SecureAre You Taking These 7 Steps to Prevent Ransomware?
Ransomware saw a disturbingly significant increase in both popularity and impact in 2020.
INSIGHTS
Advice from the people who do the work
Written by the engineers who do the work: practical security, compliance, resilience and AI advice. When something in an older post has changed, an editor's note says so.
Featured
Secure
Culture · SecureEffecting Cultural Transformation through 279 OKRs
I lead NorthState’s Technology team, responsible for the networking, systems, business applications and security on which our company and customers depend.
SecureSmall Business Security in 5 Minutes - Day 14 - Take out the trash: Part 1
If you are new to the series please start with Day 1 . If not, welcome back!
CompliantCMMC without the ransom note
A counter to fear-driven CMMC marketing. Kyl frames compliance as a set of habits, illustrated with haiku about protecting CUI and MFA prompts, and calls for a clear plan instead of panic.
Technical library · DependableSyncing files to SharePoint using OneDrive and symbolic links: a step-by-step guide
Sync a local folder to SharePoint without robocopy or scheduled tasks: make the OneDrive folder the source and point a symbolic link at it.
CompliantCMMC Phase II is suspended, but your NIST 800-171 obligations are not
CMMC Phase II assessments were suspended, but DFARS 7012 still requires NIST 800-171, SPRS scores and honest affirmations.
CompliantWhen the "optional" document becomes the one everyone reads
Kyl examines the DoD CIO's voluntary "Brilliant at the Basics" lists, published alongside the CMMC pause, which bring back practices removed in the move to CMMC 2.0. He notes the tension between relieving cost burden and the reappearing expectations.
CompliantThe Revolutionary FAR Overhaul deserves a place on your list
While attention is on CMMC, the Revolutionary FAR Overhaul may renumber every Part 52 provision and clause, which would break clause matrices and templates. Kyl notes that FAR 52.204-21's 15 FCI controls overlap with CMMC Level 1 without being the same obligation, and that public comment is open.
CompliantOne week after the CMMC pause: shape what comes next
A week after the CMMC Phase 2 suspension, Kyl describes a defense industrial base split between relief and alarm, and urges contractors to answer the DoW RFI by August 14, 2026. Meanwhile NIST 800-171 and DFARS 7012 obligations still apply.
CompliantFCI, CUI, ITAR, EAR, FAR, DFARS: the cheat sheet
Kyl argues that confusing federal data and contract terms (FCI, CUI, ITAR, EAR, FAR, DFARS) can end a contract. The terms overlap but aren't interchangeable, and the post links to a plain-English breakdown of all six.
DependableSimplify Business Continuity
I’ve been consulting for about the last 18+ years and have worked with dozens of organizations of all sizes, shapes and even nationalities.
SecureSmall Business Security in 5 Minutes - Day 6 - Who can do what?: Part 1
Hello! If you are new to the series make sure to check out Day 1 .
SecureSmall Business Security in 5 Minutes - Day 4 - Know Thy Stuff: Part 4
Hello! If you are new to this series on securing your small business in 5 minutes per day than you should start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 2 - Know Thy Stuff: Part 2
Day 2: if you are new to this series please start with Day 1 If you are returning, welcome back! So you have pulled together a list of your digital assets, applications and systems...now what to do with the list.
SecureSmall Business Security in 5 Minutes - Day 1 - Know Thy Stuff: Part 1
To get right to it skip the first paragraph... This is the start of a simple mission to reveal, in plain language, the actions you can take to protect your business.
All 59 posts, by topic
Grouped by topic, with our most useful current advice first in each. An editor's note flags anything that has changed since a post was written.
Secure 33 posts
SecurePragmatic vs. “tin foil hat” cybersecurity
Pragmatic security advice balances risk, usability and cost. “Tin foil hat” advice chases unlikely threats. How to tell the difference.
SecurePenetration testing: the audit your cybersecurity needs
Why a penetration test is to security what an audit is to your finances, what a real manual test includes, and how to choose a firm.
SecureFor account takeover, multi-factor is not enough
How a man-in-the-middle phishing page steals a password and an MFA approval in real time, and the controls that stop it.
SecurePassword FAQs
Should you force password changes every 90 days? How long should passwords be? Our answers, based on NIST guidance.
SecureHow to implement effective security awareness training in your business
Build security awareness training around your real risks: key topics, phishing simulations, leadership buy-in, role-based content and measured results.
SecureCommon small-to-medium business data breach incidents and how to prevent them
Phishing, weak or stolen passwords and unpatched systems cause most small business breaches. How to prevent each one.
Secure4 ways we make cyber spend decisions
Popular wisdom, the news, personal bias or a trusted vendor: four common ways security budgets get spent, and why data-driven risk modeling beats all four.
SecureA cyber rose by any other name
A client paid for a penetration test and got a vulnerability scan. Why security service names are so loose, and what buyers should ask before they sign.
SecureSmall business security in 5 minutes, day 1: know thy stuff
Day 1 of our small business security series: spend 5 minutes listing every digital platform, account and device your business relies on.
