Zero trust security content examines the principle of never trusting and always verifying every user, device, and connection. Articles explore micro-segmentation, least-privilege access, continuous monitoring, and how organizations transition from perimeter-based defenses to zero trust models.
posts
The Breach That Started With a Single Reused Password In 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations across the entire United States. The root cause? Compromised credentials on a remote access system that lacked multi-factor authentication. One account. No MFA. Billions of dollars in damage. I&
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider social-engineered an MGM Resorts employee through a simple phone call to the IT help desk. That single conversation — not a sophisticated zero-day exploit, not a nation-state attack — led to a ransomware incident that shut
In 2024, MGM Resorts lost an estimated $100 million after an attacker social-engineered an IT help desk employee with a ten-minute phone call. The attacker found a worker's name on LinkedIn, called the help desk, and convinced them to reset credentials. That's it. No zero-day exploit.
A $100,000 Antivirus Setup That Stopped Nothing I worked with an organization in 2024 that had invested heavily in computer security software — endpoint detection, next-gen firewalls, SIEM, the works. They still got hit with a ransomware attack that encrypted 14,000 files and shut down operations for nine days.
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
The $11 Billion Problem You're Probably Ignoring In 2023, the FBI's IC3 received over 21,000 complaints related to business email compromise alone — a category deeply intertwined with account takeover attacks — with adjusted losses exceeding $2.9 billion. That number keeps climbing. And those are just
A single employee at MGM Resorts answered a phone call from someone pretending to be a coworker. That one social engineering attack in September 2023 led to roughly $100 million in losses, a crippled reservation system, and slot machines going dark across Las Vegas. The attacker didn't exploit
A school district in Arizona lost $3.5 million in January 2024 after a single employee followed spoofed wire transfer instructions. The attacker didn't exploit a software vulnerability. They exploited trust. That incident captures why most computer security advice fails — it focuses on tools while ignoring the human
The Breach That Started With "Spring2024!" In 2023, a Verizon Data Breach Investigations Report finding shook the industry: roughly 49% of breaches involved stolen credentials. Not sophisticated zero-day exploits. Not nation-state malware. Passwords. Reused, predictable, phishable passwords. I've responded to incidents where the root cause was
The Breach That Changed How I Think About Cybersecurity In February 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations and medical claims processing across the entire United States. UnitedHealth Group later confirmed that roughly one-third of all Americans may have had their data exposed. The attack vector?
