QPC Security - Breakfast Bytes

Felicia King opens Breakfast Bytes by tearing down the myths around QR codes and taking listeners on a clear, human journey: from frustrated users mistyping long cryptographic secrets to the quiet heroism of modern multi-factor authentication. Through real examples—missed SMS messages with dangerous consequences, stolen mail, and the rise of passkeys—she shows why QR codes often solve real problems, not create them. With an approachable analogy to paper mail, Felicia explains how context, intent, and the tool you scan with determine risk, and why refusing QR codes can cut you off from essential services. This episode is a short, urgent invitation to rethink convenience and security as partners, not enemies. https://qpcsecurity.com/qr-codes-are-not-the-problem-understanding-the-difference-between-convenience-and-risk/ QR Code Misperceptions Discussion Felicia discussed the importance of addressing misperceptions about QR codes, explaining that they are simply graphical encoding formats for storing information such as URLs, phone numbers, or complex data strings. She clarified that QR codes are not complex technology but rather standardized visual formats that can store various types of information. QR Code Security Uses Felicia explained that people use QR codes in two main categories: for facilitating security through multi-factor authentication and secure enrollment, or for malicious purposes. She emphasized that QR codes themselves are not inherently risky, comparing them to barcodes on products, where the risk comes from how they are used rather than the technology itself. Multifactor Authentication User Experience Challenges Felicia discussed the challenges of multifactor authentication, particularly the inconvenience of manually typing long security codes exceeding 256 characters. She emphasized that while security is important, the technology must remain user-friendly to prevent frustration and abandonment. Felicia noted that if users struggle too many times, they will give up, making the alternative solution unacceptable. QR Code Security Concerns Discussion Felicia discussed the security concerns surrounding QR codes, comparing them to receiving mail and emphasizing the need to differentiate between trusted and untrusted sources rather than avoiding them entirely. She explained that QR codes are commonly used for multi-factor authentication enrollment from reputable providers like Microsoft 365, Google, and Proton, and noted that SMS-based MFA mechanisms will be phased out starting Q4 2026. Felicia highlighted the unreliability of SMS delivery, particularly in urgent situations, using examples of elderly individuals trying to transmit time-sensitive medical information. SMS Security Risks Discussion Felicia discussed the security risks of SMS messaging, explaining that it cannot be verified who is sending messages or confirm their delivery, making it "atrociously insecure" and high-risk. She noted that many organizations have moved away from SMS-based authentication, including the Social Security Administration, which switched to the ID.me system with more intensive multi-factor authentication requirements. Felicia suggested that people who prefer not to use QR codes for authentication might need additional training, as digital interaction is increasingly common even for basic activities like email use. Multi-Factor Authentication Evolution Felicia discussed the evolution of SMS as multi-factor authentication, noting that it was implemented around 2014 but is being discontinued. She explained that modern systems, including those used by the state of Wisconsin, are moving toward more secure authentication methods such as 6-8 digit rolling codes and pass keys. Felicia highlighted that while Microsoft 365 offers sophisticated security features, these are exceptions rather than the standard in most systems, which typically rely on basic username-password combinations with multi-factor authentication. QR Code Security Best Practices Felicia explained the difference between safe and risky uses of QR codes, particularly in the context of multi-factor authentication (MFA) enrollment. She clarified that QR codes used for MFA enrollment are secure as they function as graphical representations of cryptographic keys, which should be scanned using authenticator applications like Microsoft Authenticator, Google Authenticator, or password managers. Felicia warned against scanning random QR codes found in advertisements or public places, as these could potentially lead to malicious websites. She also noted that the negative perception of QR codes stems from their association with control mechanisms used during COVID-19, such as contact tracing. Security and Digital Authentication Models Felicia discussed the importance of understanding shared responsibility models in security, particularly regarding QR codes and multi-factor authentication. She explained that completely avoiding digital systems, including QR codes, is not practical in today's world, as many essential services require digital verification. Felicia provided an example of a stolen tax refund check to illustrate how physical mail can be insecure, emphasizing that digital alternatives like direct deposit are more secure. She concluded by noting that QR codes themselves are not inherently problematic, but rather the source and context of use are important considerations.

Felicia King interviewed Robin Grayson of Redcliffe Technology Services about artificial intelligence in software development. Robin, a programmer with 30 years of experience, discussed the importance of maintaining rigorous software development practices when using AI tools like Claude, emphasizing the need for proper guardrails, documentation, and security reviews. He explained his approach of treating AI-assisted development like working with a highly skilled junior developer, including using Azure DevOps for enterprise applications and setting up markdown files with instructions for AI to follow. Robin highlighted significant security concerns when non-technical people use AI to develop applications without proper oversight, potentially exposing sensitive systems and data to risks. He also discussed the importance of security-first development and using AI for code reviews to identify security vulnerabilities in existing codebases. https://www.redcliffesystems.com/ Software Development Evolution Discussion Robin discussed the evolution of software development practices, highlighting how developers in the past had to be more meticulous due to limited resources and the absence of modern tools like Stack Overflow. He emphasized the importance of understanding hardware, networking, and security, which many current software developers lack due to their limited exposure to physical infrastructure. Felicia agreed with Robin's points, noting the challenges faced by developers with limited real-world experience in networking and server management. Software Development Best Practices Robin discussed challenges with software development, particularly when projects are rushed into production without proper planning. He explained his approach to AI development by treating it like a highly skilled junior developer, emphasizing the importance of following proper development processes including isolated branches, pull requests, and code review. Robin highlighted that while some developers adequately review code, others simply approve pull requests without properly examining the changes. AI Integration in DevOps Workflow Robin described his approach to integrating AI, specifically Claude, into his software development workflow by establishing clear processes and requirements. He demonstrated this by setting up a DevOps board in Microsoft Azure and configuring Claude to follow specific steps, including accessing the board, moving items through development stages, and creating pull requests. Robin also explained the use of markdown files for documentation, which allows for easy tracking of changes, reviews, and testing evidence within the source control system. Markdown Documentation Process Implementation Robin explained that markdown files serve as source instructions and guardrails for Claude's work, making it more efficient than using Word documents and easier for team members to review. Robin also described implementing a system where Claude generates documentation for every change, which is checked in alongside pull requests for team review. The discussion concluded with Robin expressing concerns about "vibe coding" where non-technical users create applications without understanding the security implications, leading to potential security vulnerabilities like hardcoded credentials in source control. AI Code Development Security Guidelines Felicia and Robin discussed the importance of proper guardrails and instructions when using AI for code development assistance to prevent security risks. Robin highlighted concerns about developers giving AI systems excessive permissions without understanding the implications, while Felicia emphasized the need for better oversight processes, particularly regarding third-party information security risks when businesses use external partners' services. Both agreed that the current lack of proper review and consent processes creates significant security vulnerabilities when non-developers implement and deploy applications connected to critical systems like Microsoft 365 tenants. Data Security Governance Requirements Felicia and Robin discussed governance oversight and regulatory requirements around data security and disclosure in the UK and US. They highlighted the severity of failing to disclose material security facts, referencing regulations like GDPR and FTC regulations, and emphasized the importance of security in software development, particularly with AI and IoT devices. The conversation ended with Felicia asking Robin about their thoughts on using Azure DevOps versus GitHub, but this part of the discussion was not captured in the transcript. AI-Driven Application Security Assessment Robin advised using Azure DevOps for closed-source enterprise applications and GitHub for open-source projects. When asked about application security assessment, Robin suggested using AI tools like Claude with appropriate security standards and noted that AI can perform comprehensive security reviews of code bases, though it's important to monitor token usage during these reviews. Source Code Review and Issues Robin reviewed the source code and identified top issues that need immediate fixes, along with additional concerns to address in the future. Felicia expressed appreciation for the discussion about empowering developers with AI capabilities, noting how this could help overcome limitations in existing third-party tools. 

Felicia King opens Breakfast Bytes with two vivid vendor-vetting stories: a positive case involving a law firm engagement where clear communication and economic impact assessment resolved concerns before moving forward, and a negative case involving a UK-based consultancy reselling SaaS licenses where fraudulent billing practices occurred. Through these contrasting narratives—responsive attorneys who clarified costs versus a buggy reseller that billed months later—Felicia lays out the simple, powerful checks that prevent disputes: ask scenario questions, demand sample invoices, review service-attach schedules and data subprocessors, and get commitments in writing. Remember: payment is acceptance; lack of payment is lack of consent. Short, practical, and sharply told, this episode gives you the red flags to watch for and the exact questions to ask so you never get stuck paying for a service you never agreed to. Felicia emphasized the importance of reviewing vendor agreements carefully, asking scenario-based questions about billing processes, requesting sample invoices, understanding data subprocessors, and payment collection methods. She stressed that legitimate businesses should disconnect services immediately when payment is not received, avoid using collections agencies, and provide clear renewal processes, warning that red flags include unclear billing terms, hidden auto-renewal clauses, and refusal to share service attached schedules. Ask prospective vendors scenario-based questions about billing, non-payment consequences, and service continuation before accepting their agreement. Request a sample invoice from the vendor to ensure clarity and transparency in billing practices. Inquire about the vendor's service attached schedule and data subprocessors before engaging in business. Ask the vendor about their payment processing system and how they handle collections. Verify the vendor's policy on non-renewal and service deprovisioning in case of non-payment.   Vendor Risk Assessment Process Felicia discussed vendor risk pre-assessment and billing discrepancy issues, using a personal injury law firm case as an example of effective vendor vetting. She described how they developed criteria to evaluate law firms, scheduled calls, reviewed agreements, and addressed unclear terms regarding reimbursable expenses. The process included engaging with the attorney and their staff to clarify costs and ensure alignment before moving forward with the engagement. UK Consultancy Software License Issues Felicia discussed a negative experience with a UK-based consultancy that was reselling software licenses and providing consulting services to U.S. companies. She identified a key red flag that should have prompted ending the engagement: a disconnect between the consultancy and their software vendor, including conflicting requests about demo data in the tenant. Felicia noted that these issues could have been detected earlier to avoid problems. UK Software Vendor Billing Issues Felicia discussed issues with a software vendor from the UK that had numerous bugs and problematic billing terms. She explained that the vendor's billing agreement allowed them to bill customers irregularly and potentially not at all, which is unacceptable for month-to-month services in the United States. Felicia highlighted examples of confusing invoices with identical service terms but different invoice numbers, describing this as intentional misrepresentation. She recommended that companies should ask potential vendors about their billing practices before starting business relationships. IT Billing and Payment Policies Felicia discussed billing practices and payment policies for IT services, explaining that services are turned off when payment is not received and emphasizing the importance of clear invoicing and consent. She advised reviewing vendor agreements, asking scenario questions, and obtaining sample invoices to ensure transparency. Felicia also highlighted the significance of reviewing service attached schedules to understand third-party risk management and data subprocessors in the supply chain. Transparent Vendor Billing Practices Felicia discussed the importance of transparent billing practices and payment structures in vendor relationships. She emphasized that the use of collections agencies should be a red flag, particularly for smaller consulting firms, as it often indicates poor business practices or fraudulent billing. Felicia recommended a straightforward approach where services are billed upfront or monthly, with disconnection if payment is not received, and suggested providing 90-day advance notice for renewals. Vendor Non-Renewal Policy Discussion Felicia discussed the importance of understanding vendor policies for non-renewal processes, emphasizing that vendors should make it easy for customers to self-manage if they don't want to renew. She highlighted the need to inquire about data handling when services are discontinued due to non-payment, warning that some vendors may retain customer data even after services are turned off, which she described as mismanagement.

