posts
In 2023, MGM Resorts lost roughly $100 million to a ransomware attack that started with a social engineering phone call. The attackers didn't exploit some exotic zero-day. They called a help desk, impersonated an employee, and got credentials reset. MGM had security tools. What they lacked was a
The Framework Nobody Reads But Everyone Claims to Follow I once walked into a mid-sized financial firm that proudly declared on their website they were "aligned with NIST standards." Thirty minutes into the assessment, I found admin passwords on sticky notes, no multi-factor authentication on critical systems, and
In February 2024, NIST released version 2.0 of its Cybersecurity Framework — the biggest overhaul in a decade. Within weeks, I watched organizations scramble to figure out what changed and what they needed to do about it. Most of them were still struggling to implement version 1.1. Here'
