The IT job market has always shifted as technologies advanced, but cloud computing has pushed changes in the market to speeds never seen before. The job market for cloud architects changes as rapidly as the technology itself. At AWS Re:Invent 2018 last week, AWS announced 30+ new significant services alone. Then there is Microsoft, Google, and all the smaller players to keep track of.Details
Social media can do wonders for you as an individual, as well as if you are running your own online business. It can help you build a loyal following, spread word and awareness about your brand, and reach out to other like-minded people, as well as customers. And the best about it is that it’s incredibly easy to do, since everyone you are looking for is already there. It is estimated that there will about 2.77 billion users on social media in 2019!
However, because the power of social media is so easy to utilize, most people let their guard down when it comes to cybersecurity, which can come back to haunt them at some point in the future, in a number of different ways. In order to avoid that, let’s take a look at seven ways in which social media sites sabotage your cybersecurity.Details
This months podcast features Matthew Pascucci, cybersecurity practice manager at CCSI, speaking with guest CISO Patricia Smith from Cox Automotive, on vulnerability management in the Cloud. Does vulnerability management change depending on deployment model? How to you measure cloud vulnerability metrics? Patricia Smith and Matthew Pascucci touch upon these and more in this podcast episode.Details
The first question you may be asking is, “Why should I be considering third party maintenance over OEM maintenance contracts?” The short answer: MONEY
Most buyers who utilize third party maintenance services save up to 50 percent or more over three years, in most cases. In reality though, it isn’t just about the money you could save, excellent service is also an important trait, third party technicians come just as qualified as manufacturer technicians. Third party maintenance requires careful vetting, but in the end, it can be more than worth it.Details
As more enterprise IT operations organizations move to container technology, IT administrators are having to morph into DevOps roles to deal with the container orchestration systems within IT production. These include systems like Docker Swarm, Apache Mesos, and Google Kubernetes, as well as a handful of lesser known players. Container technology has become a reliable way to quickly package, deploy and run application workloads without the need for concern of the physical underlying hardware or operating systems.
Just as important as the containers themselves is the container orchestration technology. These products allow you to start and stop containers through scheduling. They also allow you to scale container usage through managed container clusters. Enterprise data centers have come to expect 99.99% uptime, and introducing new technologies puts a lot of pressure on those individuals expected to run them.Details
In today’s world, digital security is more important than ever. Long gone are the days where you only needed to worry about physical security for offices. Now, banks, law offices, government facilities, and private companies all depend on their technology being protected from a range of threats. It’s essential for a seamless continuity of daily life to identify and quickly respond to these threats as they occur.Details
Containers and microservices are becoming a very popular option for deploying applications. There are many benefits of containers, faster deployments, reproducibility of environments, cost optimizations, isolation, and flexibility in general.
There is one glaring problem that is seen right after initial deployment, monitoring and troubleshooting is exponentially more complex when it comes to containers. Containers are designed to run programs in an isolated context, and that means that they tend to be opaque environments. Because of this, the same visibility tools we’ve all been using for years are now failing to perform as expected. Now, you suddenly realize you are flying blind.Details
There is a massive need for cybersecurity professionals today and the need is only growing. We’ve seen estimates of anywhere between 2-3 million vacant jobs over the next three years. The demand is definitely bullish and showing no signs of stopping. With this being said, breaking into an industry is always a difficult thing to do and nothing should be assumed, even with the massive demand of unfilled positions. Here are a few areas I’d suggest if you’re looking to not only get into security, but become successful.Details
Site Reliability Engineering (SRE) is a practice that combines software development skills and IT operations into a single job function. Automation and continuous integration and delivery are used to reach the goal of improving highly dynamic systems. The concept originated with Google in the early 2000s and was documented in a book with the same name, Site Reliability Engineering (a must read). SRE shares many governing concepts with DevOps—both domains rely on a culture of sharing, metrics and automation. SRE can be thought of as an extreme implementation of DevOps. The role of the SRE is common in cloud first enterprises and gaining momentum in traditional IT teams. Part systems administrator, part second tier support and part developer, SREs require a personality that is by nature inquisitive, always acquiring new skills, asking questions, and solving problems by embracing new tools and automation.Details
Microsoft’s had significant difficulties recovering from its most severe Azure outage in years. On September 4, 2018 there was a weather related power spike at Microsoft’s Azure South Central U.S. region in San Antonio. That surge hit crippled their HVAC system. The subsequent rising temperatures triggered automatic hardware shutdowns. More than 30 cloud services, as well as the Azure status page were taken out in the process.Details
Businesses report the key advantages of moving workloads to the Cloud are flexibility, agility, easy access to information, and cost savings. Clearly they are taking use of these advantages, as seen in the 2018 State of the Cloud Survey performed by RightScale, they found that 96% of respondents now use the public, private, hybrid, or…Details
There are any number of use cases where you would need a disaster recovery solution. These can be a disaster emanating from within, such as end user error that has unexpected catastrophic results that cripples your system. There can also be outside influences, like acts of Mother Nature that could flood your data center or…Details
Around the Millenium when 802.11 was ratified, any measure of security was enough; just having an SSID that was closed was “security”. Then came WEP to stop unauthorized access, however, that was soon cracked. That is why, the IEEE and the WiFi Alliance devised WiFi Protected Access (WPA). Protecting WLANs (Wireless Local Area Networks) should…Details
Today, cybersecurity is vital to the safety and security of your company and its data. Developing a proper risk assessment strategy for cyberattacks is about as necessary as breathing. Not only can an incident get you in a lot of trouble with your customers, lowering your reputation, but it can also get you into legal…Details
Effectively connect people, process and technology to minimize MTTD and MTTR
There’s a reason it’s said that what gets measured gets managed. In order to successfully achieve a goal, you have to be able to measure progress. It’s the only way to know if you’re heading in the right direction.
