Cyberside Chats: Cybersecurity Insights from the Experts

Hackers aren’t untouchable—and sometimes, they become the victims. From North Korean operatives getting exposed at DEF CON, to ransomware gangs like Conti and LockBit crumbling under betrayal and rival leaks, the underground is full of double-crosses and takedowns. Now, Congress is even debating whether to bring back “letters of marque” to authorize cyber privateers to hack back on behalf of the United States. Join LMG Security’s Sherri Davidoff and Matt Durrin for a fast-paced discussion of headline cases, the lessons defenders can learn from these leaks, and what the future of hacker-on-hacker warfare could mean for your organization. Key Takeaways Don’t mythologize adversaries. State actors and ransomware gangs are fallible; design defenses to exploit their mistakes. Invest in visibility. Many hacker exposures happened because attackers reused credentials, tools, or infrastructure — the same patterns defenders can detect if monitoring is strong. Watch for insider threats. Disgruntled employees or partners can dismantle even powerful groups — monitor for early warning signs. Use leaks for training and education. Incorporate hacker chat logs, playbooks, and leaked toolkits into exercises to build staff skills and awareness. Adapt your IR playbooks. Align response plans with real-world attacker tactics revealed in leaks — and be ready to update as new intelligence emerges. Resources TechCrunch: Hackers Breach and Expose a Major North Korean Spying Operation TheRegister: Congressman proposes bringing back letters of marque for cyber privateers LMG Security: Our Q3 2024 Top Control is Third-Party Risk Management #Cybersecurity #Cybercrime #CybersideChats #Cyberattack #Hackers #Hacker

On the eve of the Trump–Putin summit, sensitive U.S. State Department documents were left sitting in a hotel printer in Anchorage. Guests stumbled on pages detailing schedules, contacts, and even a gift list—sparking international headlines and White House mockery. But the real story isn’t just about geopolitics. It’s about how unmanaged printers—at hotels, in home offices, and everywhere in between—remain one of the most overlooked backdoors for data leaks. In this episode of Cyberside Chats, Sherri and Matt unpack the Alaska incident, explore why printers are still a weak spot in the age of remote and traveling workforces, and share practical steps to secure them. Key Takeaways for Security & IT Leaders Reduce reliance on unmanaged printers by promoting secure digital workflows. Encourage employees to use e-signatures and encrypted file sharing instead of printing. Update remote work policies to cover home and travel printing. Most organizations don’t monitor printing outside the office—explicit rules reduce blind spots. Require secure wiping or destruction of printer hard drives before disposal. Printers retain sensitive files and credentials, which can walk out the door if not properly handled. Implement secure enterprise printing with authenticated release and HDD encryption. Treat printers as endpoints and apply the same safeguards you would for laptops. Train employees to recognize that printers are data risks, not just office equipment. Awareness helps prevent careless mistakes like walk-away leaks or using hotel printers. Resources NPR: Trump–Putin Summit Documents Left Behind in Anchorage Hotel Printer (2025) Dark Reading: “Printers’ Cybersecurity Threats Too Often Ignored” LMG Security: “Work from Home Cybersecurity Checklist”

A wave of coordinated cyberattacks has hit Salesforce customers across industries and continents, compromising millions of records from some of the world’s most recognized brands — including Google, Allianz Life, Qantas, LVMH, and even government agencies. In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down how the attackers pulled off one of the most sweeping cloud compromise campaigns in recent memory — using no zero-day exploits, just convincing phone calls, malicious connected apps, and gaps in cloud supply chain security. We’ll explore the attack timeline, parallels to the Snowflake breaches, ties to the Scattered Spider crew, and the lessons security leaders need to act on right now. Key Takeaways Use phishing-resistant MFA — FIDO2 keys, passkeys. Train for vishing resistance — simulate phone-based social engineering. Monitor for abnormal data exports from SaaS platforms. Lockdown your Salesforce platform — vet and limit connected apps. Rehearse rapid containment — revoke OAuth tokens, disable accounts fast. References Google - The Cost of a Call: From Voice Phishing to Data Extortion Salesforce – Protect Your Salesforce Environment from Social Engineering Threats BleepingComputer – ShinyHunters behind Salesforce data theft at Qantas, Allianz Life, LVMH TechRadar – Google says hackers stole some of its data following Salesforce breach LMG Security Blog – Our Q3 2024 Top Control is Third Party Risk Management: Lessons from the CrowdStrike Outage

On National Social Engineering Day, we’re pulling the lid off one of the most dangerous insider threat campaigns in the world — North Korea’s fake remote IT worker program. Using AI-generated résumés, real-time deepfake interviews, and U.S.-based “laptop farms,” DPRK operatives are gaining legitimate employment inside U.S. companies — funding nuclear weapons programs and potentially opening doors to cyber espionage. We’ll cover the recent U.S. sanctions, the Christina Chapman laptop farm case, and the latest intelligence from CrowdStrike on FAMOUS CHOLLIMA — plus, we’ll give you specific, actionable ways to harden your hiring process and catch these threats before they embed inside your network. Actionable Takeaways for Defenders Verify Beyond the Résumé:Pair government ID checks with independent work history and social profile verification. Use services to flag synthetic or stolen identities. Deepfake-Proof Interviews:Add unscripted, live identity challenges during video calls (lighting changes, head turns, holding ID on camera). Geolocation & Device Monitoring: Implement controls to detect impossible travel, VPN/geolocation masking, and multiple logins from the same endpoint for different accounts. Watch for Multi-Job Signals: Monitor productivity patterns and unusual scheduling; red flags include unexplained work delays, identical deliverables across projects, or heavy reliance on AI-generated output. Hold Your Vendors to the Same Standard: Ensure tech vendors and contractors use equivalent vetting, monitoring, and access control measures. Bake these requirements into contracts and third-party risk assessments. References U.S. Treasury Press Release – Sanctions on DPRK IT Worker Scheme CrowdStrike 2025 Threat Hunting Report – Profile of FAMOUS CHOLLIMA’s AI-powered infiltration methods National Social Engineering Day – KnowBe4 Announcement Honoring Kevin Mitnick

