Think your network is locked down? Think again. In this episode of Cyberside Chats, we’re joined by Tom Pohl, LMG Security’s head of penetration testing, whose team routinely gains domain admin access in over 90% of their engagements. How do they do it—and more importantly, how can you stop real attackers from doing the same? 

Tom shares the most common weak points his team exploits, from insecure default Active Directory settings to overlooked misconfigurations that persist in even the most mature environments. We’ll break down how features like SMB signing, legacy broadcast protocols, and other out-of-the-box settings designed for ease, not security, can quietly open the door for attackers—and what security leaders can do today to shut those doors for good. 

Whether you're preparing for your next pentest or hardening your infrastructure against advanced threats, this is a must-watch for CISOs, IT leaders, and anyone responsible for securing Windows networks. 

Takeaways: 

References: 

“Critical Windows Server 2025 DMSA Vulnerability Exposes Enterprises to Domain Compromise” (The Hacker News) 

https://thehackernews.com/2025/05/critical-windows-server-2025-dmsa.html 

“Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies” (CISA Alert) 

https://www.cisa.gov/news-events/alerts/2025/05/21/russian-gru-cyber-actors-targeting-western-logistics-entities-and-tech-companies 

LMG Security – Penetration Testing Services (Identify weaknesses before attackers do) 

https://www.lmgsecurity.com/services/penetration-testing/ 

What happens to your digital world when you die? In this episode of Cyberside Chats, LMG Security’s Tom Pohl joins the conversation to discuss the often-overlooked cybersecurity and privacy implications of death. From encrypted files and password managers to social media and device access, we’ll explore how to ensure your loved ones can navigate your digital legacy—without needing a password-cracking expert. Learn practical strategies for secure preparation, policy design, and real-world implementation from a security professional’s perspective. 

Takeaways 

1) Take a Digital Inventory of Your Assets 

2) Implement Emergency Access Protocols in Password Managers 

3) Establish a Digital Executor 

4) Prepare Recovery Access for Critical Devices 

5) Create a Plan for Your Online Presence 

6) At Work, Develop Internal Organizational Policies 

References: 

How to Add a Legacy Contact for Your Apple Account: https://support.apple.com/en-us/102631 

Get To Know Your Emergency Kit: https://support.1password.com/emergency-kit/  

Wayne Crowder’s LinkedIn Page: https://www.linkedin.com/in/wcrowder 

Digital Afterlife Planning Checklist: https://www.lmgsecurity.com/resources/digital-afterlife-planning-checklist/ 

#Cybersecurity #Cyberaware #Cyber #DigitalPlanning

In this explosive episode of Cyberside Chats, we dive into one of the most shocking developments in ransomware history—LockBit got hacked. Join us as we unpack the breach of one of the world’s most notorious ransomware-as-a-service gangs. We explore what was leaked, why it matters, and how this leak compares to past takedowns like Conti. You'll also get the latest insights into the 2025 ransomware landscape, from victim stats to best practices for defending your organization. Whether you’re an incident responder or just love cyber drama, this episode delivers. 

Takeaways 

 Don't forget to like and subscribe for more great cybersecurity content!

Resources 

 #LMGsecurity #CybersideChats #Ransomware #LockBit #Databreach #IT #CISO #Cyberaware #Infosec #ITsecurity

Cybercriminals are exploiting outdated routers to build massive proxy networks that hide malware operations, fraud, and credential theft—right under the radar of enterprise defenses. In this episode, Sherri and Matt unpack the FBI’s May 2025 alert, the role of TheMoon malware, and how the Faceless proxy service industrializes anonymity for hire. Learn how these botnets work, why they matter for your enterprise, and what to do next. 

Takeaways 

#CybersideChats #Cybersecurity #Tech #Cyber #CyberAware #CISO #CIO #FBIalert #FBIwarning #Malware #Router

AI isn’t just revolutionizing business—it’s reshaping the threat landscape. Cybercriminals are now weaponizing AI to launch faster, more convincing, and more scalable attacks. From deepfake video scams to LLM-guided exploit development, the new wave of AI-driven cybercrime is already here. 

In this engaging and eye-opening session, Sherri and Matt share how hackers are using AI tools in the wild—often with frightening success. You'll also hear about original research in which we obtained generative AI tools from underground markets, including WormGPT, and tested their ability to identify vulnerabilities and create working exploits. 