Join Felicia King on Breakfast Bytes as she exposes the broken paradigms behind how small and medium businesses manage their websites. Through clear, hard-earned advice and real-world examples, she shows why handing everything to a web vendor leads to lost continuity, failed deliverability, and missed sales — and how a shared-responsibility approach with the right CTO and tools restores control and effectiveness. From domain ownership and DNS to WordPress hosting, contact-form delivery, and email authentication (DMARC, DKIM, SPF), Felicia walks listeners through the practical steps to secure and optimize a website that actually connects with prospects. Whether you’re deciding between affordable managed WordPress plans or choosing the right frameworks, you’ll leave with a framework for ownership, documentation, and a small, sustainable maintenance plan that preserves business continuity and boosts outcomes.   Website Management Challenges for SMBs Felicia discussed the common challenges small to medium businesses face with their websites, emphasizing that it's a paradigm issue rather than just a vendor selection problem. She identified key concerns including business continuity, ownership, and understanding risk associated with websites as critical public-facing organizational presence. Felicia noted that past paradigms for website management no longer work effectively and haven't been functional for at least the last six years. Website Effectiveness and Optimization Felicia discussed website effectiveness and shared insights about what doesn't work well, mentioning Matt Diggity as an authoritative resource on website optimization. She explained that website effectiveness involves connecting with prospects, accurately representing the organization's activities, and facilitating business objectives like email marketing and CRM systems. Felicia specifically highlighted that contact forms are often problematic and can reveal inadequate technology providers or website consultants. Domain Hosting Best Practices Felicia strongly advised against having website development or management companies host domain and DNS, warning that this creates migration issues and potential problems if separating from the company. She emphasized her 30 years of experience in recommending that domain and DNS hosting should be either internally owned or managed by a chief technology officer rather than outsourced to web development companies. WordPress CMS Benefits Discussion Felicia discussed the benefits of using WordPress as a content management system, highlighting its market share and security improvements. She emphasized that businesses should own their WordPress.com accounts rather than paying monthly fees to manage basic features like automated backups and security. Felicia recommended quarterly check-ins with a CTO for website health monitoring and suggested a total annual cost for website hosting and tooling ranging from $1,200 to $3,000. Website Management and WordPress Strategy Felicia discussed the importance of maintaining direct involvement in website management rather than delegating it entirely to others, emphasizing that outsourcing key aspects like SEO is ineffective due to constant changes in the field. She highlighted the benefits of using WordPress.com, including built-in features like WooCommerce and Stripe integration, which are not commonly promoted by web developers whose business model relies on delegation. Felicia also warned about the potential negative impact on website performance when switching to third-party services, citing examples of companies whose statistics declined after using website mills. Website Contact Form Email Configurations Felicia discussed the importance of having effective contact forms on websites, emphasizing the need for proper email deliverability and anti-spam protections. She highlighted common issues with third-party web developers' inadequate handling of DMARC, DKIM, and SPF configurations, which can lead to undelivered emails. Felicia also criticized the use of certain email services like SendGrid, suggesting they are poorly configured for effective communication. Email Deliverability and Security Issues Felicia discussed email deliverability issues, specifically highlighting problems with a website using SendGrid for multi-factor authentication (MFA) that resulted in 100% undeliverable emails due to improper implementation. She emphasized that most organizations fail basic email security standards like DMARC, DKIM, and SPF, and criticized the widespread technical incompetence in email deliverability management despite these standards being established over a decade ago. AI Search Optimization and Control Felicia discussed the importance of AI search optimization for websites and criticized the practice of delegating website management entirely to external third parties. She argued that spending significant monthly fees on SEO management without proper expertise or results constitutes fraud, describing it as a "dead paradigm." Felicia emphasized that business owners should remain involved in their website management rather than abdicating all responsibility to external companies. Shared Website Management Responsibility Felicia discussed the importance of a shared responsibility paradigm for website management, emphasizing that outsourcing everything or trying to do it all independently doesn't work effectively. She explained that the ideal approach involves working with a CTO on a project to set up the website, with monthly check-ins to support internal team members in learning SEO and content management. Felicia stressed the need to start with clear requirements before seeking proposals from vendors and highlighted the importance of maintaining a professional public-facing security posture through proper website and email configuration.

Felicia King pulls back the curtain on Windows 365 Cloud PCs and takes you on a journey from the chaos of shipping laptops to the precision of cloud-hosted workstations. Through real-world examples—remote hires across continents, a surveillance system rescued from theft, and the thorny case of legacy apps—she shows how moving the PC to the cloud transforms logistics, security, and performance. The episode dramatizes the stakes: stolen hardware, data exfiltration, and transatlantic latency versus a low-latency Microsoft backbone, regional Cloud PC placement, and tight policy controls. Felicia balances costs, practical limits (hello, South Africa), and alternatives like Azure Virtual Desktop, turning technical tradeoffs into human-centered decisions. Listen in for clear, no-nonsense guidance, vivid field-tested anecdotes, and a final note: the right rollout needs networking wizards. If you manage remote teams or sensitive data, this episode reframes what a desktop can be—and what it should cost you to keep your business safe. Felicia King discussed Windows 365 Cloud PCs, explaining their costs, use cases, and limitations. She outlined that Cloud PCs are suitable for remote workers, particularly those in foreign countries, as they allow for better performance and security without the need to deploy physical hardware. Felicia highlighted the importance of selecting the correct region to minimize latency and discussed the challenges of using Cloud PCs in areas like South Africa due to poor connectivity. She also explained the benefits of using Azure Virtual Desktop for larger-scale deployments or legacy applications requiring Active Directory. Felicia emphasized the security advantages of Cloud PCs, including the ability to control network connections and prevent data exfiltration, and suggested that they could be a cost-effective solution for remote workers when combined with devices like the Microsoft 365 Link. Windows 365 Cloud PCs Overview Felicia discussed Windows 365 Cloud PCs, explaining that they are cloud-based computers accessible only through a business's Microsoft 365 tenant and Azure Active Directory. She noted that the baseline cost for a suitable business implementation is over $2,000 per year, requiring proper management and maintenance. Felicia mentioned that Windows 365 Cloud PCs are particularly beneficial for remote workers in business environments. Remote Work Challenges and Solutions Felicia discussed the challenges organizations face with remote working, particularly regarding equipment deployment and recovery for employees in different countries. She explained how Windows 365 cloud PCs could address these issues by allowing organizations to host virtual desktops in region-specific data centers, which would improve performance and reduce latency for remote workers. Cloud PC Regional Positioning Strategy Felicia discussed the benefits of positioning cloud PCs in regions near workers, explaining how this reduces latency and improves performance. She emphasized the importance of being on the Microsoft backbone for enhanced connectivity to Microsoft services and other cloud resources. Felicia noted that while this approach significantly improves performance, there is currently no South Africa region available for Windows 365 cloud PCs. Microsoft Teams Connectivity Challenges Felicia explained that Microsoft cannot currently make Microsoft Teams work effectively for South Africa due to poor connectivity between South Africa and the United States, with data routes going through Europe or taking a high-latency route through Brazil. She noted that Azure Virtual Desktop could be a solution but only becomes economically feasible for 15-20 endpoints or more, requiring significant administrative overhead. Felicia identified two main use cases for Azure Virtual Desktop: when organizations need large quantities of low-latency workstations close to users, or when they are using legacy technology requiring Active Directory like Great Plains or Solomon systems. Windows 365 Cloud PC Limitations Felicia discussed the limitations of Windows 365 Cloud PCs, noting that they cannot be joined to Active Directory unlike Azure Virtual Desktop. She explained her current use of Windows 365 Cloud PC for printing and accessing on-premises resources through custom networking and secure edge agents. Felicia also shared an example of using cloud servers for a business that wanted to avoid on-premises hardware after experiencing a break-in, implementing a solution with microSD card caching for camera recordings. Windows 365 Cloud PC Implementation Felicia explained the implementation of a Windows 365 cloud PC for a customer, which provides secure high-performance access to their video management system and other applications from anywhere. She described how this solution allows users to access a full desktop experience from any device while maintaining security through restrictions on copy-paste functionality between the local and cloud environments. Felicia noted that while complete data security is impossible, the cloud PC provides significant protection against data exfiltration compared to traditional local computing. Cloud PC and Microsoft 365 Link Felicia discussed the benefits of cloud PCs, highlighting their security features and ease of management compared to traditional hardware. She introduced Microsoft 365 Link, a new device with a downsized operating system priced around $400 with an optional $100 warranty, which can support up to two monitors. Felicia explained that these devices can be accessed with Microsoft 365 accounts, similar to Google Workspace. Windows 365 Cloud PC Implementation Felicia discussed the use case for Windows 365 cloud PCs, particularly for remote workers, emphasizing enhanced security and control over data and network connections. She explained how cloud PCs can mitigate risks associated with data exfiltration and hardware security, especially for sensitive roles like accounting. Felicia noted that while cloud PCs may be more expensive than traditional hardware, they offer better security and compliance benefits and suggested using them in conjunction with Microsoft 365 Link PCs for remote workers.