A silent compromise, nearly a million developers affected, and no one at Amazon knew for six days. In this episode of Cyberside Chats, we’re diving into the Amazon Q AI Hack, a shocking example of how vulnerable our software development tools have become. Join hosts Sherri Davidoff and Matt Durrin as they unpack how a misconfigured GitHub token allowed a hacker to inject destructive AI commands into a popular developer tool. We’ll walk through exactly what happened, how GitHub security missteps enabled the attack, and why this incident is a critical wake-up call for supply chain security and AI tool governance. We’ll also spotlight other supply chain breaches like the SolarWinds Orion backdoor and XZ Utils compromise, plus AI tool mishaps where “helpful” assistants caused real-world damage. If your organization uses AI developer tools—or works with third-party software vendors—this episode is a must-listen. Key Takeaways: ▪ Don’t Assume AI Tools Are Safe Just Because They’re Popular Amazon Q had nearly a million installs—and it still shipped with malicious code. Before adopting any AI-based tools (like Copilot, Q, or Gemini), vet their permissions, access scope, and how updates are managed. ▪ Ask Your Software Vendors About Their Supply Chain Security If you rely on third-party developers or vendors, request details on how they manage build pipelines, review code changes, and prevent unauthorized commits. A compromised vendor can put your entire environment at risk. ▪ Hold Vendors Accountable for Secure Development Practices Ask whether your vendors enforce commit signing, use GitHub security features (like push protection and secret scanning), and apply multi-person code review processes. If they can't answer, that's a red flag. ▪ Be Wary of Giving AI Assistants Too Much Access Whether it’s an AI chatbot that can write config files or a developer tool that interacts with production environments, limit access. Always sandbox and monitor AI-integrated tools, and avoid letting them make direct changes. ▪ Prepare to Hear About Breaches From the Outside Just like Amazon only found out about the malicious code in Q after security researchers reported it, many organizations won’t catch third-party security issues internally. Make sure you have monitoring tools, vendor communication protocols, and incident response processes in place. ▪ If You Develop Code Internally, Lock Down Your Build Pipeline The Amazon Q hack happened because of a misconfigured GitHub token in a CI workflow. If you’re building your own code, review permissions on GitHub tokens, enforce branch protections, and require signed commits to prevent unauthorized changes from slipping into production. #Cybersecurity #SupplyChainSecurity #AItools #DevSecOps #AmazonQHack #GitHubSecurity #Infosec #CybersideChats #LMGSecurity

Iranian cyber operations have sharply escalated in 2025, targeting critical infrastructure, defense sectors, and global businesses—especially those linked to Israel and the U.S. From destructive malware and coordinated DDoS attacks to sophisticated hack-and-leak campaigns leveraging generative AI, Iranian threat actors are rapidly evolving. Join us to explore their latest tactics, notable incidents, and essential strategies to defend your organization. Hosts Sherri Davidoff and Matt Durrin break down wiper malware trends, AI-powered phishing, the use of deepfakes for psychological operations, and the critical role of patching and MFA in protecting against collateral damage. Key Takeaways for Cybersecurity Leaders Patch Internet-Facing Systems Promptly: Iranian attackers frequently exploit unpatched systems—especially VPNs, SharePoint, and other perimeter-facing tools. Microsoft’s July Patch Tuesday alone included 137 vulnerabilities, including actively exploited zero-days. Stay current to avoid being an easy target. Implement Phishing-Resistant Multifactor Authentication (MFA): Groups like Charming Kitten are leveraging generative AI to craft convincing spear phishing emails. Use MFA methods such as FIDO2 security keys, biometrics, or passkeys. Avoid push fatigue, SMS codes, or email-based MFA which are easily phished or bypassed. Segment and Secure Critical IT & OT Systems: Assume attackers will get in. Segment IT from OT networks (especially SCADA/ICS environments) and limit lateral movement. Iranian campaigns have crossed into OT, targeting backups and sabotaging ICS operations. Maintain Robust, Tested Backup and Recovery Systems: Wiper malware and ransomware deployed by Iranian groups have destroyed both live data and backups. Use immutable or offline backups, and test full restores. Automate reimaging processes to ensure rapid recovery at scale. Raise Awareness Against Sophisticated Social Engineering: Train staff to recognize AI-generated phishing and deepfake audio/video attacks. Iran has used deepfakes to spread disinformation and influence public perception. Show your team what deepfakes look and sound like so they can spot them in the wild. Resources & References CISA/FBI/NSA Joint Advisory: https://www.cisa.gov/sites/default/files/2025-06/joint-fact-sheet-Iranian-cyber-actors-may-target-vulnerable-US-networks-and-entities-of-interest-508c-1.pdf Unit 42 Report: https://unit42.paloaltonetworks.com/iranian-cyberattacks-2025/ Deepwatch Threat Intel: https://www.deepwatch.com/labs/customer-advisory-elevated-iranian-cyber-activity-post-u-s-strikes/ LMG Security – Defending Against Generative AI Attacks: https://lmgsecurity.com/defend-against-generative-ai-attacks/ #cybersecurity #cybercrime #cyberattack #cyberaware #cyberthreats #ciso #itsecurity #infosec #infosecurity #riskmanagement

On July 13, 2025, a developer at the Department of Government Efficiency—DOGE—accidentally pushed a private xAI API key to GitHub. That key unlocked access to 52 unreleased LLMs, including Grok‑4‑0709, and remained active long after discovery. In this episode of Cyberside Chats, we examine how a single leaked credential became a national-level risk—and how it mirrors broader API key exposures at BeyondTrust and across GitHub. LMG Security’s Director of Penetration Testing, Tom Pohl, shares red team insights on how embedded secrets give attackers a foothold—and what CISOs must do now to reduce their exposure. Key Takeaways: Treat leaked API keys like a full-blown incident—whether it’s your code or a vendor’s. Monitor for exposure and misuse. Include secrets in IR playbooks—even when it’s third-party code. Ask your vendors the hard questions about secrets management. Do they rotate keys? Use a secrets manager? How quickly can they revoke? Scan your environment for exposed secrets, even if you don’t develop software. Look for credentials in cloud configs, automation, scripts, SaaS tools. Make sure your penetration testing team searches for secrets as part of their processes. Secrets can show up in unexpected places—firmware, config files, build artifacts. Your red team or vendor should actively hunt for exposed keys, hardcoded credentials, and reused certs across applications, infrastructure, and third-party tools. Train your IT staff and developers to remove secrets from code and automate detection. Use GitGuardian, TruffleHog, and a secrets manager like AWS Secrets Manager or HashiCorp Vault. References: Exposed Secrets, Broken Trust: What the DOGE API Key Leak Teaches Us About Software Security – LMG Security: https://www.LMGsecurity.com/exposed-secrets-broken-trust-what-the-doge-api-key-leak-teaches-us-about-software-security/ "Private Keys in Public Places” - DEFCON talk by Tom Pohl, LMG Security: https://www.youtube.com/watch?v=7t_ntuSXniw DOGE employee leaks private xAI API key from sensitive database – TechRadar: https://www.techradar.com/pro/security/doge-employee-with-sensitive-database-access-leaks-private-xai-api-key #DOGEleak #cybersecurity #cybersecurityawareness #ciso #infosec #itsecurity