SecureDigital assets, day 2: know thy stuff
Day 2 of our small business security series: clean up your list of digital assets and delete the accounts, apps and services you no longer use.
SecureSmall business security in 5 minutes, day 3: know thy stuff, part 3
Day 3 of our small business security series: rank each digital asset by how much harm its loss or exposure would cause your business.
SecureDigital asset protection, day 4: know thy stuff, part 4
Day 4 of our small business security series: data you keep is a risk as well as an asset. What to wipe, delete or encrypt first.
SecureFirewall settings, day 5: basic hardening, part 1
Day 5 of our small business security series: check that workstation, server, network and home-office firewalls are turned on and set correctly.
SecureDigital asset access, day 6: who can do what? Part 1
Day 6 of our small business security series: review who can access each digital asset, and remove old, duplicate and over-privileged accounts.
SecureDay 14: take out the trash
Day 14 of our small business security series: find equipment past its end-of-life date, record it, and replace what no longer gets security updates.
SecureDay 15: security awareness
Day 15 of our small business security series: short, regular training and simulated phishing give the best return for most small businesses.
SecureSmall Business Security in 5 Minutes - Day 7 - Who can do what?: Part 2
Howdy, if you are new to this series start with past me on Day 1 ! For the rest of you...you are stuck with present me.
SecureSmall Business Security in 5 Minutes - Day 2 - Know Thy Stuff: Part 2
Day 2: if you are new to this series please start with Day 1 If you are returning, welcome back! So you have pulled together a list of your digital assets, applications and systems...now what to do with the list.
SecureSmall Business Security in 5 Minutes - Day 14 - Take out the trash: Part 1
If you are new to the series please start with Day 1 . If not, welcome back!
SecureSmall Business Security in 5 Minutes - Day 3 - Know Thy Stuff: Part 3
Hello! If you are new to this series please start with Day 1 or if you missed any other days they can all be found Here .
SecureSmall Business Security in 5 Minutes - Day 4 - Know Thy Stuff: Part 4
Hello! If you are new to this series on securing your small business in 5 minutes per day than you should start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 6 - Who can do what?: Part 1
Hello! If you are new to the series make sure to check out Day 1 .
SecureSmall Business Security in 5 Minutes - Day 15 - Security Awareness: Part 1
Howdy, if you are new to the series start here . If you are caught up, welcome back!
SecureSmall Business Security in 5 Minutes - Day 8 - Basic Hardening: Part 2
Salutations, if you are new to the series start here Day 1 . To those who are caught up let's get to it.
SecureSmall Business Security in 5 Minutes - Day 11 - Stopping Malware: Part 1
Hello! If you are new to this series please start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 9 - Security Visibility: Part 1
Hail! If you are new to the series start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 10 - Basic Web Security: Part 1
Hello! If you are new to the series start with Day 1 .
SecureAre You Taking These 7 Steps to Prevent Ransomware?
Ransomware saw a disturbingly significant increase in both popularity and impact in 2020.
SecureSmall Business Security in 5 Minutes - Day 16 - Plan for success: Part 1
Hello! If you are new to this series start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 12 - Digital Crisis Recovery: Part 1
Howdy! If you are new to the series start with Day 1 .
SecureSmall Business Security in 5 Minutes - Day 5 - Basic Hardening: Part 1
Welcome, if you are new to the series start with Day 1 . For those who are all caught up let's continue.
SecureSmall Business Security in 5 Minutes - Day 1 - Know Thy Stuff: Part 1
To get right to it skip the first paragraph... This is the start of a simple mission to reveal, in plain language, the actions you can take to protect your business.
SecureSmall Business Security in 5 Minutes - Day 13 - Digital Crisis Recovery: Part 2
Salutations! If you are new to the series start with Day 1 .
Dependable 4 posts
Dependable4 reasons why BC/DR planning may still be on your to-do list (and help with 3 of them)
Intimidation, budget, the tyranny of the urgent and “we’re too small”: why continuity plans stall, and free help with three of the four.
DependableTrapped in managed service provider (MSP) despair? Actionable strategies for business leaders
Stuck with a mediocre MSP because switching costs too much? Three ways to protect yourself: financial accountability, third-party audits, real references.
DependableThe state of ransomware: an archived snapshot
An archived snapshot of ransomware statistics: costs, attack vectors, downtime, insurance, healthcare and crypto. The figures are historical.
DependableSimplify Business Continuity
I’ve been consulting for about the last 18+ years and have worked with dozens of organizations of all sizes, shapes and even nationalities.
Compliant 9 posts
CompliantCMMC Phase II is suspended, but your NIST 800-171 obligations are not
CMMC Phase II assessments were suspended, but DFARS 7012 still requires NIST 800-171, SPRS scores and honest affirmations.
CompliantAlphabet soup: FCI, CUI, ITAR, EAR, FAR and DFARS, and how to tell them apart
Proprietary data, FCI and CUI nest like Russian dolls. Three questions to tell which you hold, and which rulebook (FAR, DFARS, ITAR or EAR) applies.