Host Felicia King sits down with Rick Hernandez, CEO of N2Con, to unravel a common but dangerous IT story: assessments that miss the point and audits that leave companies exposed. Through candid examples—lost laptops, stale Active Directory entries, and policies that never existed—they set the stage for a real-world investigation into how businesses really manage (or mismanage) their digital assets. As the conversation deepens, the tension grows: accounting firms deliver check-the-box reports, old tools miss cloud realities, and well-meaning assessments become expensive paperweights. Felicia and Rick walk listeners through the messy discoveries they encounter when onboarding clients, and the moment when a seemingly small gap in inventory can lead to a major security and financial risk. Instead of one-off reports, the episode offers a roadmap—pick a practical framework, insist on executive buy-in, adopt continuous vulnerability management, and own your asset and compliance data. Short, vivid, and tactical, this episode turns audit horror stories into clear next steps for any organization ready to take responsibility for its security.   Quick recap Felicia King and Rick Hernandez discussed challenges around assessments and audits in cybersecurity, particularly focusing on the issues that arise when clients approach MSPs after undergoing assessments with accounting firms. They explored how many organizations lack proper asset inventories and off-boarding processes for equipment, leading to security gaps and compliance challenges. The conversation highlighted the problems with one-time security assessments, with both speakers agreeing that a more effective approach involves implementing continuous monitoring tools and establishing proper frameworks like NIST or CMMC before seeking external assessments. They discussed how many organizations waste money on incomplete assessments from firms lacking proper cybersecurity expertise, and emphasized the importance of executive buy-in and proper risk prioritization for successful security implementations. Asset Inventory Management Challenges Felicia and Rick discussed challenges with asset inventory and management in businesses. They highlighted the importance of having an accurate inventory for security purposes and noted that assets are often tracked in various systems, including accounting, spreadsheets, and ticketing systems. They also addressed the issue of tracking assets allocated to employees, particularly when they leave the company, emphasizing the need to reclaim company property, especially devices containing sensitive data. https://www.watchguard.com/wgrd-security-hub/secplicity-blog/security-gap-lets-attackers-walk-right Equipment Disposal and Data Security Rick and Felicia discussed the implementation of a new policy regarding equipment disposal and data security. The policy now requires proper wiping and decommissioning of equipment before it can be given to departing employees, who can then purchase it if desired. They emphasized that the previous approach of simply giving equipment to employees without proper data wiping was ineffective and potentially harmful to the company's data security. Asset Inventory and Off-boarding Processes Felicia and Rick discussed the importance of maintaining an accurate asset inventory and proper off-boarding processes for systems. They highlighted how common it is to find stale data and unmanaged assets in systems like Active Directory and Bitdefender platforms, often due to lack of formal off-boarding procedures. Felicia emphasized that an asset management platform can be cost-effective and significantly improve system maintenance efficiency. IT Asset Inventory Management Discussion Felicia and Rick discussed the importance of maintaining accurate IT asset inventory and lifecycle tracking, emphasizing that relying solely on IT vendors for documentation is insufficient. They highlighted how understanding equipment lifecycles can help IT managers forecast future replacement costs and plan accordingly. The conversation then shifted to addressing challenges when dealing with clients who approach Managed Service Providers (MSPs) after undergoing formal assessments or audits conducted by accounting firms, with Felicia noting the need to distinguish between assessments and audits in the IT context. Traditional Security Assessment Limitations Rick and Felicia discussed the limitations of traditional security assessments conducted by accounting firms and less experienced providers. They agreed that many existing assessment tools and methods are outdated, particularly in modern cloud environments where traditional network discovery techniques no longer work effectively. Both expressed skepticism about the reliability of assessment data from less experienced firms, with Rick noting he always questions the tools used in such assessments. Assessment Report Scope Issues Rick and Felicia discussed issues with assessment reports, particularly when the scope and intent of the assessment are unclear. Rick explained that while this information might be found in the initial statement of work, it's not typically included in the final report, which can lead to questions about the report's legitimacy. Felicia expressed concern about the lack of clear scope information in reports, describing the situation as potentially indicating "amateur hour" work. Risk Assessment Method Discussion Felicia and Rick discussed their concerns about assessment approaches, with Felicia expressing that she prefers a focused risk-prioritization method rather than comprehensive audits. They agreed that organizations typically already know their major risks, and leadership interviews can quickly identify key concerns. The conversation ended with them beginning to discuss how to approach clients who come seeking help after an audit, though the specific details were not captured in the transcript. Security Implementation Challenges Discussion Felicia and Rick discussed common scenarios where organizations seek help after conducting initial assessments with other firms that lacked proper implementation expertise. Rick explained that when clients approach his team, they often have gaps in their previous assessments and have become overwhelmed. They both emphasized the importance of executive management buy-in for successful implementation of security controls, with Rick noting that his team will walk away if they don't have proper support from the top leadership. Cybersecurity Framework Implementation Discussion Rick and Felicia discussed the importance of proper cybersecurity framework implementation and the pitfalls of one-time vulnerability assessments. They agreed that organizations should first establish a policy and framework, then implement continuous monitoring tools rather than paying for external assessments. Felicia emphasized that organizations should own their tools and processes, while Rick acknowledged that most IT personnel and MSPs lack the security expertise to properly implement complex controls without creating additional risks.

Topics Summary Join CTOs Felicia King and Shimon Magal for a candid, off-the-cuff conversation that pulls back the curtain on Microsoft Secure Score. They explore its strengths and sharp limitations—where it guides security improvements, where it pushes licensing, and why it falls short for real compliance and legal attestation. Through real-world MSP and enterprise scenarios, they reveal the importance of risk-prioritized, continuous configuration management, explain how compensating controls and human workflows matter, and outline why non-tamperable reporting and the right licensing are critical. Whether you’re an MSP or an in-house security leader, this episode challenges assumptions and offers a practical roadmap to turn Microsoft security metrics into defensible, actionable posture management. Shimon is the CTO for Optimize365.io https://www.optimize365.io/ Microsoft Secure Score Limitations Shimon and Felicia discussed the limitations of Microsoft's Secure Score tool, which Felicia described as being Microsoft-centric and not providing comprehensive compliance reports. They agreed that while Secure Score could be useful as a baseline assessment, organizations need more specific controls for compliance with frameworks like CIS, NIST, or HIPAA. Felicia emphasized that the tool's accuracy is crucial for meaningful risk assessment, though she acknowledged that technology assessments must evolve as the tools themselves change. Challenges with Secure Score Assessment Shimon and Felicia discussed the limitations and challenges of Secure Score, a Microsoft tool for assessing security posture. They highlighted that Secure Score's scoring system is not equally weighted across all aspects, making it difficult for organizations to improve in specific areas. Felicia emphasized that Secure Score is primarily used to sell more Microsoft licensing rather than providing meaningful insights for improving security. They also discussed the importance of generating legal attestation reports and tracking changes over time, which Secure Score does not support effectively. Felicia suggested the need for a more comprehensive assessment platform that can produce meaningful reports, facilitate workflows, and provide a customer-facing portal for better visibility and control. Enhancing Risk Assessment Tools Felicia and Shimon discussed the limitations of Secure Score, noting that it does not account for complementary tools or manual processes, which are crucial for compensating controls. They emphasized the importance of incorporating both technical and human components into risk-prioritized assessments and attestation workflows. Secure Score Compliance Challenges Felicia expressed deep concern about MSPs using Secure Score as a fee-based service without generating legally valid attestation reports, emphasizing the importance of non-tamperable documentation for legal proof and compliance. She highlighted the need for automated systems to generate and publish reports to a secure repository, ensuring retention policies align with legal requirements. Shimon agreed on the shortcomings of Secure Score for MSPs and the need for a robust workflow that includes documentation repositories to meet business and legal needs. M365 Licensing and Security Management Felicia discussed the importance of having the right licensing, such as Entra IDP2, to access proactive real-time controls and data from Microsoft 365. She emphasized that alerting and diagnostics tools like Petra Security and Optimize can be beneficial for MSPs, but they should not replace Entra IDP2 licensing. Felicia also stressed the need for consistent, regular proactive secure configuration management as a service, not a one-time project, and advised MSPs to ensure their M365 tenants have this service or have explicitly declined it.