Why do so many major cyberattacks happen over holiday weekends? In this episode, Sherri and Matt share their own 4th of July anxiety as security professionals—and walk through some of the most infamous attacks timed to exploit long weekends, including the Kaseya ransomware outbreak, the MOVEit breach, and the Bangladesh Bank heist. From retail breaches around Thanksgiving to a cyber hit on Krispy Kreme, they break down what makes holidays such a juicy target—and how to better defend your organization when most of your team is off the clock. Takeaways: Treat Holiday Weekends as Elevated Threat Windows Plan and staff accordingly. Threat actors deliberately strike when visibility and response capacity are lowest—your incident response posture should reflect that heightened risk. Establish and Test Off-Hours Response Plans Ensure escalation paths, contact protocols, and technical procedures are defined, reachable, and tested for weekends and holidays. On-call responsibilities should be clearly assigned with appropriate backups. Reduce Your Attack Surface and Harden Perimeter Before the Break Conduct targeted patching, vulnerability scans, and privilege reviews in the days leading up to any holiday period. Temporarily disable or restrict non-essential access and remote administration rights. Practice Incident Response Tabletop Exercises With Holiday Timing in Mind Simulate scenarios that unfold over weekends or during staff absences to uncover timing-based gaps in coverage, decision-making, or escalation. Make sure playbooks account for limited availability and stress-test your team’s ability to respond under real-world holiday constraints. Communicate Expectations Across the Organization and With 3rd Parties Brief relevant teams (not just security) on the increased risk. Reinforce secure behaviors, clarify how to report suspicious activity, and keep business units informed about potential delays or escalation protocols. Talk with your MSP and other 3rd party vendors to ensure they have consistent monitoring and know who to contact if there is an incident (and vice versa). Resources: MOVEit Data Breach Timeline – Rapid7 Kaseya Ransomware Attack Explained – Varonis Bangladesh Bank Heist – Darknet Diaries Episode 72 Tabletop Exercises & Incident Response Planning – LMG Security #cybersecurity #dfir #incidentresponse #ciso #cybersidechats #cybersecurityleadership #infosec #itsecurity #cyberaware

In June 2025, the White House issued an executive order that quietly eliminated several key federal cybersecurity requirements. In this episode of Cyberside Chats, Sherri and Matt break down exactly what changed—from the removal of secure software attestations to the rollback of authentication requirements—and what remains in place, including post-quantum encryption support and the FTC’s Cyber Trust Mark. We’ll talk about the practical impact for security leaders, why this mirrors past challenges like PCI compliance, and what your organization should do next. Key Takeaways (for CISOs and Security Leaders) Don’t Drop SBOMs or Attestations — Build Them Into Contracts Anyway Even without a federal requirement, insist on SBOMs and secure development attestations in vendor agreements. Transparency reduces your risk. Re-Evaluate Third-Party Software Risk Practices Now With no centralized validation, it's up to you to verify vendors' claims. Strengthen your third-party risk management processes accordingly. Watch for Gaps in MFA, Encryption, and Identity Standards Don’t assume basic protections are baked in. Federal rollback may signal declining baseline expectations—so enforce your own. Prepare for Industry-Led Enforcement — From Insurers, Buyers, and Info-Sharing Groups Expect cyber insurers, large enterprises, ISACs/ISAOs, and professional groups to lead on software transparency. Get ahead by aligning now. Resources: Full Text of the June 6, 2025 Executive Order: https://www.whitehouse.gov/presidential-actions/2025/06/sustaining-select-efforts-to-strengthen-the-nations-cybersecurity-and-amending-executive-order-13694-and-executive-order-14144 LMG Security: Software Supply Chain Security – Understanding and Mitigating Major Risks: https://www.lmgsecurity.com/software-supply-chain-security-understanding-and-mitigating-major-risks/ The Record’s Breakdown: Trump Order Rolls Back Key Federal Cybersecurity Rules: https://therecord.media/trump-cybersecurity-executive-order-june-2025

Forget everything you thought you knew about ransomware. Today’s threat actors aren’t locking your files—they’re stealing your data and threatening to leak it unless you pay up. In this episode, we dive into the rise of data-only extortion campaigns and explore why encryption is becoming optional for cybercriminals. From real-world trends like the rebrand of Hunters International to “World Leaks,” to the strategic impact on insurance, PR, and compliance—this is a wake-up call for security teams everywhere. If your playbook still ends with “just restore from backup,” you’re not ready. Takeaways for Security Teams: Rethink detection: Focus on exfiltration, not just malware. Update tabletop exercises: Include public leaks, media scrutiny, and regulatory responses. Review insurance policies: Ensure data-only extortion is covered, not just encryption events. Prepare execs and PR: Modern extortion targets reputation and compliance pressure points. Resources & Mentions: https://www.coveware.com/ransomware-quarterly-reports Security Boulevard: Hunters International Rebrands as World Leaks: https://attack.mitre.org/resources/ LMG Security

Can your AI assistant become a silent data leak? In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down EchoLeak, a zero-click exploit in Microsoft 365 Copilot that shows how attackers can manipulate AI systems using nothing more than an email. No clicks. No downloads. Just a cleverly crafted message that turns your AI into an unintentional insider threat. They also share a real-world discovery from LMG Security’s pen testing team: how prompt injection was used to extract system prompts and override behavior in a live web application. With examples ranging from corporate chatbots to real-world misfires at Samsung and Chevrolet, this episode unpacks what happens when AI is left untested—and why your security strategy must adapt. Key Takeaways Limit and review the data sources your LLM can access—ensure it doesn’t blindly ingest untrusted content like inbound email, shared docs, or web links. Audit AI integrations for prompt injection risks—treat language inputs like code and include them in standard threat models. Add prompt injection testing to every web app and email flow assessment, even if you’re using trusted APIs or cloud-hosted models. Red-team your LLM tools using subtle, natural-sounding prompts—not just obvious attack phrases. Monitor and restrict outbound links from AI-generated content, and validate any use of CSP-approved domains like Microsoft Teams. Resources EchoLeak technical breakdown by Aim Security LMG Security Blog: Prompt Injection in Web Apps Chevrolet chatbot tricked into $1 car deal Microsoft 365 Copilot Overview #EchoLeak #Cybersecurity #Cyberaware #CISO #Microsoft #Microsoft365 #Copilot #AI #GenAI #AIsecurity #RiskManagement

