Blog

Understanding actual cyber incidents that others have experienced can help businesses identify where they may also be at risk.  Each of these scenarios is an actual incident with identifiable details removed. Unauthorized access risk:  Suspicious email activity was...

The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning for Managed Security Providers (MSPs) and Cloud Security Providers (CSPs) that they were at high risk of cyber attacks.  Why the focus on MSPs and CSPs?  Gaining access to these types of...

Is the motivation behind these faceless attacks simply greed?  Talos Intelligence Group interviewed a hacker referred to as "Aleks", a university-educated Russian male who says he taught himself cybersecurity skills to find new vulnerabilities and gain recognition....

The Digital Identity and Authentication Council of Canada (DIACC) uses the Pan-Canadian Trust Framework (PCTF) to establish guidelines for securing data and protecting the rights of Canadian citizens by controlling and notifying citizens of how the data is used. The...

What is the right amount to spend on cybersecurity?  Gartner reports average spend of 5-8%, but a CIO survey showed closer to 15% of the IT budget with almost a quarter of the respondents allocating more than 20% of their IT budget to securing their data. Now that...

As cybercrime continues to increase, master agents are expanding their services to help protect their customers from losses related to cyber incidents. Telarus recently added Foresite's cybersecurity testing, compliance assessments, audits and consulting, and SOCaaS...

Executive involvement is a critical component to any organization's cybersecurity. Why?  The IT department may not have all of the knowledge about what data could have a critical impact on the business if it was lost or exposed, IT can recommend security controls, but...

We keep hearing about quantum computing and how it is going to change cybersecurity as we know it, but what is it? Today’s computing is made up of binary bits either 0 or 1, therefore if we ask a computer to guess a number 0-9 it will try 0000, then 0001, 0010,0100,...

A question we have been hearing a lot lately is "what is the government doing to protect business from cyber threats", after all, cyber attacks are often coming from other countries and have been compared to another form of warfare or terrorism. Here in the U.S., the...

Priorities have shifted a bit as COVID drastically changed the way work is being done for so many organizations.  Now that it's become clear that it will not be as short-term a change as we first thought, how does this impact cybersecurity?  Based on our insights and...

The time had come for a contract renewal with one of our Managed Security Services clients, and we started the conversation with a look back at what we have accomplished together since 2015 when the relationship began. At that time, the main focus was on replacing...

Payment Card Industry Data Security Standard (PCI DSS) 4.0 is on the horizon. More details are expected late 2020 with the requirements to be in use in mid-2021. There have been a few releases from the PCI Council on what to expect in the new version of the digital...

The technologies that you have invested in can provide even more value if you are able to analyze the log data effectively.  Here are 5 key tips: Know which logs to monitor and which not to monitor.  With the average infrastructure generating millions of log events,...

Government compliance standards can be confusing. Making matters worse, many of them overlap, and organizations aren’t certain which standards apply to them. Even if your organization does not currently operate in the public sector, it is important to understand the...

When you think about information technology implementation and support, the optimal solution is often the combination of internal resource(s) who know the business, the culture and the current technologies and controls and an outside resource who specializes in the...

Organizations sometimes ignore breach notifications because of a loophole in virtually all privacy regulations – they do not address third-party notifications, so companies feel free to ignore them. Whether deliberate or a casualty of the notification overload...

One of the latest approaches to client server computing is going ‘serverless" - a move from ‘DevOps’ to ‘NoOps’. In serverless computing, the developers use code to simply create instances.  Serverless computing is a cloud computing execution model in which the cloud...

The Managed Security Service Provider (MSSP) and Security Information and Event Management (SIEM) space has a lot more players than it used to, and it leads to confusion, starting with "What are the differences between MSSP and SIEM"?  "How do you know which is the...

The recent pandemic has left state and local governments with budget shortfalls as cyber threats continue to rise, leaving state asking the federal government for funding to help them protect their data. A coalition of Governors, Comptrollers, CIOs and Emergency...

COVID-19 has changed our world in many ways, and the Wall Street Journal reports that due to the heightened security risk from the increased remote workforce, commercial insurers are taking a closer look at their policyholders and new applicants for cyber coverage....

The difference in how well a SOC 2 organization measures up is in the details. CPA firms who audit for SOC 2 compliance use exceptions and opinions, so it's important to understand how these apply. Exceptions Audit exceptions are simply deviations from the expected...

A reported by Ponemon on The Economics of Security Operations Centers: What Is the True Cost for Effective Results" included a number of key findings to consider if you are looking at setting up a SOC, reviewing the value of your current SOC or considering outsourcing...

A ransomware attack has hit a prominent NYC law firm with a client list that includes top celebrities, musicians, sports stars and media companies.  The attackers are demanding an undisclosed ransom or they will begin leaking data in a phased approach, putting the...

If your business suffered a fire, who would you want to call first, your commercial insurer to file a claim or the fire department to come put out the flames?  When a cyber incident occurs, the same thinking should apply, but it is being complicated by organizations...

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations of cyberattacks. They’re displayed in matrices that are arranged by attack stages, from initial system access to data theft or machine...

Cyberattacks that focus on schools are becoming more frequent. Why? Schools are considered an easy target as lack of funding for proactive cybersecurity means that the IT team is woefully outgunned and often already overwhelmed with providing the day-to-day support...

Ideally you would already have classified your data and be aligned with a cybersecurity or compliance framework to be able to effectively classify the severity level of various types of incidents.  This quick reference model can help with communication and next steps...

Should you do your own cybersecurity monitoring?  It's a fair question. You may already be paying for IT staff and many tools exist to collect logs. There are important considerations when you make this decision. Let's start with your staff.  If they are like most IT...

Change Management is really risk management. Change management is viewed as a set of rigid standards and processes, but really change management should be an enabler of change and not an obstacle. The point of change management is to ensure that any type of change is...

The "Stop Hacks and Improve Electronic Data Security" or SHIELD Act signed by New York Governor Andrew Cuomo is effective as of 3/21/20, and will apply to you if you own or license provate information on New York residents. What are the requirements?  Simply put, you...

“93% of companies currently using an MSP would consider moving to a new provider if they offered the right cyber security solution. Equip your business with cyber protection services that defend against ransomware and other data loss threats to protect customers,...