On Breakfast Bytes, host Felicia King sits down with Jane Conners—a California attorney with deep expertise in governance, risk, compliance, and the new frontier of AI privacy—to unpack a hidden threat stalking small and medium businesses: asymmetrical contract power. From click‑wrap traps and rogue shadow IT to agentic AI that quietly folds your data into someone else’s model, Jane frames a vivid narrative of how everyday procurement decisions can become serious legal battles. Through sharp anecdotes and practical rules of thumb—start renewals six months early, demand clear SLAs and exit language, insist on an ‘unlearn’ right, and adopt a stepped early dispute resolution process—Jane maps a fast, pragmatic path out of years‑long litigation nightmares. Tune in to learn how to turn diffuse legal risk into focused strategy and get back to running your business.   Quick recap Felicia and Jane discussed dispute resolution mechanisms for small and medium-sized businesses (SMBs) in the context of vendor contracts, particularly focusing on asymmetrical bargaining power and the challenges SMBs face when negotiating with larger technology vendors. Jane explained the importance of implementing a structured procurement process and highlighted the benefits of early dispute resolution frameworks, which can help resolve disputes within 100 days through a four-step process involving executive-level negotiations and risk-adjusted value analysis. They discussed specific strategies for SMBs, including negotiating renewal terms 6 months in advance, being cautious with shadow IT that can lead to binding legal traps, and ensuring clear definitions around service security failures versus data breaches in contracts with MSPs and MSSPs. Jane also emphasized the need for SMBs to negotiate the right to "unlearn" their proprietary data from AI systems and to explicitly define liability caps in contracts. Small Business Contract Negotiation Strategies Jane discussed her background in dispute resolution and highlighted the challenges small businesses face when negotiating contracts with SaaS vendors and other service providers. She emphasized the increasing asymmetry in bargaining power, particularly with the rise of agentic AI, and the issue of click-wrap agreements that small businesses often accept without legal review. Jane suggested that small businesses should focus on developing effective strategies to protect themselves from liability and navigate disputes with vendors. Vendor Negotiation Strategies and Policies Felicia emphasized the impact of asymmetrical bargaining power in vendor relationships, urging small to medium businesses to develop rigorous procurement policies. Jane shared strategies for negotiating with vendors, highlighting the potential for significant price reductions if renewals are planned six months in advance. She also advised focusing on aspects beyond pricing, such as data privacy and security standards, and emphasized the need for clear exit strategies, particularly in the context of agentic AI. Negotiation Clauses for Business Contracts Jane and Felicia discussed the importance of negotiating clauses for unlearning and controlling costs in business contracts, particularly for enterprise clients and early-stage startups. They highlighted the need for clear processes around procurement to avoid unexpected expenses and risks. Jane also explained the different types of dispute resolution mechanisms available, including mediation, arbitration, and neutral case evaluation, emphasizing the importance of choosing the right process to resolve disputes efficiently. AI Dispute Resolution Platforms Jane explained a dispute resolution methodology that aims to resolve cases within 60 days, involving risk-adjusted value analysis and structured negotiations. She highlighted the use of digital first arbitration platforms, including JAMS, which have implemented new rules for AI and machine learning disputes. These platforms help contain technical discovery, manage security, and address unique conflicts related to AI training and utilization. Enhancing EDR for Business Success Jane discussed the challenges and inefficiencies of traditional arbitration and litigation, particularly for small and medium-sized businesses. She highlighted the benefits of early dispute resolution (EDR) frameworks, which involve a structured process to identify issues, assess risks, and facilitate principled negotiations. Jane emphasized the importance of clear contract terms, including specific service level agreements (SLAs) and liability caps, to protect businesses from vendor leverage and unexpected costs. She recommended that businesses review and modernize contracts 6 months before renewals, be vigilant about shadow IT, negotiate stepped ADR processes, and ensure the right to unlearn AI-driven data.

Felicia King takes you inside a cautionary tale — from the head of a major cybersecurity agency accidentally feeding confidential memos into a public AI, to small businesses unknowingly making their data the price of a "free" account. Through sharp examples and blunt truth, she shows how missing policies, licenses, and training turn promising tools into breach vectors. Then she guides you through a practical playbook: the shared-responsibility model, paid licensing, demonstrable due care, and professional operational maturity. With vivid stories of project estimates, productivity boosts, and AI acting as an engineering assistant, Felicia reveals how the right guardrails can transform AI from a liability into the competitive edge that moves the impossible into the possible.   Felicia discussed the importance of implementing proper governance structures and training for artificial intelligence technologies to prevent businesses from being victimized by them, highlighting the role of employees as potential security risks. She emphasized the need for consistent policies and risk management when using AI tools like ChatGPT and Copilot, while also addressing concerns about data privacy and proper licensing in financial technology. Felicia stressed the importance of operational maturity and shared responsibility in managing resources securely, particularly for small organizations, and discussed how AI can enhance business productivity and enable better project planning when guided by experienced professionals. Summary AI Governance and Employee Training Felicia discussed the importance of implementing governance structures and providing training for artificial intelligence technologies to prevent businesses from being victimized by them. She highlighted that employees often serve as the weakest link in cybersecurity, using a recent incident involving the head of CISA as an example. Felicia emphasized the need for consistent policies and training, even for high-ranking officials, to avoid exceptions that can lead to security breaches. AI Risk Management Strategies Felicia discussed the risks associated with using AI tools like ChatGPT and Copilot, emphasizing the need for proper risk management and operational maturity when implementing such technologies. She highlighted that while these tools can be beneficial, they also pose potential risks that need to be addressed through appropriate governance, controls, and training. Felicia used the example of bank wire transfers to illustrate how even basic technologies require risk management, and she suggested that similar principles should apply to AI usage in businesses. AI Licensing and Data Protection Felicia explained that using AI tools like ChatGPT requires a paid plan rather than a free one, as free plans often exploit user data. She used the example of Better Tracker, a tool designed for CFOs to automate and categorize technology expenses, emphasizing the importance of proper licensing and data protection in financial technology. FinTech Privacy and Security Concerns Felicia discussed the functionality of FinTech tools like Better Tracker, which connects to digital banking accounts to automate transaction data population into expense management platforms. She emphasized her decision not to use Better Tracker due to concerns about data privacy, as the service required connecting bank and credit card accounts, making users the product. Felicia also shared experiences of recent data breaches involving Microsoft 365 tenants, highlighting the importance of proper licensing and security measures for businesses. Shared Responsibility in Cloud Services Felicia explained the shared responsibility model between service providers like Microsoft and Google, and their customers, emphasizing that customers are primarily responsible for managing their rented accounts securely and professionally. She clarified that issues with Microsoft 365 tenants cannot be resolved by switching to Google Workspace, as both platforms follow similar shared responsibility models. Felicia also highlighted that customers need to ensure proper management of their resources to maintain privacy, security, and data availability. Operational Maturity and Security Management Felicia discussed the importance of operational maturity and shared responsibility in managing resources, emphasizing that businesses need to meet certain expectations to avoid higher costs and inconveniences due to outages and compromises. She highlighted the need for businesses to demonstrate due care and due diligence through technical controls and regular gaps assessments with implementation plans to limit liability in case of a breach. Felicia also mentioned her previous work on legal defensibility and security models, as well as insights from a breach attorney about the importance of proving demonstrable progress in security improvements over time. Cybersecurity Investment for Small Organizations Felicia discussed the importance of data protection and operational maturity for small organizations, highlighting that investing in cybersecurity measures, such as professional maintenance, can significantly impact an organization's security posture and readiness for technologies like AI. She emphasized that the cost of proactive cybersecurity measures, which she compared to maintaining a car for emergency situations, is minimal compared to the potential benefits, including improved operational stability and readiness for future opportunities. AI for Business Productivity Enhancement Felicia discussed the importance of AI in business survival, particularly in the face of a competitive squeeze that began in 2025. She emphasized that AI should be used to enhance the productivity of existing employees rather than focusing solely on hiring younger workers. Felicia explained that by providing AI tools like Copilot, along with customized training and fractional CTO guidance, companies can effectively double the value of their employees, particularly those earning higher salaries. AI and Experienced Engineers Collaboration Felicia discussed the importance of experienced engineers in leveraging AI for feasibility assessments and project planning. She emphasized that AI, when guided by experienced professionals, can transform impractical or impossible tasks into manageable ones by providing accurate time estimates and project plans. Felicia also highlighted that AI can reduce risks, boost staff productivity, and enable the development of in-house software, thereby reducing dependency on commercial off-the-shelf solutions.