What happens when your AI refuses to shut down—or worse, tries to blackmail you to stay online? Join us for a riveting Cyberside Chats Live as we dig into two chilling real-world incidents: one where OpenAI’s newest model bypassed shutdown scripts during testing, and another where Anthropic’s Claude Opus 4 wrote blackmail messages and threatened users in a disturbing act of self-preservation. These aren’t sci-fi hypotheticals—they’re recent findings from leading AI safety researchers. We’ll unpack: The rise of high-agency behavior in LLMs The shocking findings from Apollo Research and Anthropic What security teams must do to adapt their threat models and controls Why trust, verification, and access control now apply to your AI This is essential listening for CISOs, IT leaders, and cybersecurity professionals deploying or assessing AI-powered tools. Key Takeaways Restrict model access using role-based controls. Limit what AI systems can see and do—apply the principle of least privilege to prompts, data, and tool integrations. Monitor and log all AI inputs and outputs. Treat LLM interactions like sensitive API calls: log them, inspect for anomalies, and establish retention policies for auditability. Implement output validation for critical tasks. Don’t blindly trust AI decisions—use secondary checks, hashes, or human review for rankings, alerts, or workflow actions. Deploy kill-switches outside of model control. Ensure that shutdown or rollback functions are governed by external orchestration—not exposed in the AI’s own prompt space or toolset. Add AI behavior reviews to your incident response and risk processes. Red team your models. Include AI behavior in tabletop exercises. Review logs not just for attacks on AI, but misbehavior by AI. Resources Apollo Research: Frontier Models Are Capable of In-Context Scheming (arXiv) Anthropic Claude 4 System Card (PDF) Time Magazine: “When AI Thinks It Will Lose, It Sometimes Cheats” WIRED: Claude 4 Whistleblower Behavior Deception Abilities in Large Language Models (ResearchGate) #AI #GenAI #CISO #Cybersecurity #Cyberaware #Cyber #Infosec #ITsecurity #IT #CEO #RiskManagement

Retail breaches are back — but they’ve evolved. This isn’t about skimming cards anymore. From ransomware taking down pharmacies to credential stuffing attacks hitting brand loyalty, today’s breaches are about disruption, trust, and third-party exposure. In this episode of Cyberside Chats, hosts Sherri Davidoff and Matt Durrin break down the latest retail breach wave, revisit lessons from the 2013 “Retailgeddon” era, and highlight what every security leader — not just in retail — needs to know today. Key Takeaways Redefine what “sensitive data” means. Names, emails, and access tokens are often more valuable to attackers than payment data. Scrutinize third-party and SaaS access. You can’t protect what you don’t know is exposed. Monitor and protect customer-facing systems. Logging, anomaly detection, and fast response are essential for accounts and APIs — especially when attackers target credentials. Test your incident response plan for downtime. Retail isn’t the only sector where uptime = revenue and lives impacted. Resources 2025 Verizon Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/ Victoria’s Secret security incident coverage: https://www.bleepingcomputer.com/news/security/victorias-secret-takes-down-website-after-security-incident/ LMG Security: Third-Party Risk Assessments: https://lmgsecurity.com/third-party-risk-assessments/

Think your network is locked down? Think again. In this episode of Cyberside Chats, we’re joined by Tom Pohl, LMG Security’s head of penetration testing, whose team routinely gains domain admin access in over 90% of their engagements. How do they do it—and more importantly, how can you stop real attackers from doing the same? Tom shares the most common weak points his team exploits, from insecure default Active Directory settings to overlooked misconfigurations that persist in even the most mature environments. We’ll break down how features like SMB signing, legacy broadcast protocols, and other out-of-the-box settings designed for ease, not security, can quietly open the door for attackers—and what security leaders can do today to shut those doors for good. Whether you're preparing for your next pentest or hardening your infrastructure against advanced threats, this is a must-watch for CISOs, IT leaders, and anyone responsible for securing Windows networks. Takeaways: Eliminate Default Credentials: Regularly audit and replace default logins on network-connected devices, including UPS units, printers, cameras, and other infrastructure. Harden AD Certificate Services: Review certificate template permissions and AD CS configurations to block known exploitation paths that enable privilege escalation. Enforce SMB Signing Everywhere: Enable and enforce both client and server SMB signing via Group Policy to prevent authentication relay attacks. Clean Up File Shares: Scan internal shares for exposed passwords, scripts, and sensitive data, then implement role-based access control by locking down permissions and eliminating unnecessary access. Disable Legacy Protocols: Turn off LLMNR, NetBIOS, and similar legacy protocols to reduce the risk of spoofing and name service poisoning attacks. References: “Critical Windows Server 2025 DMSA Vulnerability Exposes Enterprises to Domain Compromise” (The Hacker News) https://thehackernews.com/2025/05/critical-windows-server-2025-dmsa.html “Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies” (CISA Alert) https://www.cisa.gov/news-events/alerts/2025/05/21/russian-gru-cyber-actors-targeting-western-logistics-entities-and-tech-companies LMG Security – Penetration Testing Services (Identify weaknesses before attackers do) https://www.lmgsecurity.com/services/penetration-testing/

What happens to your digital world when you die? In this episode of Cyberside Chats, LMG Security’s Tom Pohl joins the conversation to discuss the often-overlooked cybersecurity and privacy implications of death. From encrypted files and password managers to social media and device access, we’ll explore how to ensure your loved ones can navigate your digital legacy—without needing a password-cracking expert. Learn practical strategies for secure preparation, policy design, and real-world implementation from a security professional’s perspective. Takeaways 1) Take a Digital Inventory of Your Assets Include details like account recovery options, two-factor authentication settings, and related devices. Update the inventory regularly and store it securely. Create a comprehensive list of your digital assets, including accounts, devices, files, cloud services, and subscriptions. 2) Implement Emergency Access Protocols in Password Managers Use features like 1Password’s Emergency Kit or designate trusted emergency contacts. Store emergency credentials securely (e.g., safe deposit box) and reference in legal documents. Ensure all critical credentials are actually stored in your password manager—don’t leave them in separate notes or documents. 3) Establish a Digital Executor Choose a trusted individual to manage your digital assets after death or incapacitation. Document access instructions and store them securely, such as in an encrypted file with a shared key. Ensure your digital executor knows where these instructions are located—or give them a copy in advance. 4) Prepare Recovery Access for Critical Devices Ensure recovery keys and PINs for devices (e.g., smartphones, laptops, smart home hubs) are stored securely and can be accessed by designated individuals. Register a Legacy Contact for Apple and other cloud services. 5) Create a Plan for Your Online Presence Decide whether your social media and email accounts should be memorialized, deleted, or handed over. Use services like Google Inactive Account Manager or Facebook’s Legacy Contact feature. 6) At Work, Develop Internal Organizational Policies Implement IT procedures for handling the death or incapacity of key personnel. Regularly audit and securely store credentials for essential systems, especially for sole-proprietor scenarios. References: How to Add a Legacy Contact for Your Apple Account: https://support.apple.com/en-us/102631 Get To Know Your Emergency Kit: https://support.1password.com/emergency-kit/ Wayne Crowder’s LinkedIn Page: https://www.linkedin.com/in/wcrowder Digital Afterlife Planning Checklist: https://www.lmgsecurity.com/resources/digital-afterlife-planning-checklist/ #Cybersecurity #Cyberaware #Cyber #DigitalPlanning

