Ryan Johnson

Interesting #scam. Adding some details for clarity: 1. Scammer cuts out part of the gift card that contains the actual redemption code, and returns the card to the rack. 2. Innocent victim buys that card. Once payment is made, the card becomes active. 3. Unclear: How does the scammer know about the activation? I assume they try the redemption code every few days. 4. Either way, the person who bought the card is out of the money. According to the FTC, there may be a possibility to get the money back. if a gift card scam happens to you, act fast: Report it to the gift card company. Tell them you were scammed. Give the gift card company the information from your receipt or a copy of the numbers on your gift card. Ask for your money back. Once you report a gift card scam to the gift card company, ask for your money back. If the money was frozen or not downloaded by the scammer, some gift card companies will give the money back. Tell the FTC. Your report makes a difference and helps #stopscams. Link to FTC page in comments #giftcard #scam #cutout

490

42 Comments

There's a site that can tell you if your SSN was leaked from the personal security company Pentester. You must input your first name, last name, year of birth, and what states you've lived in. If your SSN was leaked, the site will present you with a chart showing your address in the record and the last two numbers of your SSN. If you don't find your records associated with your current state or name, try searching for previous states and/or other last names. I tested this tool and found legitimate records listed. https://lnkd.in/gsMkUMXR

1

A recent incident serves as a stark reminder of why we need to be vigilant about who has access to our systems… A former employee of NCS in Singapore was recently sentenced after illegally accessing his ex-employer’s systems and deleting 180 test servers. This act of revenge cost NCS a whopping $678,000. The employee’s access should have been revoked immediately after his termination, but due to an oversight, he retained a login. This enabled him to wreak havoc over several months, ultimately leading to significant financial damage and operational disruption. What can we learn from this? - Revoke access immediately: Ensure that access credentials are deactivated as soon as an employee leaves the company. This should be a standard part of your offboarding process. - Regularly audit access: Conduct periodic reviews of who has access to what. Even current employees should only have access to the information and systems necessary for their role. - Implement stringent controls: Use multi-factor authentication (MFA) where you get a code on another device to prove it’s you. Other security measures add layers of protection. This makes unauthorized access much more difficult. - Monitor and enhance: Keep an eye on your systems and regularly update your security protocols. Stay informed about the latest security practices and adapt as necessary. Remember, a small oversight can lead to huge losses. When did you last review who has access to what? If it’s been more than a few months, it’s time to get to work. My team can help if needed. Send me a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eWFSv9Cw

3

To news organizations looking to siphon more revenue from readers with paywalls: Content paywalls do not automatically lend credence or credibility to the content you are fronting as news. The fair and balanced aspects of your content, along with legitimate research and analysis, accomplish that goal.

3

2 Comments

If you're struggling with compliance and security challenges, CCM might me the game-changer you need. Here's why: 🏆 Rapid Certification: Achieve compliance certifications like SOC 2, CMMC, or NIST CSF in record time – like a FedRAMP High In Process package in just 3 months. 📊 Automated Evidence Collection: Cut audit prep time by up to 60%, saving costs and improving accuracy. Always be audit-ready! 🗺️ Streamlined Compliance: Map a single control across multiple frameworks, eliminating redundant tasks and ensuring a harmonized compliance posture. 🔄 DevSecOps Integration: Embed compliance checks directly into your development pipeline, maintaining security without disrupting workflows. #ContinuousControlsMonitoring #Compliance #Cybersecurity #RiskManagement #RegScale

4

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

As CMMC takes effect, many FSOs are discovering that their workload is growing rapidly. In our ever-connected, digital, and internet-of-things world, the lines between physical security, digital security, cybersecurity, and information security are blurring. Protecting sensitive information now means guarding against both physical and digital threats. FSOs might find themselves needing to understand not just how to secure a door, but also how to safeguard access controls with strong passwords. The modern FSO is becoming a key figure in overall compliance, taking charge of overseeing, developing, maintaining, and enhancing all aspects of security, not just the physical side. Ultimately, it's all about ensuring that national security information, classified data, CUI, and any other sensitive material are truly protected.

1

Are we lying to ourselves? I had a wonderful coffee and conversation with Dana Wolf of YeshID yesterday and our discussion turned to fine-grain controls. Which got me to thinking about why current state security solutions and architectures are so bad at repelling the bad guys. And it has to do with atoms. Atomizing and democratizing the tech stack is our evolutionary curve. We have atomized and virtualized massive parts of the digital estate down to APIs, microservices and many other forms of bits and widgets. If this is doubted - take a look at the horizon. Quantum computing isn’t atomizing - it is sub-atomizing. Literally by definition and design. Code at the photoelectric quantum state level. You know what hasn’t been atomized? Security. The vast majority of security solutions still operate at the coarse-grained level. Authentication? IP blocking? Role and profile? Block/allow? Rules based? Policy based? All are coarse-grained security approaches to an already atomized and fine-grained digital world. Coarse-grained has been proven to be easy to break - and fine-grained is where the bad guys reap all their rewards. So - are we lying to ourselves buying and continuing to leverage coarse-grained security solutions against a fine-grained weaponized enemy?

