Risk Assessment and Management

11th August 2022

The Makeup of a Great SOC 2 Risk Assessment

Not all risk assessments are created equal. Some are low and others are high. Yeah, that’s really helpful. Right? Risk assessments are so crucial to information security that the American Institute of Certified Public Accountants (AICPA) requires them from every single company seeking SOC 2 compliance. SOC 2 Risk Assessments fall primarily under the Security…

15th July 2021

Are You Taking on More Risk Than Necessary?

What a bakery stuck in the 1980s can tell us about approaching cybersecurity risk in the 2020s.

14th January 2021

Human Root of Trust

The Human Root of Trust is composed of the key pieces that allow someone to confidently identify a human on the Internet.

16th July 2020

COVID and Cyber Hygiene: Not That Different

“We are doing a good job with social distancing. We stay inside a bubble.” I’ve heard this kind of thing from many friends and neighbors recently regarding their COVID behavior. But I’m not exactly buying it. For many, the “bubble” — the small group of close friends and relatives we have each chosen to interact with freely…

21st May 2020

How Secure Are Your Employees’ Home Networks?

Everyone: “Rob, why don’t you deposit checks from your phone?” Me, Pre-Pandemic: “Use the app on my phone? Are you crazy? The bank is right around the corner. It’s so easy to deposit checks there. If my phone were stolen, the attacker would have a leg up on getting my banking information. I feel safer at the bank.”…

6th November 2019

3 Tips to Make Your Vulnerability Report Pop

Have you ever been the victim, I mean, read a vulnerability report? It looks like the world is about to end with all of the red tens and lots of numbers all over the place. Technical humans trying to make sense of the information mumble things like, “I guess we have to patch” or “um,…

13th March 2019

Pen Test. Do I need one?

“Yes, but…” That is the right answer 95% of the time. Almost every organization needs a penetration test or pen test. Organizations with mature security programs don’t need to ask the question. They already know the answer based on their program and plan. Organizations that are asking that question are operating from the right mindset….

8th June 2018

Cybersecurity Risk Assessment – A Better Way

What do cybersecurity pros mean when they talk about a “high vulnerability” or “high risk?” – if you’ve ever scratched your head listening to someone present a cybersecurity risk assessment, you’re not alone. Many of us have these questions about risk: What does a high vulnerability mean to a business? How do we rank cybersecurity…