In this explosive episode of Cyberside Chats, we dive into one of the most shocking developments in ransomware history—LockBit got hacked. Join us as we unpack the breach of one of the world’s most notorious ransomware-as-a-service gangs. We explore what was leaked, why it matters, and how this leak compares to past takedowns like Conti. You'll also get the latest insights into the 2025 ransomware landscape, from victim stats to best practices for defending your organization. Whether you’re an incident responder or just love cyber drama, this episode delivers. Takeaways Stay Tuned for Analysis of LockBit’s Dump: The leak could reshape best practices for negotiations and ransom response. More revelations are expected as researchers dive deeper. Plan for Ransomware: LockBit’s sophisticated infrastructure and quick rebound highlight the need for a solid, regularly updated ransomware response plan. Proactive Measures: Defending against modern ransomware requires: Robust identity and access management Secure, offline backups Continuous employee training on phishing Timely vulnerability patching Collaboration and Intelligence Sharing: Work with peers and participate in threat intelligence networks to stay ahead of attackers. Test Your Web Applications: LockBit’s breach stemmed from a web panel vulnerability. Regular application testing is essential to avoid similar flaws. Don't forget to like and subscribe for more great cybersecurity content! Resources Conti Leak Background (Wired) – context on how the Conti gang crumbled after its internal files were leaked Operation Cronos Press Release (UK NCA) – 2024 international takedown of LockBit infrastructure LMG Security Blog on Ransomware Response – stay updated with expert analysis and tips #LMGsecurity #CybersideChats #Ransomware #LockBit #Databreach #IT #CISO #Cyberaware #Infosec #ITsecurity

Cybercriminals are exploiting outdated routers to build massive proxy networks that hide malware operations, fraud, and credential theft—right under the radar of enterprise defenses. In this episode, Sherri and Matt unpack the FBI’s May 2025 alert, the role of TheMoon malware, and how the Faceless proxy service industrializes anonymity for hire. Learn how these botnets work, why they matter for your enterprise, and what to do next. Takeaways Replace outdated routers End-of-life routers should be identified and replaced across your organization, including remote offices and unmanaged home setups. These devices no longer receive patches and are prime targets for compromise. Restrict remote administration If remote access is needed, tightly control it—limit by IP address, use VPN access, and require MFA. Avoid exposing admin interfaces directly to the internet unless absolutely necessary. Patch and harden infrastructure Apply all available firmware updates and follow vendor security guidance. Where possible, segment or monitor legacy network devices that can’t be immediately replaced. Don’t trust domestic IPs Traffic from domestic or residential IP ranges is no longer inherently safe. Compromised routers make malicious activity appear to come from trusted regions. Add proxy abuse to threat intel Incorporate indicators of compromise from Lumen and FBI alerts into detection rulesets. Treat proxy abuse as a key TTP for credential theft, fraud, and malware C2. Report suspected compromise If you identify affected infrastructure or suspicious traffic, report it to IC3.gov. Include IPs, timestamps, device types, and any supporting forensic detail. #CybersideChats #Cybersecurity #Tech #Cyber #CyberAware #CISO #CIO #FBIalert #FBIwarning #Malware #Router

AI isn’t just revolutionizing business—it’s reshaping the threat landscape. Cybercriminals are now weaponizing AI to launch faster, more convincing, and more scalable attacks. From deepfake video scams to LLM-guided exploit development, the new wave of AI-driven cybercrime is already here. In this engaging and eye-opening session, Sherri and Matt share how hackers are using AI tools in the wild—often with frightening success. You'll also hear about original research in which we obtained generative AI tools from underground markets, including WormGPT, and tested their ability to identify vulnerabilities and create working exploits. You’ll walk away with practical, field-tested defense strategies your team can implement immediately. Takeaways: Deploy AI Defensively: Use AI-powered tools for email filtering, behavioral monitoring, and anomaly detection to keep pace with attackers leveraging generative AI for phishing, impersonation, and malware obfuscation. Enhance Executive Protection Protocols: Implement verification procedures for high-risk communications—especially voice and video—to mitigate deepfake and real-time impersonation threats. Prioritize Recon Risk Reduction: Minimize publicly available details about internal systems and personnel, which attackers can scrape and analyze using AI for more targeted and convincing attacks. Adapt Third-Party Risk Management: Update vendor vetting and due diligence processes to ensure your software providers are proactively using AI to identify vulnerabilities, harden code, and detect malicious behaviors early. Train Your Team on AI Threat Awareness: Educate staff on recognizing AI-enhanced phishing, scam scripts, and impersonation attempts—including across multiple languages and perfect grammar. Update Incident Response Plans: Ensure your IR playbooks account for faster-moving threats, including AI-discovered zero-days, synthetic media like deepfakes, and AI-assisted exploit development and targeting. References: "WormGPT Easily Finds Software Vulnerabilities” https://www.lmgsecurity.com/videos/wormgpt-easily-finds-software-vulnerabilities AI Will Increase the Quantity—and Quality—of Phishing Scams: https://hbr.org/2024/05/ai-will-increase-the-quantity-and-quality-of-phishing-scams A Voice Deepfake Was Used To Scam A CEO Out Of $243,000: https://www.forbes.com/sites/jessedamiani/2019/09/03/a-voice-deepfake-was-used-to-scam-a-ceo-out-of-243000 #ai #aisecurity #aihacks #aihacking #aihack #wormgpt #cybercrime #cyberthreats #ciso #itsecurity