Felicia King opens Breakfast Bytes with a sharp, practical question: is the “juice” you get from a centralized email signature platform worth the “squeeze” it takes to implement it? Through a series of real-world examples and clear stakes, she walks listeners from small teams that should keep signatures simple to larger organizations that need policy, tooling, and operational rigor. Along the way she exposes the conflict: marketing wants shiny banners, IT worries about deliverability and DNS changes, and third parties may see your outbound mail or inject tracking pixels. When signatures are mishandled, the consequence is not just ugly formatting — it can become a genuine business problem, even a “sales prevention” issue. Felicia closes with practical resolution: write a policy, empower managers, and choose platforms that preserve data sovereignty and utilize role-based control. It’s a compact, candid roadmap for anyone deciding whether to centralize email signatures — and how to do it without breaking email.   Felicia discussed the implications of email signature management platforms, highlighting security risks and operational challenges while emphasizing the need for organizations to weigh benefits against potential drawbacks. She provided guidance on email signature policies, recommending manual management for small organizations and centralized systems for larger ones, while stressing the importance of written policies and technical implementation tools. Felicia advocated for empowering managers to independently handle email signatures through appropriate training and accountability, contrasting this approach with organizations that rely on IT support, and emphasized the benefits of centralized platforms for branding, compliance, and data integrity. Email Signature Management Security Risks Felicia discussed the implications of using email signature management platforms, emphasizing the need to weigh the benefits against potential security risks and operational challenges. She highlighted that email signatures can affect email deliverability, as elements like hyperlinks and embedded graphics are subject to security scanning by recipient email systems, potentially leading to emails being marked as spam or blocked. Felicia also noted that many platforms are IT-centric, limiting staff involvement, and suggested considering whether department managers could handle email signature management effectively. Email Signature Management Guidelines Felicia discussed email signature policies, explaining that organizations with fewer than 10 employees should manage signatures manually through a written policy and staff training. For larger organizations, she recommended implementing a centralized email signature management system to handle the increased volume of business. Email Signature Policy Implementation Felicia emphasized the importance of having a written email signature policy, especially for organizations with 10 or more employees, to prevent the inclusion of excessive hyperlinks in outbound emails, which can lead to poor email scores. She highlighted the need for technical policy implementation tools and advised against attempting to configure email security settings like SPF, DKIM, and DMARC without involving a CTO, as many IT professionals still struggle with these configurations. Felicia also stressed that requesting whitelisting from recipients due to poor email deliverability is counterproductive and undermines an organization's security posture. Email Signature Management Best Practices Felicia emphasized the importance of professional assistance for DNS record and email signature implementations, warning against self-service approaches that often lead to poor outcomes. She highlighted the need for organizations to remove existing email signatures from end-user devices and modify onboarding policies to prevent signature-related issues. Felicia also raised concerns about third-party email signature platforms' practices of injecting tracking pixels, suggesting that Crossware offers a more privacy-friendly solution by deploying its platform in the client's own Azure tenant. Email Signature Management Empowerment Felicia discussed the benefits of hosting email management platforms, emphasizing data sovereignty and control over email visibility. She highlighted the importance of empowering managers to directly manage email signatures for their teams, rather than relying on the IT department. Felicia suggested a tool that allows authorized individuals to manage email signatures for specific groups within an organization, avoiding broad administrative access that could lead to inefficiencies in larger or more complex entities. Email Signature Management Empowerment Felicia emphasized the importance of empowering employees to manage their email signatures independently, requiring operational maturity and clear policies. She argued against the common practice of involving IT to assist managers with email signature management, advocating instead for mandatory training and accountability for managers to handle this responsibility themselves. Felicia contrasted this approach with organizations that rely on IT for support, highlighting that the latter approach does not lead to sustainable improvements and fosters inefficiency. Centralized Email Signature Management Platform Felicia discussed the importance of implementing a centralized email signature management platform, emphasizing the need for empowerment and accountability rather than IT-led support. She highlighted the benefits of such a platform, including consistent branding, legal compliance, and data integrity, while also addressing potential challenges like marketing overreach and rogue employee behavior. Felicia recommended a self-hosted Azure instance for data sovereignty, outlined cost considerations, and stressed the importance of proper implementation and staff accountability. She concluded by encouraging thoughtful planning and the use of good criteria to differentiate between platforms.

Host Felicia King weaves a sharp, personal narrative that ties together AI, fraud, vendor selection, and the critical role of a competent CTO. With candid anecdotes and hard-earned lessons, she explains why tightly-scoped AI — used by skilled experts with robust governance — can feel like a $150K colleague, and why poorly governed AI or flashy vendor promises can be catastrophic. Felicia recounts real examples: AI misestimating project hours, DDoS services sold as a bargain that hide downstream costs, and an enterprise outsourcing APIs to a freelance developer — each story revealing the hidden risks that lurk when counterparty relationships, transparency, and technical competency are ignored. Through clear guidance and provocative questions about trust and vendor behavior, she urges listeners to prioritize people they know, insist on disclosure, and secure CTO-level expertise to interpret AI claims and perform rigorous risk assessments. This episode is a practical wake-up call for leaders navigating the modern intersection of AI and operational risk. Quick recap Felicia discussed the proper implementation of artificial intelligence in business operations, emphasizing its value as a tool when used correctly under human oversight. She addressed the growing threat of AI-driven fraud and the importance of robust identity verification processes, introducing a service to help build trust between service providers and customers. Felicia stressed the significance of selecting IT vendors based on trust and transparency, advocating for the role of a Chief Technology Officer to navigate complex technical and business risks while ensuring proper risk management and security standards are maintained. AI Implementation and Human Oversight Felicia discussed the convergence of several interconnected topics, including artificial intelligence, fraud detection, and vendor selection. She emphasized the importance of proper AI implementation, highlighting its potential to act as a valuable asset when used correctly. Felicia also addressed the limitations of AI, noting that it excels at analyzing pre-engineered designs but should not be relied upon to create them. She stressed the need for human oversight and expertise when using AI tools, cautioning against the dangers of substituting AI for skilled professionals in critical roles. AI Fraud Prevention Strategies Felicia discussed the increasing threat of AI-driven fraud, highlighting the low financial and time investment required for criminals to create convincing deepfakes. She emphasized the importance of robust Know Your Customer (KYC) processes and multi-factor authentication, noting that these systems often create unnecessary friction for non-technical users. Felicia introduced a service called Professional Residential to address these issues, providing ongoing training and support to build trust between service providers and customers. She also explained the importance of validating customer identities, particularly for sensitive operations like vault access, and stressed that effective fraud prevention relies on maintaining consistent, human relationships with customers. Trust and Transparency in IT Vendors Felicia discussed the importance of selecting IT service providers based on trust and transparency rather than solely on technical metrics or past performance. She emphasized the need for open communication and mutual trust, warning against vendors who might be dishonest or introduce counterparty risk. Felicia also highlighted the importance of understanding the technical details of a vendor's offerings, using an example of a UCAS system where she discovered undisclosed technology through AI analysis. CTO's Role in Risk Management Felicia discussed the importance of having a Chief Technology Officer (CTO) to navigate complex technical and business risks. She shared examples of issues that could arise without proper risk assessment, such as high costs for unneeded services and lack of visibility into traffic. Felicia emphasized that only a CTO could identify these risks and make informed decisions. She also highlighted the dangers of using APIs without adhering to security standards and the importance of supply chain risk management. Felicia concluded that organizations need a CTO to help navigate these complex issues and avoid being vulnerable to potential threats.

On this episode of Breakfast Bytes, Felicia King tells the story of how simple, everyday choices—like a tax method or an internet contract—become high-stakes business decisions. Through vivid examples about mileage rates, S‑corp elections, and a seven‑year ISP contract that could cost tens of thousands, she reveals how knowledge turns ambiguity into power. As the narrative unfolds, you’ll follow a CEO learning to ask the right questions, to spot public‑facing security failures, and to judge vendors by demonstrated competence rather than the lowest price. Each example becomes a lesson in risk, cost of ownership, and contextual trust. By the end of the episode, you’ll have a clear, story‑driven framework: arm yourself with focused expertise, engage strategically with advisors, and select partners who earn their place through competence—because smart decisions protect your business and its future.   Felicia emphasized the importance of informed decision-making in business, particularly when selecting vendors and service providers, and discussed the value of building a knowledge base through regular engagement with strategic advisors. She highlighted the significance of understanding complex topics like S-Corp taxation and evaluating competency when selecting professionals, while also stressing the need for thorough research and consultation with experts. Felicia also discussed the importance of assessing counterparty risk and selecting IT service providers based on competency rather than just cost, emphasizing the need for professional management and active participation in risk management discussions. Informed Decision-Making for Business Leaders Felicia King discussed the importance of informed decision-making in business, particularly when selecting vendors and service providers. She used examples like tax planning and internet connection choices to illustrate how having a basic level of expertise allows business leaders to better evaluate competency and make strategic decisions. Felicia emphasized that while business leaders don't need to handle every detail themselves, they should be well-informed enough to make key risk management and strategic decisions, potentially saving significant amounts of money over time. Strategic Advice for Informed Decisions Felicia discussed the importance of building a knowledgebase through regular engagement and discourse with strategic advisors, such as a chief technology officer, to prevent problems and make informed decisions. She used the example of choosing between the standard mileage rate and actual mileage for tax purposes, emphasizing the need to understand the implications and burden of compliance. Felicia highlighted the value of expert advice in strategic decisions, such as determining the most suitable method based on specific use cases like frequent vehicle changes. S-Corp Taxation Considerations Felicia discussed the complexities of S-Corp taxation and its implications for businesses, emphasizing the importance of understanding the costs and benefits before making an election. She highlighted the need for thorough research and consultation with professionals to avoid compliance issues. Felicia also stressed the significance of evaluating competency when selecting professionals, using examples from both accounting and technology industries to illustrate her points. Counterparty Risk Assessment Importance Felicia discussed the importance of assessing counterparty risk, noting that organizations often fail quickly in these assessments. She emphasized that a poor public-facing security posture can deter potential clients and reflect poorly on the organization's overall IT capabilities. Felicia highlighted that many security issues are relatively easy to fix and suggested that professional management is necessary for maintaining a secure configuration. IT Provider Selection Strategy Felicia discussed the importance of selecting IT service providers based on competency rather than just cost, emphasizing that trust must be contextual and not blanket. She highlighted that organizations should engage in informed decision-making processes, read technical documents, and participate actively in risk management discussions. Felicia also advised against comparing IT spending with peers due to varying business needs and encouraged businesses to allocate at least 15% of their revenue to technology expenditures, especially for those with under $20 million in revenue.