That’s why any security operations team worth their salt will be paying close attention to both their mean time to detect (MTTD) and mean time to respond (MTTR) metrics when it comes to resolving incidents.
The average dwell time for attackers still sits somewhere within the ranges of 100 – 140 days and frankly, we can do better. Security operations teams need to be fanatical when it comes to lowering these metrics within their organizations.
Significantly reducing dwell time, MTTD and MTTR starts with an understanding of attacks. From there, you need multiple groups working together in harmony enabled by technology to automate and orchestrate incident response processes.Details
Often when speaking to people about the cloud, their first reaction is that it isn’t safe and they won’t use it. Odds are that they, and most everyone else who owns an Internet connected device, is already using the cloud.
Let’s take a step back and define the cloud. In essence, it’s just a network of servers — which are large, super-powerful computers. Anything that’s referred to as “cloud-based” or “in the cloud” means it primarily lives online, instead of on something physical in your possession like a CD or your computer’s hard drive.
A good rule of thumb for determining whether something is “cloud-based” is asking yourself the following question: Can I easily log into this service from another device, like my phone or a different computer? If the answer is yes, then the service is probably based in the cloud.Details
We get asked this question frequently, “What the difference between a vulnerability assessment and penetration assessment?”. It’s a great question and one we’d like to shed a bit more light on throughout this blog. Both engagements are aimed towards shedding light on areas within your cybersecurity posture that need improvement. We regularly perform vulnerability assessments and penetration tests for our clients tasked by regulatory compliance to adhere to a particular standard or to increase their security posture. Both of these tests play an important role within your organization by enlightening you on areas of weakness and decreasing risk from adversaries.Details
This months podcast features host Larry Bianculli speaking with guest CISO Agim Bracovic from BNB Bank, as well as our very own Matthew Pascucci, cybersecurity practice manager, at CCSI, on Incident Response. How do you build a team of qualified IR resources with current staff? How do you prepare and train an incident response team?…Details
On Data Privacy Day earlier this year, CCSI briefly discussed the implications of The General Data Protection Regulation (GDPR). It is essentially a set of rules imposed by the European Union to give individuals primary control over their personal data. This means that companies will now have to disclose or delete the personal data they hold.…Details
Zero-trust networks are often deemed compromised and untrusted, making authentication variables essential to security. Expert Matthew Pascucci explains a zero-trust security model. In the past, we’ve done a great job of making networks accessible. But with this increased availability, we’ve opened the door for attackers to move more easily around networks. However, as we introduce…Details
Two weeks ago CCSI held its first annual CISO Roundtable to discuss cybersecurity trends, issues and solutions. The conversation was focused on how local CISO’s are currently handling security from an executive level. In attendance were ten cybersecurity leaders on Long Island who brought years of experience and expertise to the discussion. The attendees were…Details
It is now widely accepted that Cloud computing can help small and midsize businesses (SMBs) lower operating expenses and improve application performance – and the public clouds are helping small businesses to either replace or supplement their on-premises IT needs. While having a sound migration strategy in place is crucial, equally important is to ensure…Details
We’ve recently seen turnover in the government with a void in the Cybersecurity leadership and it led me to think about how this is being handled in enterprises nationwide. Cybersecurity is more than just technology, hackers, and fancy toys. It’s also about strategy, leadership, and team building, which needs to come first before the implementation of…Details
The first question most people have when they hear the acronym CASB is, “What the heck is this CASB thing?” According to Gartner, a cloud access security broker (CASB) is an on-premises or cloud-based security policy enforcement point that is placed between cloud service consumers and cloud service providers to combine and interject enterprise security…Details
Spending days and nights monitoring your own network, as well as others, would probably seem like a mundane task to majority of people, but like any other job there are certain days that can stick out in your mind. For the ones that are not familiar with what a Network Operations Center or NOC is,…Details
Several years back, organizations didn’t even think about users signing up for their own applications and tools. The fact that each application required access to resources that were beyond their control kept this problem bottled up. Storage, compute, and network configurations were all IT’s domain and so IT needed to be consulted before a new…Details
This past week Matthew Pascucci, Cybersecurity Practice Manager at CCSI participated in a Cyber Roundtable. Check out this article about the roundtable discussion by Teresa Varela-Lauper. Dr. James Stanger is CompTIA’s Chief Technology Evangelist. He’s a CompTIA super hero in my book….traveling all over the world, speaking at events, impacting and representing the IT industry…Details
This months podcast features host Larry Bianculli speaking with guest CISO Jeff Jennings from Healthplex, as well as our very own Matthew Pascucci, cybersecurity practice manager, at CCSI, on policy and procedures. Where do you begin to write company policy and procedures? What are the best practices and how to ensure adaptation? Jeff Jennings and…Details
The internet of things (IoT) is a living, breathing beast that’s surreptitiously infiltrating our lives. We now have smart cities where the street lights and trash bins are calculating data to schedule efficient lighting and trash pickup. Our homes are connected to devices that allow remote adjustment of lights and temperature to our liking. Then…Details