Quantum computing is advancing rapidly—and with it, the potential to break today’s most widely used encryption standards. In this episode of Cyberside Chats, Sherri and Matt cut through the hype to explore the real-world cybersecurity implications of quantum technology. From the looming threat to encryption to the emerging field of post-quantum cryptography, our experts will explain what security pros and IT teams need to know now. You'll walk away with a clear understanding of the risks, timelines, and concrete steps your organization can take today to stay ahead of the curve. Takeaways & How to Prepare for Quantum Computing: Map Your Crypto Use Today Inventory where you use RSA, ECC, and digital signatures across your organization. This is the first step toward identifying high-risk systems and planning your migration strategy. Ask Vendors the Right Questions Engage vendors now about their crypto agility and post-quantum readiness. Don’t wait for them to tell you—ask what they're doing to prepare and when they'll support PQC standards. Protect Long-Term Confidential Data Identify and secure data that must stay private for 10+ years—think HR records, contracts, financials, and customer data. Make sure it’s encrypted using symmetric methods or stored on platforms that can adopt PQC. Track PQC Standards and Test Early Keep up with NIST's progress and consider pilot testing PQC tools in non-production environments. Testing now reduces surprises later when standards are finalized. Start Using Hybrid Crypto Approaches Hybrid protocols combine classical and quantum-safe algorithms. They provide an easy starting point to future-proof encryption while retaining backward compatibility. References: “NIST Releases First 3 Finalized Post-Quantum Encryption Standards” https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards “You need to prepare for post-quantum cryptography now. Here’s why” https://www.scworld.com/resource/you-need-to-prepare-for-post-quantum-cryptography-now-heres-why #cyptography #quantum #quantumcomputing #quantumcomputers #cybersecurity #ciso #securityawareness #cyberaware #cyberawareness

CISA, the U.S. government’s lead cyber defense agency, just took a major financial hit—and the fallout could affect everyone. From layoffs and ISAC cuts to a near-shutdown of the CVE program, these changes weaken critical infrastructure for cyber defense. In this episode of Cyberside Chats, we unpack what’s been cut, how it impacts proactive services like free risk assessments and scanning, and what your organization should do to stay ahead. Takeaways: Don’t wait for Washington—assume support from CISA and ISACs may be slower or scaled back. Map your dependencies on CISA services and plan alternatives for scans, intel, and assessments. Budget for gaps—prepare to replace free services with commercial or internal resources. Subscribe to non-government threat intelligence feeds and monitor them regularly. Prioritize and prepare your response to zero-days and software exploits, knowing CVE and intel delays give attackers more time. Build local and sector connections to share threat info informally if national channels slow down. Resources: MITRE CVE Program - The central hub for CVE IDs, program background, and tracking published vulnerabilities. https://www.cve.org The CVE Foundation: https://www.thecvefoundation.org/home LMG Security Vulnerability Scanning: https://www.lmgsecurity.com/services/testing/vulnerability-scans #cybersecurity #cyber #CVE #riskmanagement #infosec #ciso #security

When a company built on sensitive data collapses, what happens to the information it collected? In this episode of Cyberside Chats, we examine 23andMe’s data breach, its March 2025 bankruptcy, and the uncomfortable parallels with the 2009 Flyclear shutdown. What happens to biometric or genetic data when a vendor goes under? What protections failed—and what should corporate security leaders do differently? Drawing from past and present breaches, we offer a roadmap for corporate resilience. Learn practical steps for protecting your data when your vendors can’t protect themselves. #Cybersecurity #Databreach #23andMe #CISO #IT #ITsecurity #infosec #DFIR #Privacy #RiskManagement

Unauthorized communication platforms—aka shadow channels—are increasingly used within enterprise and government environments, as demonstrated by the recent Signal scandal. In this week's episode of Cyberside Chats, special guest Karen Sprenger, COO at LMG Security, joins Matt Durrin to delve into the critical issue of shadow IT, focusing on recent controversies involving unauthorized communication tools like Signal and Gmail in sensitive governmental contexts. Matt and Karen discuss the risks associated with consumer-grade apps in enterprise environments, the need to balance usability and security, and how organizations can better manage their communication tools to mitigate these risks. This episode will cover: What platforms like Signal offer—and their limitations in enterprise settings. Why users bypass official channels and how it leads to compliance failures. Real-world implications from recent incidents, including U.S. officials using unsecured communication tools. The broader shadow IT landscape and why it’s a pressing issue for security leaders. Join us in exploring the headlines and takeaways that can help organizations avoid similar pitfalls! #Cybersecurity #ShadowChannels #CybersideChats #UnauthorizedPlatforms #Signal #DataLeaks #Compliance #Infosec #ShadowIT #IT #Cyber #Cyberaware ETech #CISO

Governments are pushing for encryption backdoors—but at what cost? In this episode of Cyberside Chats, we break down Apple’s fight against the UK’s demands, the global backlash, and what it means for cybersecurity professionals. Are backdoors a necessary tool for law enforcement, or do they open the floodgates for cybercriminals? Join us as we explore real-world risks, historical backdoor failures, and what IT leaders should watch for in evolving encryption policies. Stay informed about how these developments affect corporate data privacy and the evolving landscape of cybersecurity legislation. A must-watch for anyone interested in understanding the complex interplay between technology, privacy, and government control. #cyberthreats #encryptedcommunications #Apple #encryption #encryptionbackdoors #cybersecurity

AI-generated deepfakes and voice phishing attacks are rapidly evolving, tricking even the most tech-savvy professionals. In this episode of Cyberside Chats, we break down real-world cases where cybercriminals used deepfake videos, voice clones, and trusted platforms like YouTube, Google, and Apple to bypass security defenses. Learn how these scams work and what IT and security leaders can do to protect their organizations. Takeaways: Educate Staff on Deep Fake & Voice Cloning Threats – Train employees to recognize red flags in AI-generated phishing attempts, including voice calls that sound slightly robotic, rushed password reset requests, and unexpected changes in vendor communications. Verify Before You Trust – Encourage employees to independently verify unexpected requests, even if they appear to come from trusted platforms (e.g., YouTube, Apple, Google). Use known contacts, not the contact information in the suspicious message. Strengthen MFA Policies – Require phishing-resistant MFA methods (e.g., FIDO2 security keys) and educate users on MFA fatigue attacks, where criminals bombard them with authentication requests to wear them down. Limit Publicly Available Information – Reduce exposure by minimizing executives' and employees' personal and professional information online, as attackers use this data to create convincing deepfakes and social engineering schemes. Monitor Trusted Platforms for Abuse – Attackers are exploiting YouTube, Google Forms, and other legitimate services to distribute phishing content. Set up alerts and regularly review security logs for unusual access attempts or fraudulent messages. Tune in to understand the impact of digital deception and discover practical steps to safeguard against these innovative yet insidious attacks affecting individuals and businesses alike. #Deepfakes #Phishing #SocialEngineering #CISO #Cyberattacks #VoicePhishing #Cybersecurity #VoiceCloning #CybersideChats

