard. An organization pursuing a SOC…

23rd June 2022

The Purses and Flagpoles of Security Policies

I never knew what a danger soccer moms’ purses were. That is, until I attended my very first professional soccer game at Gillette Stadium. A friend of ours invited a few families to join them to watch the game. Until a few hours before arrival I could not have confidently named the home team. It’s…

« Previous 1 … 5 6 7 8 9 … 25 Next