Cybersecurity from someone who ran enterprise security for two decades and passed every audit once PCI applied. Real talk on what protects a business and what just looks like protection, from the infrastructure side where the actual work happens, plus the social engineering and insider threats most companies miss.
CybersecurityOur PCI auditor looked at a legacy database connection we could not afford to rebuild and said: wrap it in a VPN. That sentence introduced us to mitigating controls, turned a six-figure project into a configuration change, and taught me…
CybersecurityPass the audit and nothing happens. Fail it and the company loses the ability to take credit cards. For eight straight years I carried a major retailer through PCI audits that nobody outside IT ever noticed, and that invisibility is…
CybersecurityThe email said malware had been quarantined on my site and I had three days to fix it. Deleting the file took a minute. The forensics took two days, and the trail ended somewhere worse than a break-in: the plugin…
CybersecuritySomebody opened a link, and their machine was a brick. Literally unrecoverable. Across a fleet of 1,500 desktops and laptops we lost machines to ransomware over and over, and never lost the network, because the network was designed by people…
CybersecurityILOVEYOU never encrypted a file or stole a password from us. It just sent mail, from hundreds of our machines at once, until our Exchange server ran out of disk space and died. Recovery took weeks, and it changed how…
CybersecurityClean machine A. While you are cleaning machine B, machine C reinfects A. We played whack-a-mole against a network worm that never got tired, and lost, until we stopped treating machines and started treating the network.
CybersecurityThe fake UPS email arrived five minutes after my real eBay order, pixel-perfect, and I clicked it. Then the screen turned red: infection stopped, infection stopped, infection stopped. That is what layers are for, because the one filter that always…
CybersecurityThe PCI scan found L0phtCrack, a password cracker, sitting on one of our servers. We hunted it down expecting an intruder. We found our own consultant, who needed passwords to do his job and decided cracking them was faster than…
CybersecurityFour to five months of interviews, C-suite down, mapping every policy to a named role. The project revealed something no framework document warns you about: the CFO did not know what segregation of duties was, and once he understood it,…
CybersecurityHe arrived to service the payment terminals, carrying replacements: our exact model, hacked to skim card data. What stopped him was not a firewall or a scanner. It was a policy simple enough to survive contact with a busy front…
CybersecurityI have to take gamified security tests to consult for companies, and I have rewritten the book on phishing, literally: KnowBe4's Cyberheist, twice, credited alongside Roger A. Grimes. The gap between those two kinds of training is the gap between…
CybersecurityEvery executive who comes to me for a cybersecurity book wants to write a technical book. The book that builds careers is aimed at boards, customers, and the people who approve budgets, with the technical depth as rebar: everywhere, load-bearing,…
Professional ghostwriting for executives, founders, coaches, and authors who want to get the book done right. 113+ books authored. 54+ ghostwritten for clients.
Ready to discuss your book?
BOOK YOUR PRIVATE CONSULTATIONNo pitch. No pressure.
On writing, publishing, and selling your book. Free, straight to your inbox.
If you don't see the email in a few minutes, check spam and mark it as a keeper.