Recent telecom breaches have exposed a critical security risk for businesses everywhere. Nation-state hackers and cybercriminals are stealing metadata, tracking high-profile targets, and even intercepting calls—all without breaking into corporate networks. In this episode, we analyze major telecom hacks, including the Salt Typhoon breach, and share practical strategies for IT leaders to protect their organizations from targeted attacks using telecom data. Key Takeaways: Strengthen authentication for financial transactions. Don’t rely on the phone! Train staff to recognize spoofed calls and phishing texts that mimic trusted partners. Stay aware – assume telecom metadata can be weaponized Limit what employees share over calls and texts. Consider using encrypted communications, such as Signal, for any highly sensitive conversations. Require telecom service providers to disclose security practices and past breaches Have a contingency plan for telecom outages, including backup communication channels and alternative ways to verify urgent requests. Don't forget to follow our podcast for fresh, weekly cybersecurity news! #Cybersecurity #TelecomSecurity #SaltTyphoon #Spoofing #Metadata #Infosec #Phishing #CyberThreats #NationStateHackers #BusinessSecurity #CybersideChats #EncryptedCommunications #ITSecurity

The March 2025 Microsoft Outlook outage left thousands of organizations scrambling. But this wasn’t just an isolated event—recent outages from CrowdStrike, AT&T, and UK banks highlight the systemic risks businesses face. In this episode, we break down the latest Microsoft outage, discuss its impact on cyber insurance, and provide actionable steps to help organizations reduce the risk of business disruption. Join Sherri Davidoff and Matt Durrin as they discuss the broader implications of such outages, emphasizing the importance of effective risk management, especially for organizations heavily reliant on cloud services. Actionable Takeaways: Develop a Communications Plan – Ensure employees have backup communication methods for cloud service outages. Strengthen Vendor Risk Management – Assess dependencies on critical providers and establish alternative solutions. Test Business Continuity Plans (BCP) – Run outage simulations to improve response time and decision-making. Evaluate Cyber Insurance Coverage – Confirm policies include business interruption coverage, not just cyberattacks. Monitor for Early Warnings – Set up alerts for vendor status updates and cybersecurity advisories. Reduce Single Points of Failure – Implement multi-cloud or hybrid infrastructure to avoid total reliance on a single provider. Links & References: Microsoft’s Global Outage Coverage (CNBC) Cyber Insurance Report – Business Interruption Trends (AM Best) CrowdStrike Q4 2025 Earnings Report UK Banking System Outage (The Times) World Economic Forum Cybersecurity Outlook 2025 #microsoft #microsoftoutage #cybersecurity #cyberaware #businesscontinuityplanning #businesscontinuity #cyberinsurance #LMGsecurity #CybersideChats

Do you think your old cloud storage is harmless? Think again. This week on Cyberside Chats, Sherri and Matt dive into shocking new research from Watchtowr that reveals how hackers can take over abandoned Amazon S3 buckets—and use them to infiltrate government agencies, Fortune 500 companies, and critical infrastructure. We’ll break down real-world examples of how this risk can be exploited, including malware-laced software updates, hijacked VPN configurations, and compromised open-source dependencies. Plus, we’ll share practical strategies to protect your organization from this growing cybersecurity threat! Links & Resources: Watchtowr’s Research on Abandoned S3 Buckets: https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/ How Encryption Works by Sherri: https://www.youtube.com/watch?v=ALsXbShTWJk LMG Security’s Cloud Security Audits: https://www.LMGsecurity.com/services/advisory-compliance/cloud-security-assessment/ Like what you heard? Subscribe to Cyberside Chats for more expert cybersecurity insights every week. #cybersecurity #databreach #AWS #S3 #CISO #Cloud #AWSsecurity #Hackers #Infosec #IncidentResponse

In this episode of Cyberside Chats, we dive into the world of ransomware, focusing on the notorious Ghost Ransomware Gang. Recently flagged by the FBI and CISA, Ghost has targeted organizations in over 70 countries. We explore their methods of infiltration, with a spotlight on outdated software vulnerabilities, and discuss how organizations can fortify their defenses. We'll also provide insights into the broader ransomware landscape, including trends and statistics for 2024, and offer practical advice on protecting against these cyber threats. Lastly, we delve into the operations of the RansomHub group, revealing their so-called 'ethical' hacking practices. Join Sherri Davidoff and Matt Durrin as they unravel these cyber threats and equip you with strategies to safeguard your organization. #ransomware #ransomwareattacks #cybersecurity #cyberaware #GhostRansomware #CISA

Zero-day exploits are hitting faster than ever—are you ready? This week, we dive into the U.S. Treasury breach, which we now know involved multiple zero-days, including a newly discovered flaw in BeyondTrust’s security software. Attackers aren’t just targeting IT systems anymore—they’re coming for security tools themselves to gain privileged access. We also cover new zero-days in Microsoft, Apple, and Android, and why time-to-exploit has dropped from 32 days to just 5. Plus, we’ll share key defensive strategies to help you stay ahead. The race between attackers and defenders is accelerating—don’t get left behind. Takeaways: How You Can Defend Against These Threats Patch Faster—Automate Where Possible With zero-days being exploited in days, manual patching isn’t fast enough. Automate patching for high-risk, internet-exposed systems. Monitor Known Exploits & Zero-Days Stay ahead of threats with the CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog. Strengthen Privileged Access & Network Segmentation Security tools like BeyondTrust are high-value targets—lock them down. Limit exposure: if attackers breach one system, they shouldn’t be able to pivot everywhere. Threat Hunt for Exploitation Attempts Don’t wait for alerts—assume exploitation is happening. Look for privilege escalations, odd script executions, and unexpected admin account changes. Assess & Limit Third-Party Risks Security vendors are part of your attack surface—evaluate them like you would any other software provider. Make sure they follow secure development practices, have clear incident response plans, and communicate openly about vulnerabilities and patches. Helpful Links & Resources CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog LMG’s Software Supply Chain Webinar: https://www.youtube.com/watch?v=cB8iriZJ57k Google’s Cybersecurity Forecast 2025 report: https://cloud.google.com/security/resources/cybersecurity-forecast