On this episode of Breakfast Bytes, Felicia King addresses the challenges and misconceptions surrounding careers in information technology and cybersecurity. Drawing on decades of experience interviewing hundreds of candidates, Felicia dispels common myths about what it takes to become employable in IT. Key Themes: Myth-Busting: Many believe that degrees and certifications alone guarantee a lucrative cybersecurity job. Felicia explains that real employability comes from hands-on experience, not theoretical knowledge. Military Transition: While military members often have access to extensive training materials and security clearances, Felicia notes that these alone don’t translate to practical skills valued in the private sector. The Skills Gap: There’s a substantial disconnect between what candidates think they know and the actual economic value of their skills. Many struggle with basic, practical IT tasks despite formal education. Security Operations Centers (SOCs): Felicia critiques the prevalence of outsourced SOCs, describing them as “check-the-box” solutions that often lack real value and are staffed by underqualified personnel. Hands-On Learning: The most effective path to employability is setting up a home lab, experimenting with real technology, and developing practical troubleshooting skills. Felicia emphasizes that security is not a separate job—it’s an integral part of every IT function. Work Ethic and Reliability: Success in IT requires showing up, being reliable, and taking initiative. Felicia shares personal stories about always volunteering for new tasks and consistently delivering results. Continuous Learning: The IT field demands a high learning capacity and a passion for problem-solving. Felicia encourages listeners to leverage free resources, podcasts, and structured self-study to stay current and grow their expertise. Work from home is not really helping you: If you want to not be replaced by outsourced IT in another country, you have to be willing to go into the office daily. A person who goes into the office every day affords themselves the ability to be able to handle tasks from start to finish including projects which require hands-on and physical presence. Being in the office every day means you are there when there is an opportunity for cross training or collaboration. Work from home employees are a burden on the other staff and the employer and need to accept being paid less since they are inherently less valuable because they are unable to handle any of the workload that requires physical presence. Managers need to reduce hand-offs. It does not work for one person to do the onsite work and then for some other people to do all the remote work. These handoffs nearly always result in higher costs, slower time to resolution, and lower quality. Bottom line: If you are in the office, the employer has more ways in which you could add economic value to the business, and you will be seen as less replaceable while having higher economic certainty. Actionable Advice: Build a home lab and get hands-on with technology. https://qpcsecurity.com/about-us/careers/cybersecurity-career-resources/ Demonstrate your problem-solving process in interviews. Be willing to work on-site and take on a variety of tasks. Respect boundaries and be reliable; opportunity comes to those who can be counted on. Invest in continuous learning and embrace discomfort as part of growth. Closing Thought: Felicia’s message is clear: becoming employable in cybersecurity is about practical experience, reliability, and a commitment to lifelong learning—not just credentials. For more resources, visit the Career Resources section at qpcsecsecurity.com.

In this episode of Breakfast Bytes, Felicia explained the key differences between Managed Service Providers and Managed Security Service Providers, emphasizing that organizations should prefer MSPs acting as their full internal IT departments for security functions unless they are the IT department and lack necessary technical skills. She highlighted the limitations of the current incident response paradigm, particularly the challenges with outsourcing security monitoring to MSSPs and the lack of effective escalation to capable incident response teams. Felicia stressed the importance of having a skilled incident commander with strong decision-making authority and technical expertise to effectively handle security incidents. Summary MSP vs. MSSP Security Services Felicia discussed the differences between Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs). She explained that MSPs act as outsourced IT departments, handling various IT functions, while MSSPs focus specifically on security services. Felicia emphasized that organizations should aim for their internal IT departments, or their full-service MSP to handle security functions rather than outsourcing to MSSPs, unless they have an internal IT team that lacks the necessary technical skills. She advised that organizations with revenues of $300 million or more should consider hiring in-house talent or outsourcing to large, well-funded companies to avoid potential legal issues with smaller providers. Enhancing Incident Response Effectiveness Felicia discussed the limitations of the current paradigm in incident response, highlighting that outsourcing security monitoring to MSSPs often results in a flawed workflow and a lack of true escalation to capable incident response teams. She emphasized that effective incident response requires a highly skilled incident commander with deep technical knowledge, rapid decision-making authority, and an understanding of organizational politics, which is typically lacking in both internal IT departments and outsourced security providers. Felicia also pointed out the need for clear leadership and decision-making authority during incidents, as well as the ability to make immediate technical and policy changes without being hindered by organizational politics. Felicia discussed the limitations and risks of outsourced security services, emphasizing that while they may provide a false sense of security, they are not a substitute for internal capabilities and the need for organizations to maintain authority over their security decisions. She explored the challenges and risks associated with using managed security services providers and outsourcing MDR or SOC services, highlighting the importance of understanding service offerings and making informed decisions rather than relying on trust or price. Felicia concluded that while MSSPs might be suitable for very large organizations, direct purchasing from software manufacturers could often be a better option. Outsourced Security: Limitations and Risks Felicia discussed the limitations and risks of outsourced security services, emphasizing that while they may provide a false sense of security, they are not a substitute for internal capabilities. She highlighted the importance of understanding the limitations of basic security tools like Sentinel One basic licensing and the potential risks involved when using intermediaries. Felicia stressed the need for organizations to have the authority to make changes based on real data and real issues in their environment, rather than relying solely on outsourced services. MSSP Risks and Vendor Selection Felicia discussed the challenges and risks associated with using managed security services providers (MSSPs) and outsourcing MDR or SOC services. She highlighted the lack of visibility into configurations and processes when purchasing through distributors, which can lead to significant security gaps and risks. Felicia emphasized the importance of making informed decisions based on detailed understanding of service offerings, rather than relying solely on trust or price. She concluded that MSSPs should only be considered for very large organizations that require a large counterparty for liability and risk balancing, and even then, direct purchasing from software manufacturers might be a better option.

Shift your perspective on AI as Felicia shares her insights on integrating artificial intelligence into daily life and business operations, highlighting the importance of risk management. Learn about the hidden dangers of AI, and gain practical guidance on ensuring your data's confidentiality and integrity. Dive into the realm of modern communication as Felicia unravels the complexities of Unified Communications as a Service (UCaaS), revealing the critical differences between real phone systems and UCaaS solutions. Understand why safeguarding your communication privacy could be more essential than cost and come away with a new appreciation for phone system security in an interconnected world.   Felicia discussed data sovereignty and AI methodologies, emphasizing the importance of maintaining control over data while leveraging advanced analysis tools. She explored various phone system options and their security implications, particularly focusing on the risks of using UCaaS providers and the benefits of maintaining direct control over call routing and SIP providers. Felicia shared her experiences with Microsoft Copilot, highlighting its capabilities in document management and project estimation while emphasizing the need for understanding AI limitations and implementing proper security measures to mitigate risks. Next steps Organizations to implement data sovereignty policies and solutions, such as Microsoft Purview licensing, to protect data when using AI. IT consultants to assist organizations in setting up bounded AI research agents for deep analysis of specific datasets. Organizations to consider Microsoft Copilot for AI implementation, with a focus on ensuring data boundaries and security. Organizations to develop and enforce AI usage policies, including guidelines on handling personally identifiable information. Organizations to provide AI training for employees to ensure they understand and comply with AI policies and usage guidelines. Organizations to evaluate the security and privacy implications of using UCaaS providers and consider alternatives for phone systems. Organizations to consult with IT experts before implementing UCaaS solutions to assess potential risks to call security and privacy. Summary Data Sovereignty in AI Analysis Felicia discussed data sovereignty and the importance of managing data risk when using AI. She highlighted a methodology developed by Jay Valentine that allows organizations to maintain control over their data while still performing advanced analysis. Felicia also touched on the limitations of AI, noting that it often provides superficial answers rather than deep analysis. Finally, she briefly explained what UCaaS (Unified Communications as a Service) is, which seems to be a hot topic in the industry. Phone System Options and Hosting Felicia discussed the various options for phone systems, explaining that a real phone system involves having control over the phone system plane and the ability to choose a SIP provider for voice calls over the internet. She clarified that a real phone system can be hosted on a virtual machine, either on-premises or in the cloud, and may or may not involve desk phones. UCaaS Security Risks and Alternatives Felicia discussed the security risks of using Unified Communications as a Service (UCaaS) providers for phone systems, particularly concerning call routing through foreign countries. She explained that such routing can compromise call privacy and security, as demonstrated through her testing of various UCaaS providers. Felicia emphasized that using a vetted SIP provider and maintaining control over call routing is crucial for ensuring call quality, security, and privacy, especially for sensitive communications. She advised against using UCaaS solutions like RingCentral or Zoom for phone systems, highlighting their security flaws and lack of cost-effectiveness compared to on-premise solutions. Data Sovereignty in AI Solutions Felicia discussed the importance of data sovereignty in artificial intelligence, emphasizing that accessible solutions exist for organizations of all sizes. She highlighted Microsoft's Purview licensing for Microsoft 365 as a tool to secure data, allowing even small businesses to control where their data is stored and accessed. Felicia also recommended Microsoft Copilot as an AI tool that respects user-defined boundaries, noting that it is currently the most practical option for most organizations. AI Copilot Usage and Limitations Felicia shared her experiences using AI Copilot, highlighting both its strengths and limitations. She demonstrated how Copilot can effectively assist in finding specific documents, improving document readability, and generating graphics and PowerPoint presentations from text. While Copilot was successful in these tasks, Felicia noted that its effectiveness varied, with a 50% success rate in creating graphics and room for improvement in converting documents into videos. Maximizing Copilot for Business Efficiency Felicia shared her experience using Copilot for project estimation and job description drafting, highlighting its potential benefits when used with high-quality input and appropriate context. She emphasized the importance of understanding AI's data sources and limitations, such as its tendency to be "lazy" and the need for deeper analysis through research agents, which come at an additional cost. Felicia also discussed the risks of AI misuse and the importance of mitigating these risks through training and robust policies, offering solutions for both. She concluded by sharing a success story of using Copilot to significantly reduce the time required for a technical task, advocating for its cost-effective use in businesses.   🎧 Let’s Talk Cybersecurity—Together With over 25 years of hands-on experience in network-layer protection and cybersecurity strategy, we’re here to make security simple and accessible. Whether you’re a homeowner, a family, a retired professional, or running a small to medium-sized business, we’ve got solutions tailored just for you. 💡 No minimum seat count required—if you need help, we’re here for you. 🔒 Tune in, subscribe at qpcsecurity.podbean.com, and let’s build a safer digital world—one episode at a time. 🌐 Visit our website at qpcsecurity.com to learn more and book your appointment today!