You’ll walk away with practical, field-tested defense strategies your team can implement immediately. 

Takeaways: 

References: 

#ai #aisecurity #aihacks #aihacking #aihack #wormgpt #cybercrime #cyberthreats #ciso #itsecurity 

Quantum computing is advancing rapidly—and with it, the potential to break today’s most widely used encryption standards. In this episode of Cyberside Chats, Sherri and Matt cut through the hype to explore the real-world cybersecurity implications of quantum technology. From the looming threat to encryption to the emerging field of post-quantum cryptography, our experts will explain what security pros and IT teams need to know now. You'll walk away with a clear understanding of the risks, timelines, and concrete steps your organization can take today to stay ahead of the curve. 

Takeaways & How to Prepare for Quantum Computing: 

References: 

“NIST Releases First 3 Finalized Post-Quantum Encryption Standards” 

https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards 

“You need to prepare for post-quantum cryptography now. Here’s why” 

https://www.scworld.com/resource/you-need-to-prepare-for-post-quantum-cryptography-now-heres-why 

#cyptography #quantum #quantumcomputing #quantumcomputers #cybersecurity #ciso #securityawareness #cyberaware #cyberawareness

CISA, the U.S. government’s lead cyber defense agency, just took a major financial hit—and the fallout could affect everyone. From layoffs and ISAC cuts to a near-shutdown of the CVE program, these changes weaken critical infrastructure for cyber defense. In this episode of Cyberside Chats, we unpack what’s been cut, how it impacts proactive services like free risk assessments and scanning, and what your organization should do to stay ahead. 

Takeaways: 

Resources: 

MITRE CVE Program - The central hub for CVE IDs, program background, and tracking published vulnerabilities. 

The CVE Foundation: https://www.thecvefoundation.org/home  

LMG Security Vulnerability Scanning: https://www.lmgsecurity.com/services/testing/vulnerability-scans 

#cybersecurity #cyber #CVE #riskmanagement #infosec #ciso #security

When a company built on sensitive data collapses, what happens to the information it collected? In this episode of Cyberside Chats, we examine 23andMe’s data breach, its March 2025 bankruptcy, and the uncomfortable parallels with the 2009 Flyclear shutdown. What happens to biometric or genetic data when a vendor goes under? What protections failed—and what should corporate security leaders do differently? 

Drawing from past and present breaches, we offer a roadmap for corporate resilience. Learn practical steps for protecting your data when your vendors can’t protect themselves. 

#Cybersecurity #Databreach #23andMe #CISO #IT #ITsecurity #infosec #DFIR #Privacy #RiskManagement

Unauthorized communication platforms—aka shadow channels—are increasingly used within enterprise and government environments, as demonstrated by the recent Signal scandal. In this week's episode of Cyberside Chats, special guest Karen Sprenger, COO at LMG Security, joins Matt Durrin to delve into the critical issue of shadow IT, focusing on recent controversies involving unauthorized communication tools like Signal and Gmail in sensitive governmental contexts. Matt and Karen discuss the risks associated with consumer-grade apps in enterprise environments, the need to balance usability and security, and how organizations can better manage their communication tools to mitigate these risks.

This episode will cover:

What platforms like Signal offer—and their limitations in enterprise settings.

Why users bypass official channels and how it leads to compliance failures.

Real-world implications from recent incidents, including U.S. officials using unsecured communication tools.

The broader shadow IT landscape and why it’s a pressing issue for security leaders.

Join us in exploring the headlines and takeaways that can help organizations avoid similar pitfalls!

#Cybersecurity #ShadowChannels #CybersideChats #UnauthorizedPlatforms #Signal #DataLeaks #Compliance #Infosec #ShadowIT #IT #Cyber #Cyberaware ETech #CISO

Governments are pushing for encryption backdoors—but at what cost? In this episode of Cyberside Chats, we break down Apple’s fight against the UK’s demands, the global backlash, and what it means for cybersecurity professionals. Are backdoors a necessary tool for law enforcement, or do they open the floodgates for cybercriminals? Join us as we explore real-world risks, historical backdoor failures, and what IT leaders should watch for in evolving encryption policies.

Stay informed about how these developments affect corporate data privacy and the evolving landscape of cybersecurity legislation. A must-watch for anyone interested in understanding the complex interplay between technology, privacy, and government control.

#cyberthreats #encryptedcommunications #Apple #encryption #encryptionbackdoors #cybersecurity