Attacks and Vulnerabilities

2nd March 2023

4 Lessons from the CircleCI Breach

‘Twas the night before Christmas, and all through the business, no security professionals were sleeping. Not even the CISO… The holidays are a happy season for many. For cybersecurity professionals, they have become times of anxiety. Not because of the holidays themselves, but because cyber criminals have learned that launching their attacks while security teams…

4th August 2022

Browser password managers – flawed security, by design!

This article addresses a very serious and pervasive business data risk, so let’s get right to it: The default password management features available in Chrome, Firefox, and Edge browsers only provide the appearance of secure password storage. In reality, they provide absolutely no meaningful protection for stored user passwords. Business leaders take note: if your…

14th December 2021

Log4Shell Logo

I have been surprised how the Log4Shell vulnerability has not made it in the mainstream press more. This is one of the most serious vulnerabilities I have seen in my career. When I talk to my non-tech friends and family members, they haven’t heard of Log4Shell or Log4j. One of the successes of the Heartbleed…

11th December 2021

Serious vulnerability: Log4J

We sent the following notice to all Fractional CISO clients yesterday. We are sending this notice to all Fractional CISO clients to inform them about an extremely critical zero-day vulnerability that requires immediate attention – right now, not on Monday. This vulnerability is pervasive, Internet-facing, and easily exploitable by anybody with limited hacking experience. What’s…

30th September 2021

4 new and devious phishing techniques with example phishing emails.

Providing example phishing emails is a great way to train employees, especially as new phishing techniques are being developed.

27th May 2021

A 3-Point Ransomware Defense Strategy for Small to Midsize Businesses

Oops, all your organization’s data is encrypted! Could you manage to make a multi-million dollar ransom payment to restore operations? Probably not if you’re a small or midsize business – a small business ransomware attack can be the end of the line. It’s better to have a ransomware defense plan to avoid the situation altogether….

1st April 2021

Public WiFi: A double espresso for you and passwords for the bad guys.

Thanks to the power of public WiFi, it was common for many of us to head out to the nearest coffee shop, order an iced macchiato with an extra shot of espresso, whipped cream, and caramel drizzle, and pop open the work laptop to get stuff done in a cozy, public environment. Well, it was…

19th March 2021

Slack Shared Channel Metadata Exposure

Slack sent us a notice on Thursday, March 18, 2021 that due to a software vulnerability it “unintentionally shared Slack Connect metadata” with partners that we share a Slack channel with. The result was a Slack shared channel metadata exposure. Slack is a messaging platform that we use to communicate internally and externally with some…