Apple just released iOS 14.4, with absolutely essential security updates. Although we rarely use this blog as a method of announcing patches and releases from specific vendors, the iOS security vulnerabilities in Apple's recent release are so essential that we'll break with tradition. We'll break down the three key points in Apple's release notes for you below.
If there is one thing we've learned about small business cybersecurity it's that there are a great many operators that are afraid to ask tough questions about cybersecurity... because they are worried what the answers might be. We specialize (tactfully, of course) in helping organizations raise and think through those tough questions -- and come out the other end safer and happier. Today we'll take on the issue of Remote Work, asking four of the tough questions that deserve to be asked. And giving you, our reader, a ray of hope that there are reasonable ways to resolve any cybersecurity loose ends made apparent by the question. Here goes:
Many companies that have "gone remote" have decided to keep some small physical office for occasional team gatherings, customer visits, and regulatory and compliance purposes. However, that has often involved moving from a pre-existing office (often a spacious one) to a more compact one that fits the new normal. A popular request we've received during those transitions is for a small business network setup checklist summarizing the key things that are the largest information security factors in getting a new office network set up safely. Here's our take on that.
Stating the obvious: over the past year, we've come to meet many people who now WFH (work from home). And, many of them rely on Xfinity router security to keep them safe. It's long overdue that we talk about that in specific terms, about what to expect -- and what not to expect -- if that description matches your situation. Equally important, it might describe many employees in your organization -- probably even employees that handle sensitive company information regularly.
For this particular post, we're going to focus mostly on malicious traffic filtering, although we have much more to say about Xfinity router security and WFH threats in future posts.
Many small businesses – especially those with a web-based product or service – choose to use an outsourced Data Protection Officer to fulfill their GDPR obligations. These same SMBs are often the least inclined to outsource anything, but yet they happily choose to outsource their Data Protection Officer function. Why?
Does your company handle Sensitive But Unclassified (SBU) information in your role as a contractor of the IRS? If you do (and in some cases, even if you don’t), you’ve got IRS Cybersecurity Standards to keep an eye on. Evaluating your current approach to complying with IRS Cybersecurity Standards is a deeper topic than we can cover in a single article, but here we’ll focus on some initial steps you can take (if you haven’t already) to handle some of your most essential cybersecurity obligations.
Many small businesses end up on the receiving end of highly nuanced security and regulatory questions from clients and partners, with little in the way of internal expertise or resources to find their way to acceptable answers. One way that savvy small businesses prevail, is to know the language of "big company" compliance. That way, when a question arises -- perhaps one about NIST Control Families -- the small business is prepared to give a contextually relevant answer about controls or compensating controls.
Many small businesses decide that they aren't ready to full-time IT professionals, but still realize that they need professional help to manage their IT and IT Security needs. One click deeper into that research small businesses often end up asking themselves what the difference is between MSP vs MSSP. If you are in that very spot, you've come to the right place -- in this post we'll discuss the difference between those two types of service providers.
As we help companies in regulated industries with their cybrersecurity obligations, we try to be a resource for others that are at a more exploratory phase in their journey towards compliance. One particularly misunderstood regulatory obligation that many financial institutions face is the FTC Safeguards Rule. That rule is not misunderstood by 10,000-person financial institutions, and probably not misunderstood by 1,000-person financial instituations, given the resources and expertise that they are able to leverage in their compliance efforts. But our clients tend to be the type of organizations that have several dozen to a few hundred employees, and at that organization size, very few have the resources to have dedicated on-staff cybersecurity professionals studying every nuanced regulatory obligation. And that's where we step in.
There's something that doesn't feel right about most small business MSSP relationships. MSSPs, for those that aren't familiar with the term, are managed security service providers.
The origin of many of these engagements is fine and reasonable. When a small business operator knows that they should be doing more on the infosec/cybersecurity front, but doesn't want to hire a CISO or other security specialists, engaging an MSSP seems like a logical step. But, what happens next, is "too much" on many dimensions. Here's our perspective.