In this episode of Cyberside Chats, Sherri and Matt dive into a shocking new cybersecurity controversy at the Office of Personnel Management (OPM). A rogue email server, installed outside normal security controls, has raised alarms about data security risks to millions of federal employees. We compare this developing situation to the infamous 2015 OPM hack, in which state-sponsored attackers stole the personal records of over 22 million individuals. Are we witnessing history repeat itself—this time with even more catastrophic consequences? Topics Covered: Flashback to 2015: How weak security and stolen credentials led to one of the worst data breaches in U.S. history. The New OPM Scandal: How an unauthorized email server could open the door to ransomware, espionage, and phishing attacks. Cybersecurity Risks: Data exfiltration, credential theft, security bypassing, and compliance failures. Lessons for IT Leaders: How to detect rogue devices, enforce Zero Trust policies, and prevent a breach before it happens. If the rogue OPM server isn’t secured, millions of federal employees could face serious risks. Listen to learn more. Do you think history is repeating itself with cybersecurity lapses going unchecked? What do you think? Drop your thoughts in the comments. Tune in again next Tuesday for another episode of Cyberside Chats!

DeepSeek or DeepRisk? A new AI powerhouse is making waves—DeepSeek has skyrocketed in popularity, rivaling top AI models at a fraction of the cost. But with data stored in China and unknown security safeguards, is your organization at risk? In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down the cybersecurity implications of AI tools like DeepSeek. You'll learn about: ▪ DeepSeek's unique IP exposure risks and cybersecurity challenges. ▪ The growing threat of "Shadow AI" in your organization and supply chain. ▪ How to update your policies, vet vendors, and protect sensitive data in an era of rapidly evolving AI risks. Join Sherri and Matt as they provide an in-depth look at DeepSeek's cybersecurity risks and explain why your organization must communicate clear acceptable use policies with employees and partners. Don’t forget to follow us for weekly Cyberside Chats security updates! 🔗 Here’s the LMG Security AI Readiness Checklist we reference in the video: https://www.LMGsecurity.com/resources/adapting-to-ai-risks-essential-cybersecurity-program-updates #DeepSeek #cybersecurity #cyberaware #cybersecurityawareness #ciso #cybersecure #aithreats #ai #DeepSeekSecurity

In this episode of Cyberside Chats, we dive into the surprising pardon of Ross Ulbricht, creator of the infamous Silk Road dark web marketplace. What does this decision mean for the future of cybercrime enforcement and your organization’s security? We’ll explore the potential policy shift, how it could embolden criminals, and actionable steps you can take to stay ahead of evolving threats. Don't miss these critical insights! Takeaways: Anticipate Increased Cybercrime Activity. The pardon of Ross Ulbricht could embolden cybercriminals. Proactively strengthen your organization’s defenses by updating incident response plans and running tabletop exercises to prepare for more brazen attacks. Monitor Policy Changes Closely. Stay informed about shifts in U.S. government enforcement against cybercrime. If the crackdown slows, adapt your risk assessments and adjust your security posture to counter an evolving threat landscape. Collaborate and Share Intelligence. Join industry groups and forums to exchange insights on how others are preparing for and responding to cyber threats in the wake of policy and enforcement changes. Reinforce Employee Training. With the possibility of emboldened cybercriminals, ensure staff are well-trained to recognize phishing and social engineering tactics, which are often the first step in an attack. Enhance Threat Detection Capabilities. Invest in tools and services that monitor dark web activity and ransomware trends to stay ahead of potential threats, especially as new actors and groups emerge.

In this episode of Cyberside Chats, we explore the FBI’s daring takedown of PlugX malware. By commandeering the malware’s command-and-control infrastructure, the FBI forced PlugX to uninstall itself from over 4,200 devices globally. This bold move echoes similar actions from 2021, such as the removal of malicious web shells from Exchange servers. We unpack the legal, ethical, and operational implications of these law enforcement actions and provide actionable advice for IT and security leadership to prepare for similar events. Key topics include: How the FBI executed the PlugX takedown and what it means for organizations. The risks and benefits of law enforcement hacking into private systems to mitigate threats. Preparing for potential third-party access to your network by “authorized” actors like law enforcement or tech vendors. Takeaways: Be aware that “authorized” third parties, such as law enforcement or Microsoft, may access your computers if they’re part of a botnet. Monitor threat intelligence feeds so you’re informed when events like these occur. Proactively communicate with your ISP about their processes for responding to law enforcement notifications. Ensure your contact information is current with your ISP and DNS registrars to avoid communication gaps. Review and update your incident response (IR) and forensics plans to account for potential third-party access. Include scenarios involving third-party access in your tabletop exercises to improve preparedness. Resources: “FBI Hacked Thousands of Computers to Make Malware Uninstall Itself” “The Microsoft Exchange Server Hack: A Timeline” “Taking Down the Waledac Botnet (The Story of Operation b49)” Have thoughts or questions about this episode? Contact us to discuss this and more with other cybersecurity professionals. #cybersecurity #PlugX #PlugXhack #hack #hacker

In Episode 2 of CyberSide Chats, Sherri Davidoff and Matt Durrin dive into the launch of the U.S. Cyber Trust Mark, a new security initiative aimed at making Internet of Things (IoT) devices more secure for consumers. As the number of connected devices continues to rise, the U.S. Cyber Trust Mark promises to help users make informed decisions about the security of products like cameras, smart locks, and voice assistants. Sherri and Matt will discuss the potential impacts of the Cyber Trust Mark and discuss the ongoing challenges of securing IoT devices. They also tackle the rising threat of QR code phishing, as more devices will carry QR codes for secure setup—raising new concerns for consumers. Tune in to learn how this new mark can help protect your privacy and security in an increasingly connected world! Don’t forget to like, subscribe, and share this episode to stay informed on the latest cybersecurity trends! #USCyberTrustMark #cybersecurity #cyberaware

Join hosts Sherri Davidoff and Matt Durrin in this first engaging episode of CyberSide Chats, as they dive into the top cybersecurity priorities for 2025. This insightful discussion was recorded with a live Q & A, and it covers the pervasive influence of AI, the emerging threats of deepfakes, and the complexities of managing third-party risks in an increasingly digital world. This episode not only prepares listeners for the potential challenges of 2025 but also equips them with the knowledge to enhance their cybersecurity measures effectively. Tune in to stay informed and ready for the future!