CompliantUnderstanding ITAR: what businesses need to know
What ITAR is, what the US Munitions List covers, what counts as an export, and how to tell whether your business must comply.
CompliantOne week after the CMMC pause: shape what comes next
A week after the CMMC Phase 2 suspension, Kyl describes a defense industrial base split between relief and alarm, and urges contractors to answer the DoW RFI by August 14, 2026. Meanwhile NIST 800-171 and DFARS 7012 obligations still apply.
CompliantCMMC Phase II is suspended, but NIST 800-171 is not
On the July 13, 2026 suspension of CMMC Phase II, Kyl explains that only the DFARS 7021 certification gate is paused. DFARS 7012, which requires NIST 800-171, and the SPRS self-assessment duties still apply, and a proposed FAR CUI rule could widen 800-171.
CompliantThe Revolutionary FAR Overhaul deserves a place on your list
While attention is on CMMC, the Revolutionary FAR Overhaul may renumber every Part 52 provision and clause, which would break clause matrices and templates. Kyl notes that FAR 52.204-21's 15 FCI controls overlap with CMMC Level 1 without being the same obligation, and that public comment is open.
CompliantWhen the "optional" document becomes the one everyone reads
Kyl examines the DoD CIO's voluntary "Brilliant at the Basics" lists, published alongside the CMMC pause, which bring back practices removed in the move to CMMC 2.0. He notes the tension between relieving cost burden and the reappearing expectations.
CompliantFCI, CUI, ITAR, EAR, FAR, DFARS: the cheat sheet
Kyl argues that confusing federal data and contract terms (FCI, CUI, ITAR, EAR, FAR, DFARS) can end a contract. The terms overlap but aren't interchangeable, and the post links to a plain-English breakdown of all six.
CompliantCMMC without the ransom note
A counter to fear-driven CMMC marketing. Kyl frames compliance as a set of habits, illustrated with haiku about protecting CUI and MFA prompts, and calls for a clear plan instead of panic.
Relevant 1 post
RelevantThe highs and lows of bug-hunting with LLMs
A date bug that only appeared in Azure Functions, a test harness that hid it, and how an LLM, after some wrong turns, found the root cause.
Technical library 5 posts
Technical library · DependableSyncing files to SharePoint using OneDrive and symbolic links: a step-by-step guide
Sync a local folder to SharePoint without robocopy or scheduled tasks: make the OneDrive folder the source and point a symbolic link at it.
Technical library · DependableProtecting infrastructure with always-on VPN
How an always-on VPN with a pre-logon device tunnel and an MFA-protected user tunnel improves device authentication, user authentication and visibility.
Technical library · CompliantSalesforce file upload: understanding lightning-input type=file vs. lightning-file-upload
CUI and ITAR files should not land in commercial Salesforce. Use lightning-input type=file to send uploads straight to GCC High SharePoint, with code.
Technical library · DependableThe Series: Signed, Sealed, Certified (Part One: What is a Certificate, Really?)
Part One: What is a Certificate, Really? This is going to be the first post of a 10-part series (maybe more) where I break down certificates: what they are, what they do, how they're used, and where trouble might be "creepin' 'round the bend." We're going at this with baby steps first, with a gradual crescendo into the heavier-ish items.
Technical library · DependableThe Series: Signed, Sealed, Certified (Part 2: A Key, or Not a Key? That is the Question)
Part 2: A Key, or Not a Key? That is the Question.
Culture 7 posts
Culture · CompliantThe humility of George C. Marshall, and what it taught me about leadership
Marshall wanted to command D-Day and refused to ask for it. What that taught one of our Principal Engineers about leading to serve, not to be served.
Culture · SecureEmployee Disengagement and Character
I had the privilege of attending the Executive Symposium @CiscoLive this year. The content was great, and I got to hear a number of highly impactful presentations.
Culture · SecureEffecting Cultural Transformation through 279 OKRs
I lead NorthState’s Technology team, responsible for the networking, systems, business applications and security on which our company and customers depend.
Culture · SecureLead from Behind
I’ve just finished listening to “How to Lead When you’re not in Charge” by Clay Scroggins.
Culture · SecureEmployee Retention – the wrong metric?
Anyone that manages highly technical resources has gone through the experience of losing a key team member. It’s painful to lose good people and only natural to think in terms of retention strategies.
Culture · SecureA Pragmatist’s Guide to Corporate Culture
I’ve had a number of friends and colleagues over the years that will either roll their eyes and/or disengage when someone brings up the subject of ‘corporate culture’.
Culture · Secure5 Tips to go from #opentowork to #employed Using LinkedIn
If you are currently searching for a new job opportunity, LinkedIn can be a valuable resource. With over 722 million users worldwide, LinkedIn offers unparalleled access to professional connections and potential employers.
Talk to a Principal Engineer
Got a question one of these posts didn't answer? Ask the engineer who would do the work.
Talk to a Principal Engineer
Prefer email? Send us a note instead.