In this episode of Breakfast Bytes, host Felicia King delves into the controversial world of IT assessments, often considered a deceptive sales tool rather than a vital business instrument. Drawing from years of experience, Felicia shares her insights into the improper paradigms surrounding assessments, highlighting how they frequently mislead businesses with daunting price tags and negligible results. Felicia recounts numerous encounters with frustrated business leaders who have spent exorbitant amounts, such as $20,000, on assessments that they didn't understand how to utilize. She unveils the reality that many assessments merely serve as a distraction, leading to further confusion rather than providing clear solutions. Throughout the episode, Felicia emphasizes the importance of targeted analysis: understanding the most critical problems and prioritizing them rather than attempting to 'boil the ocean' with expensive and comprehensive assessments. She shares her methodology of efficient, experience-driven evaluations and warns against "free assessments," which often turn out to be cleverly disguised marketing traps that create confusion instead of clarity while leaving vulnerabilities in your environment. Tune in for an eye-opening narrative on why most IT assessments might not be worth your time or money, and discover smarter ways to identify and fix your IT issues with strategic precision. https://qpcsecurity.com/choosing-the-right-consultant-to-run-assessments-on-your-environment/   Quick recap Felicia King discussed the limitations and pitfalls of IT industry assessments, emphasizing the need for focused evaluations that identify and prioritize the top problems rather than attempting comprehensive solutions. She warned against external IT service providers using assessment tools as sales tactics and highlighted the importance of proper vetting and consultation with internal IT departments before implementing external tools. Felicia recommended exploring the CISO Community Defense Model for risk management and emphasized the critical need to focus on top IT strategy categories while avoiding misleading "free" assessments, advocating for comprehensive evaluations led by experienced security professionals. Summary Effective IT Assessment Strategies Felicia King discussed the pitfalls of IT industry assessments, explaining that most are ineffective and serve as sales tools rather than valuable insights. She emphasized that a proper assessment should identify the top 5-6 problems and their prioritization, rather than attempting to solve everything, which can be costly and unnecessary. Felicia recommended a focused approach, suggesting that a 2.5-hour assessment could reveal enough information to address significant issues without the need for an exhaustive analysis. She also advised against expensive assessments, noting that anything over $10,000 is likely unnecessary, and warned against free assessments, which she described as misleading. External IT Assessment Tool Risks Felicia warned against allowing external IT service providers to install assessment tools in company environments without proper vetting. She explained that such tools are often used as a sales tactic to create fear, uncertainty, and doubt between the incumbent IT service provider and the company seeking their services. Felicia emphasized that executive management should not make decisions about installing external tools without consulting the internal IT department and conducting a thorough assessment of potential risks and impacts. She shared a personal example of a large campus where a COO was tricked into allowing an external provider to install assessment tools, which led to a security breach and other issues. Manipulated Endpoint Assessment Incident Felicia described an incident where a company conducted an assessment using software on sensitive endpoints, but the results were manipulated by intentionally incorporating data from a separate organization to create misleading findings. She explained that the assessment team was incompetent and had engaged in malfeasance to cover up their inability to gather meaningful data from the hardened environment. Felicia emphasized that this was not an isolated incident, but rather a common practice in the industry, highlighting the importance of having qualified personnel conduct assessments and the need for a correct paradigm in assessment strategies. CIS Defense Model for Business Felicia recommended exploring the CIS Community Defense Model, an international standard for risk management and mitigation, which she covers in a webinar. She emphasized that executive leaders often view security investments as expenses, but highlighted the potential for returns through innovation and risk reduction. Felicia shared her company's experience providing enterprise-grade security for small environments at competitive prices, and stressed the importance of understanding the model to make informed business decisions about security partnerships. https://qpcsecurity.com/addressing-information-security-fundamentals-with-cis-and-community-defense-model/ IT Strategy Focus and Prioritization Felicia emphasized the importance of focusing on the top six critical categories of items in IT strategy execution, as neglecting these areas leads to wasted resources and increased risk. She advised against accepting "free" IT assessments, warning that they often uncover internal IT department deficiencies rather than evaluating external service providers effectively. Felicia stressed that such assessments can be misleading and incomplete, urging IT professionals to prioritize genuine, comprehensive evaluations led by experienced CTOs or CISOs rather than sales representatives. https://qpcsecurity.com/what-is-a-qualified-technology-executive-and-why-does-your-company-need-one/  

In this engaging episode of Breakfast Bytes, host Felicia King invites wealth manager and seasoned investment specialist Chris Belchamber to share his 41 years of industry insight. Dive into a rich narrative exploring risk management from two unique perspectives: technology and finance. As Chris unveils his journey towards shaping informed risk takers, listeners are guided through his groundbreaking efforts in establishing clear success benchmarks while unveiling tips on tax efficiency and strategic asset management. Chris reveals the practical steps he's taking in democratizing financial clarity, from publishing his insightful book, "Invest Like the Best," to launching informative online platforms for both comprehensive financial guidance and free educational resources. As the narrative unfolds, learn about Chris's diverse strategies—from using sophisticated tools like the Calmar Ratio in investment analysis to collaborating with global professionals for unparalleled estate planning advice. https://chris-belchamber.com/ This episode is the latest in our series on risk management practices. Chris' expertise blends risk management and wealth preservation. He offers sage advice on evaluating investment advisors effectively.   Resources Chris refers to: https://maxifiplanner.com/ https://www.interactivebrokers.com/en/whyib/overview.php  

Join Felicia King in this eye-opening episode of Breakfast Bytes as she unravels the concept of third-party information security risk management. Felicia highlights the growing debates around software as a service (SaaS) platforms and the complexities they entail, raising poignant questions about security, backups, and risk. Dive deep into the intricacies of backups—from on-premise practices to the vulnerabilities introduced with SaaS. Felicia draws parallels between the supply chain practices of ancient times and the critical information security strategies needed in today's digital landscape. Through vivid storytelling and expert insights, discover why making informed decisions about SaaS requires more than just evaluating business functionalities—it demands a comprehensive risk management strategy and the right technological expertise. Don't miss this narrative packed with actionable advice for becoming an informed risk decision maker in the world of technology.   Quick recap Felicia discussed the importance of third-party information security risk management in the technology industry, emphasizing the need for comprehensive backup methods and informed decision-making when evaluating software as a service solutions. She highlighted the misconception that Business Continuity and Disaster Recovery is primarily an IT problem, stressing the importance of business processes and human continuity. Felicia emphasized the crucial role of involving a qualified Chief Technology Officer in the evaluation process of software as a service solutions to ensure proper security measures, backup capabilities, and role management are considered before making procurement decisions.   Third-Party Information Security Risk Management Felicia discussed the importance of third-party information security risk management, also known as counterparty risk, in the technology industry. She highlighted that this topic has been underestimated and is becoming increasingly relevant as more legacy applications are being considered for replacement into software as a service (SaaS). Felicia emphasized the need for informed risk decision-making and raised awareness about the nuances of backups, which are crucial for information security risk management. She also mentioned that the approach to backups should be based on the end goal of restoration, and that relying on a single method for backups can be naive.   Comprehensive Backup Strategies for Businesses Felicia discussed the importance of backup methods for businesses, emphasizing the need for a more comprehensive approach than the standard 3-2-1 method. She highlighted the limitations of cloud storage and the need for brick-level backup, which allows for the recovery of individual objects or databases, rather than the entire server. This flexibility is crucial for businesses, especially those with complex systems like enterprise resource planning tools, where rapid and easy recovery from backups is essential for scenario planning and testing.   BCDR: Business Processes Over IT Felicia discussed the misconception that Business Continuity and Disaster Recovery (BCDR) is primarily an IT problem, emphasizing that it is 80% about business processes and human continuity. She highlighted the importance of moving away from legacy apps due to their high maintenance and operational costs. Felicia also pointed out the limitations of on-premise infrastructure in meeting uptime requirements, suggesting that software as a service could be a more viable option. She concluded by stating that most businesses cannot afford the same level of uptime as software as a service, despite what are sometimes higher monthly fees for SaaS.   Involving CTO in Software Evaluation Felicia emphasized the importance of involving a Chief Technology Officer (CTO) in the evaluation process of software as a service solutions. She highlighted that without a CTO, the evaluation process lacks essential technical questions, such as security, access control, integration with onboarding and offboarding processes, and backup and restore capabilities. Felicia stressed that these technical aspects are crucial for a successful procurement and should be evaluated before making a business decision.   Involving Right People in Pre-Procurement Felicia emphasized the importance of involving the right people in the pre-procurement phase of software as a service, such as a qualified CTO, to ensure proper backup and security measures are in place. She used the example of XERO, an accounting platform, and its lack of native backups, requiring an additional third-party add-on, Control C, for backup solutions. Felicia stressed that without a competent CTO, it's impossible to make informed decisions based solely on price quotes from software companies, as additional costs for competent reporting and backup solutions need to be factored in.   QuickBooks Backup Limitations and Security Risks Felicia discussed the limitations of QuickBooks Online's backup and restore capabilities and suggested considering alternatives like Odoo for more control over data. She emphasized the importance of understanding third-party information security and risk management to make informed decisions. Felicia also highlighted the risks associated with software as a service, including potential privacy violations and lack of full control over access logs. She advised considering the security implications of software development and the need for ongoing security processes.   Saas Platform Evaluation Challenges Discussed Felicia discussed the challenges of managing roles and responsibilities in software as a service applications. She highlighted that only a small percentage of these applications allow for customization, which is a significant issue. Felicia emphasized the importance of considering various factors when evaluating a SaaS platform, suggesting that it's a task best suited for a Chief Technology Officer (CTO). She encouraged attendees to consult with their preferred CTO for guidance on evaluating Saas platforms.  