14

7 Comments

Hiring a CISO is sooooo expensive. You have to: Pay for onboarding with money and time Pay their Salaries Give ESOPs as they're a C-suite hire Build them a team for Security and compliance. a shit ton of other things. No More. We are introducing the Cywreck V-CISO! Imagine getting the exact CISO you asked for, all the qualifications that you need at half the cost. That's what our virtual CISO does. 1 week onboarding, you get an outsourced team for your security and compliance from cywreck and you save them DOLLARS. Reach out to me or book a call with us on our website! #vciso #hireciso #compliance #cybersecurity #ciso #hiringciso

12

A cybersecurity services business unit has more revenue than any pure-play cybersecurity company in the public markets today. Yep, you read that correctly. Accenture reported its FY'24 annual earnings yesterday. Security is a strategic business unit they break out revenue for. Guess how much cybersecurity revenue they had? ... Nine billion dollars. With 23% year-over-year growth. Just incredible. Palo Alto Networks is the only pure-play public company who is even close — currently at $8.03 billion of revenue (TTM). Of course, there is also Microsoft's reported $20 billion of cybersecurity products and services revenue, plus some very large business units in other companies that don't regularly report revenue. But any way you compare it, Accenture has a massive cybersecurity business. Product-focused companies get a lot of the hype, but services companies make it all go. This is exactly why Accenture and other large services firms are critical channel partners for almost every large cybersecurity product company. It's also a good reminder that services are an equally impressive and important part of our industry.

1,517

111 Comments

Want to run a flawless vCISO cadence call? Then follow these 6 steps. One of the core values I have MSPs focus on in their vCISO program is to 𝗮𝗱𝗱 𝘃𝗮𝗹𝘂𝗲 𝘄𝗶𝘁𝗵 𝗲𝘃𝗲𝗿𝘆 𝗶𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝗼𝗻. Want to know what DOESN'T do this? Dull, lifeless review calls that the client dreads showing up to. So how do we turn this back into the client's time, where they come away excited and satisfied? I'm glad you asked 😁 Steal my easy-to-action model that's been tested and proven to add value in literally hundreds of client calls over the years. 1. 𝗥𝗲𝘃𝗶𝗲𝘄 "𝗛𝗼𝘁 𝗦𝘁𝗼𝘃𝗲" 𝗜𝘁𝗲𝗺𝘀 - Identify new or critical issues that need immediate attention, especially questions or concerns the client has voiced via email or other methods. 2. 𝗥𝗶𝘀𝗸 𝗮𝗻𝗱 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝘆 𝗔𝗱𝗷𝘂𝘀𝘁𝗺𝗲𝗻𝘁𝘀 - Assess emerging risks or metrics since the last meeting and prepare to discuss tactical or strategic adjustments to the current roadmap. 3. 𝗧𝗮𝘀𝗸 𝗮𝗻𝗱 𝗣𝗿𝗼𝗷𝗲𝗰𝘁 𝗥𝗲𝘃𝗶𝗲𝘄 - Discuss progress and actions required to keep tasks aligned with strategic goals. 4. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝗔𝗹𝗹 𝗗𝗲𝗰𝗶𝘀𝗶𝗼𝗻𝘀 - Capture decisions, action items, and assignments during the call - always have next steps. Make sure any task has a Resource Committed to a Time for completion (RCT) 5. 𝗣𝗼𝘀𝘁-𝗖𝗮𝗹𝗹 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 - Finalize documentation of the call template and send it to all parties. 6. 𝗙𝗼𝗹𝗹𝗼𝘄-𝗨𝗽 𝗼𝗻 𝗔𝗰𝘁𝗶𝗼𝗻 𝗜𝘁𝗲𝗺𝘀 -Track progress on action items using a system for accountability. Come to the next call having done what you committed to do, and watch trust skyrocket. It's just one of the litany of templates, methods, and workflows you get in the PowerGRYD vCISO System. But don't take my word for it. If you want to see the results, drop a comment below to get access to my cadence call template, and try this with a client or two. Then when you see the difference it makes, come back for the whole system 😎 ------------------------------------------ 👋 Hi there; my name's Jesse. 👇 I help you scale your vCISO program; profitably. https://lnkd.in/gaJ7Chm2 ------------------------------------------

