Articles In Security

By Kevin Santarina, Posted in Security

If you haven’t read tech news in the last week or two, would you have thought twice about clicking on these links if they were embedded into an email? This past month, Google introduced eight new top-level domains that are publicly available for registration. Among them are two very commonly recognized file extensions, .zip and .mov. The .zip extension is one of those file extensions used to indicate to a user that they are about to receive a collection of files, PDFs, documents, installers, etc., a... read more.

• May 23, 2023

By Steve Gold, Posted in Security

If you’ve ever challenged a rule your parents set, you’ve probably heard the phrase, “As long as you live in my house, you’ll live by my rules”. Sometimes, if you’re lucky, it’s followed up with, “You can do whatever you want when you have your own home”. So, what do these painful childhood memories have to do with security? I’m so glad you asked! Your parents established certain rules/processes to ensure that the home, and everyone in it, is prot... read more.

• May 16, 2023

By Steve Gold, Posted in Security

Hopefully by now you’re seeing a trend. You need full visibility into your environment and you also need both the visibility and capability to remove any unauthorized assets or software. I know this may seem kind of basic, but remember, we are only at Control 2. Wait till we get to Control 17 and start discussing Incident Response. But let’s not get ahead of ourselves just yet. After all, we are working with a prescriptive, prioritized, and simplified set of best practices. In the previous blog... read more.

• May 09, 2023

By Steve Gold, Posted in Security

Okay, so it’s not Christmas time but my hair is getting grayer (whiter) and I’m feeling quite jolly talking about security. And because you’ve been so good reading this blog, you deserve a gift. The gift of reusability. Now, I’m not talking about that button down shirt you wore yesterday on your video calls hanging over your chair. I’m talking about using the same tool you use to inventory your assets to inventory your software. Most commercial tools that do one will also do t... read more.

• May 02, 2023

By Steve Gold, Posted in Security

Ok, so that’s not exactly what the sign typically says but you should have your own sign that says “No Approval. No Authorization. No Access!” No one wants uninvited guests in their home/party just like no wants unauthorized, unapproved assets on their network. You need the visibility to know who/what is on your network and the ability to remove them if they’re not authorized. Those unauthorized assets can unknowingly expand your blast radius and increase your attack surface. Wheth... read more.

• April 25, 2023

By Steve Gold, Posted in Security

Don’t know what a blast radius is, well let’s turn to our friend Wikipedia: “The distance from the source that will be affected when an explosion occurs. A blast radius is often associated with bombs, mines, explosive projectiles (propelled grenades), and other weapons with an explosive charge.” From a security perspective, blast radius is used “to designate the impact that a security breach of one single component has on the overall environment. Reducing the blast radius of a... read more.

• April 18, 2023

By Steve Gold, Posted in Security

“There can be only one” If you’re a fan of the movie Highlander like I am, you remember that line. Now, we’re not talking about immortals killing each other until only one remains. We’re talking about security and how to get started. Although, if you post comments on that, perhaps I can start another blog, but I digress. CIS agreed with Connor MacLeod of the Clan MacLeod and felt that there can (should) be only one task for people to start their cybersecurity journey and crea... read more.

• April 11, 2023

By Steve Gold, Posted in Security

Security: the final frontier. These are the safeguards of the CIS Critical Security Controls. It’s ongoing mission: To protect organizations, To seek out security gaps and misconfigured systems, To boldly go where few security professionals have gone before. Hi, I’m Steve Gold. Cybersecurity Practice Director for Gotham Technology Group and a little bit of a closet Trekkie. I’ve spent my career working for organizations that truly help people. From Wyse Technology, which minimize... read more.

• April 04, 2023

By Timothy Karl, Posted in Infrastructure, Security, Support, Virtualization

Citrix recently released the first new LTSR version of Citrix Virtual Apps and Desktops in over two years. Here is what I feel are the top 5 new features and enhancements available in 2203: #1 - Microsoft Teams Optimizations Citrix has added a lot of functionally to Microsoft Teams optimizations over the last two years that were until now only available in current releases. These new functionalities in the latest LTSR release include: App sharing Multimonitor screen sharing DTMF support Proxy server... read more.

• April 15, 2022

By Nancy Rand, Posted in Security

The PCI Council published a blog announcing the coming of PCI DSS version 4.0 at the end of March 2022 https://blog.pcisecuritystandards.org/countdown-to-pci-dss-v4.0. The blog contains a PCI DSS Version 4.0 Implementation timeline. The new standard document, the Summary of Changes v3.2.1 to 4.0 will be released along with the Report on Compliance ROC Template and Attestations of Compliance AOC documents at the end of March 2022. The Self-Assessment Questionnaires SAQs will be available shortly after. Tr... read more.

• March 17, 2022