Signal vs. Noise - The Pulse

This week on the Signal vs. Noise cybersecurity podcast: hackers hit supermarket freezers for a second time, after the equipment maker told its Dutch customers to take them off the internet.

Most acted.

A small number did not.

So if a warning like that went out about your equipment, whose inbox would it land in?

Mike Faas's take, why France's cyber agency brings up your insurance contract, and what to do this week, even if you don't own a freezer.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: what happens when a vendor you connected years ago gets breached.

It looks like a vendor problem. It's really an identity problem, a data problem and a readiness problem, and the moment you know, every notification clock starts at once: your customer contracts, your cyber insurance, and your state's breach law.

At a bigger company those clocks belong to four different people.

At a founder-led company, every clock lands on one desk.

Adapted from Mike Faas's talk at Triangle InfoSeCon, with the three things to put on one page this week.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: JPMorgan's CFO said on the bank's earnings call that if customers give their credentials to an AI agent and it does something they don't want, that's on them.

The CEO called it a liability transfer.

Days later, reporting relayed from Axios said some of the biggest US banks are blocking or restricting AI agents that log in with a customer's own password. To the bank, an agent with your password is you.

This episode translates what that means for a company your size, why read-only access is the safe lane, and the one rule and two questions to put in place this week.

Five minutes, hosted by Jane.

Full edition: nightglassadvisory.com/newsletter

This week on the Signal vs. Noise cybersecurity podcast: Denmark's national ID register was breached, and about 8.8 million people were affected.

The way in wasn't the government. It was a two-person IT company with a legitimate login, and, reportedly, accounts that used the password 123456.

Most companies your size hold keys like that: a login to a customer's supplier portal, an account in their order system. To your customer, each one is a door.

This episode explains what your biggest customer's security questionnaire is really asking, and gives you the four things to write down before they ask.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: the FBI and the Secret Service warned about FortiBleed, a campaign that has compromised more than 86,644 firewalls and VPN gateways by one security firm's count, using leaked and reused passwords.

Getting in didn't involve choosing anybody. What came next did: the attackers sorted what they'd caught by revenue and network structure, then sold the access.

Some companies can end up locked out of their own firewall, and the FBI says getting back in takes more than standard patching and password resets.

Why an update closes a door but doesn't empty the room, who should have read this warning for you, and the questions to ask your IT company this week.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: a small school district in Vermont found a ransom note on one of its servers.

More than three weeks later, its school board voted, in public, NOT to pay.

Security professionals, lawyers, the insurer and law enforcement all did the work. The board made the call.

At a 40-person company there's no board meeting. The board is you.

Why the worst week of your year is a bad time to find out who decides, the one question to ask your insurance broker before you need the answer, and why it's worth settling who makes the call on a quiet day.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: an online whisky shop in the UK told its customers that their names, email addresses, phone numbers and shipping addresses had been taken.

The shop wasn't broken into, and neither was the platform it runs on.

The company behind one of its add-ons was, and that add-on held a key to the shop's customer information. The platform turned the key off.

The founder's name went on the apology.

Why the apps you install hand keys to companies you never evaluated, and the two questions to ask before anyone clicks install on the next one: what does it get to see, and who can turn it off?

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: one person with a laptop and an AI chatbot broke into 395 organizations in 48 countries, most of them schools, through the same piece of printing software.

In twelve of them the attacker ended up holding the keys to the whole network. In the other 383, the attacker got the print server and the passwords on it, and stopped there.

The difference was not budget or headcount. It was what one boring box was allowed to reach.

Why you have something like that box, why patching cannot be the whole plan when the warning, the fix and the attack all land in the same week, and the one question to ask your IT company tonight: if that box got hit, what could it reach?

Five minutes, hosted by Jane.

Full edition: signal.echocyber.io

This week on the Signal vs. Noise cybersecurity podcast: on September second the government published seven things that are being broken into right now, and you can read all seven without knowing whether one of them is yours.

That is not a competence problem. Attached to the list was something easy to miss, a rule for deciding which ones could wait, two questions long and written in plain English.

Why the translation already exists, for free, and why it was addressed to somebody else.

Five minutes, hosted by Jane.

This week on the Signal vs. Noise cybersecurity podcast: a flaw that could have handed your identity system to a stranger left no trace inside your company, and that was the good outcome.

One layer down, a flaw in VMware vCenter went from disclosure to exploitation in five days, and the campaign that followed reached three hundred and sixty one addresses across forty seven countries.

Nobody looked any of them up by name.

Why "we're too small to be a target" is not how any of this works.

Five minutes, hosted by Jane.