27

15 Comments

A new ICS/OT vulnerability? PATCH NOW! Wait... scratch that... Reverse it. Vulnerability management is VERY different in the ICS/OT world. In the IT world, a new patch comes out and it's off to the races! - We're patching servers. - We're rebooting servers. - We're patching workstations. - We're rebooting workstations. - We're patching everything we can get our hands on. You get the idea. In ICS/OT, just because a new vulnerability is announced, it does not mean we have to patch right away. We might not even have an option to patch a system until the next maintenance window. In six months. Or a year. If ever. When that new ICS/OT vulnerability is announced, we still have to take action though. It's just a different action than in IT. When a new ICS/OT vulnerability is announced: 1. Determine if it affects your environment. This is why having a current asset register is essential. 2. If the vulnerability exists in your environment, perform a risk assessment. Consider questions including, but not limited to: -> Which systems are impacted? -> Where do the impacted systems live? -> Do compensating controls exist to reduce the risk? -> Does the vulnerability put lives/physical safety at risk? -> Could the vulnerability affect the operations of the facility? -> What would be the impact if the vulnerability was exploited? NOTE: When assessing risk, get all of the right people in the room to help make an informed decision. Engineering, operations, maintenance, cyber security, etc. 3. Based on the risk assessment, and the owners risk tolerance: -> Do you need to take action? -> If so, how soon? IT and OT can have MANY similarities. But IT and OT can also be VERY different. Vulnerability management is one of the ways where they are very different. And each requires a different approach to maintain secure, and SAFE, environment. (Repost for your network if you like it ♻️) P.S. Do you work in IT or OT vulnerability management?

12

This Kiteworks article is a good read for cybersecurity professionals who want to learn more about a roadmap for Department of Defense (DoD) contractors to achieve compliance with the Cybersecurity Maturity Model Certification (CMMC) 2.0. The article outlines the steps and strategies contractors need to take to meet the updated CMMC requirements, emphasizing the importance of understanding the new framework and preparing for the certification process. Your Ultimate Guide for CMMC 2.0 Compliance Get the CMMC Roadmap: https://lnkd.in/evfK7SC8 #CMMC #compliance #cybersecurity #blog #NIST

15

Conducting a Post-Incident Review Once the dust has settled, it's time to figure out what went wrong. A post-incident review isn't optional—it's how you identify the weaknesses that led to the breach in the first place. Without it, you're leaving your business vulnerable to the next attack. Ask yourself: how did they get in, what systems failed, and what steps need to change? This isn't just about fixing—it's about preventing future incidents. Are you ready to conduct a thorough post-incident review? Let's make sure your next breach isn't worse. #PostIncidentReview #CyberSecurityAnalysis #LessonsLearned

1

3️⃣ x P's of #CyberSecurity: Passwords, Phishing, and Patching. If you can follow these #BoringBasics you're going to be laughing. At last week's PC Matic Townhall, Corey and I were sharing a refresher on the 3 P's of cybersecurity for #SMBs. > Passwords: use unique passwords for every account. Don't even bother remembering passwords anymore that's so much work. Just use a password manager. Double benefit: autofills all your logins for you & creates unique passwords for every account > Phishing: scam emails are part of our daily lives these days. Criminals are trying to trick you into giving up your credentials and your money. That's the world we live in. Talk about this with your employees so everyone is locked and loaded to #SpotThePhish. We are stronger together 💪 > Patching: Keep your devices up to date. Old software is the weak link that criminals use to install ransomware. This is the easiest of the #BoringBasics. Whenever you see a Windows or MacOS software update, install it 💉 If you're a #SmallBusiness owner, follow the simple three P's of cyber and you won't need to worry about most of the cyber noise out there. #CyberPowered #CyberScore

62

9 Comments

Compliance Doesn’t Equal Security Being compliant means you're secure. I see a lot of organizations flaunting their ISO or SOC 2 certifications like it’s a bulletproof vest. Hackers don’t care if you passed an audit—they care about your vulnerabilities and weak spots. Compliance is just a minimum standard. It’s about checking boxes, not defending against real-world threats. Sure, compliance frameworks are a good start, but they’re not enough. Security is about being proactive, continuously adapting, and having systems in place to stop attacks before they happen. So, if your focus is just on passing audits, you’re missing the bigger picture. Compliance should be the baseline, not the end goal. Let’s focus on building systems that actually protect, not just “look good” on paper. What’s your take? Are we relying too much on compliance? Drop your thoughts in the comments or DM me if you want to chat about building real security strategies. #Cybersecurity #Compliance #CxO #SecurityLeadership #RiskManagement

2