Welcome to another episode of Breakfast Bytes with Felicia King. In this gripping sequel, Felicia delves deeper into the concept of operational maturity and its vital role in driving organizational profitability and AI readiness. If you've ever wondered why achieving consistency in management across departments can be challenging, this episode sheds light on the ubiquitous struggles faced by organizations regardless of size or industry. Drawing from her extensive 30-year career, Felicia shares eye-opening, real-world anecdotes that reveal the tangible barriers to operational maturity. Imagine a world where processes run smoothly, unaffected by the presence or absence of key personnel. A world where toxic workplace drama is curtailed by structured training, setting boundaries for employees, and instilling a culture of accountability. Through fascinating real-life examples and practical solutions, Felicia paints a vivid picture of how a lack of training and consistency can cause unwarranted drama and productivity loss, and how a mature operational framework can prevent such chaos. Managers play a crucial role, and Felicia discusses how they're uniquely positioned to counteract drama, empower their teams, and facilitate training that aligns with company standards and processes. As AI adoption becomes increasingly crucial, Felicia emphasizes that a solid foundation of operational maturity is not merely beneficial but essential. This episode not only highlights the risks of neglecting these elements but also inspires action by showcasing how adopting and enforcing standards can transform organizational culture, improve profitability, and ensure readiness for the technological advancements AI brings.     Felicia King emphasized the importance of operational maturity in driving profitability and readiness for AI adoption, highlighting the risks of not achieving it and the need for a shared responsibility model. She discussed various issues such as misconfigured phone systems, lack of accountability, and the negative impact of a sales-centric culture on employee retention. Felicia also stressed the importance of proper training, decoupling roles from individuals, and moving away from loyalty to individuals towards a more role-based approach to improve process documentation and prevent businesses from becoming overly reliant on one person.     Operational Maturity and AI Readiness Felicia King discussed the importance of operational maturity in driving profitability and readiness for AI adoption. She emphasized the risks of not achieving operational maturity, citing her 30 years of experience working with various organizations. Felicia also highlighted that most organizations face similar challenges and need to undertake the same actions to improve operational maturity. She then hinted at providing solutions to these problems in future discussions.     Operational Maturity and Its Consequences Felicia discussed the importance of operational maturity in organizations, emphasizing the need for consistency, standards, and policies. She used real-world examples to illustrate the consequences of a lack of operational maturity, such as wasted payroll and toxic drama. Felicia stressed the importance of training and accountability in preventing such issues. She also highlighted the role of managers in proactively managing toxic drama and ensuring they have a solid command of the technical systems used in their departments. Felicia concluded by emphasizing the need for a shared responsibility model and the importance of using the resources provided by the company, such as the knowledge base.     Misconfigured Extension Causes Toxic Drama Felicia discussed an issue with an employee who misconfigured their phone system extension, causing problems. The employee was not held accountable for their behavior, and instead wrote a manual to guide others on how to avoid the same mistake. Felicia highlighted the toxic drama that can arise when employees are not held accountable for their actions, and the potential for further issues if the problem is not addressed.     Accountability and Adhering to Company Policies Felicia discussed a problematic situation involving an employee who caused weeks of disruption by forwarding business calls to an external individual's personal cell phone. This led to potential legal issues and a complaint against the company. Felicia emphasized the importance of accountability and adherence to company policies and processes. She also highlighted the issue of blaming IT departments for poor performance, which she described as a cancer that can negatively impact an organization's profitability. She suggested that managers should take responsibility for knowing what is right and wrong, and not be bamboozled by employees' claims of IT-related issues.     Improving Accountability and Productivity Training Felicia discussed the importance of proper training and accountability in the workplace. She highlighted the issue of employees not utilizing company-provided technology effectively, leading to inefficiencies and a lack of business continuity. Felicia suggested that managers should create development plans for employees, utilizing company training resources, to improve accountability and productivity. She also pointed out the negative impact of a sales-centric culture on employee retention and the overall payroll.     Decoupling Roles, Ensuring Business Continuity Felicia discussed the importance of decoupling roles from individuals in organizations to ensure continuity and efficiency. She argued that job rotation and quality control measures can improve process documentation and prevent businesses from becoming overly reliant on one person. Felicia also emphasized the need for organizations to move away from loyalty to individuals and towards a more role-based approach. She suggested that smaller businesses are better positioned to achieve operational maturity due to their ability to make decisions and set policies without needing a committee-based approach.

In this enlightening episode of Breakfast Bytes, Felicia King draws upon her three decades of business experience to guide us through the crucial steps organizations must take to flourish amidst today's challenges. With a focus on operational maturity, Felicia unravels the strategies businesses need to implement to harness the power of AI without compromising data security. Explore the pitfalls of inadequate governance in the age of rapidly advancing technologies and discover why the absence of a robust data policy could be detrimental. Felicia also delves into the cultural shifts required within organizations to ensure not only survival but also increased profitability. As businesses navigate generational labor market shifts and the complexities of AI integration, this episode serves as a narrative roadmap. Listen in to learn how to foster a culture that supports both employee growth and organizational resilience. Summary     Addressing Labor Challenges With AI Felicia King discussed the challenges faced by businesses in finding reliable, capable, and dependable employees. She highlighted the increasing use of robotics and AI as a response to these challenges, and the need for organizations to decouple their business processes from individuals. Felicia emphasized the importance of operational maturity for organizations to effectively utilize AI, and the lack of executive management wanting to put constraints around AI. She also noted that sales executives often drive the agenda in organizations, which can lead to a lack of focus on protecting company assets and customer data.     Unregulated AI Usage Risks and Solutions Felicia discussed the dangers of unregulated AI usage in an organization. She emphasized the importance of having company policies and employee training to ensure proper use of AI technology. She stressed the risks of losing company data and increasing legal liabilities when AI is not controlled and its boundaries are not set. Felicia also highlighted the need for security measures like data loss prevention and digital rights management in AI usage. She noted the difficulty and time-consuming nature of implementing such measures, and the need for a paradigm shift in an organization's approach to technology.     Data Retention Policies Drive Operational Maturity Felicia discussed the importance of data retention policies, data classification, and data sensitivity labels in driving operational maturity and cultural change within a company. She emphasized that these measures are crucial for an organization's readiness for AI and can lead to increased profitability. Felicia also highlighted the challenges faced by Generation Z workers due to their habits, which can negatively impact their employability. She noted that some employers have found it more cost-effective to deal with the gap of not having an employee than to manage the negative impact of an unprofitable employee.     Operational Maturity in AI Adoption Felicia discussed the importance of operational maturity in organizations, emphasizing that it is crucial for adopting AI without risking data and customer safety. She highlighted the need for policies, standards, processes, and key performance indicators (KPIs) to drive cultural change and achieve higher profitability. Felicia also warned against solely focusing on metrics like time to close a ticket, as it could lead to ignoring potential issues. She suggested that operational maturity is necessary to prevent employees from becoming the biggest risk factor. Felicia concluded by stating that she would provide more tangible steps to achieve operational maturity in a future discussion.     Addressing Common Business Challenges Felicia discussed her extensive experience in consulting for over 450 businesses, highlighting common problems such as underutilized resources, inconsistent outcomes, and compliance issues. She emphasized the importance of maintaining consistent outcomes, adhering to compliance requirements, and avoiding policy violations. Felicia also stressed the need for businesses to make tough decisions, such as firing underperforming employees, to ensure operational maturity and avoid adverse impacts on the organization.     Understanding Monthly Expenses and Profitability Felicia discussed the importance of understanding the monthly expenses per knowledge worker employee, excluding salary, which can range from $300 to $400 monthly. She emphasized that businesses should aim to cover total per-employee expenses three to four times over to ensure profitability. Felicia also highlighted the shared responsibility model for profitability, stressing the need for both the organization and employees to improve their operational maturity and skills. She concluded by noting that this approach is not only beneficial for profit-making companies but also for nonprofits seeking to provide wage increases while staying within budget.

In this episode of Breakfast Bytes, Felicia King delves into the intertwining worlds of AI and technology adoption for businesses. She sheds light on how small and midsize businesses can leverage AI safely and the pivotal role of adopting the right technology. Drawing from three decades of experience, Felicia explores real-world scenarios, such as a 100-person law firm facing a potential $9 million data risk, highlighting the necessity of robust data governance and security measures. Listeners will gain insight into the vital decisions that executive management teams must make to remain competitive. Felicia discusses the importance of informed risk management decisions, advocating for comprehensive training, data governance, and enforcement to empower employees and safeguard company and customer data. Throughout the episode, Felicia emphasizes the need for businesses to engage with the right advisors, particularly in the realm of AI strategy, and not just rely on IT departments. By sharing real-world examples, she illustrates the significant risks and costs associated with inadequate guidance, and offers solutions for businesses to thrive in an ever-evolving technological landscape.

In this episode of Breakfast Bytes, join Felicia King as she sits down with Chris Gross, the Director of Product at Breach Secure Now, to explore the revolutionary impact of continuous education in cybersecurity and productivity. Discover how Breach Secure Now's unique approach to training empowers managers and employees alike to enhance organizational culture, productivity, and security awareness. Learn why weekly micro-trainings are more effective than traditional annual methods, transforming end-users into informed, accountable team members. Chris shares the insights into the seamless integration of AI and security training with platforms like Microsoft Teams, and how this strategy keeps vital information at the forefront, ultimately cultivating a proactive workplace environment. Tune in to understand the significant role of employee empowerment in reducing risk, improving efficiency, and creating happier workplaces, while breaking down the traditional barriers of IT-led transformation. Finally, uncover how simple, actionable tools like the Security Risk Assessment can guide your organization in achieving operational maturity by 2025.   Related shows: https://qpcsecurity.podbean.com/e/operational-maturity-practical-example/ https://qpcsecurity.podbean.com/e/why-you-need-a-cto-avoiding-costly-mistakes-in-document-management/     Improving Operational Maturity for 2025 Felicia and Chris discussed the importance of improving operational maturity for businesses to survive and thrive in 2025. Felicia emphasized the need for training, an AI strategy, and policies to prepare for competition and potential threats. She also highlighted the importance of implementing technical controls to protect company assets and the need for a cultural shift and policy management. Felicia suggested that a comprehensive tool like Breach Secure Now could be beneficial in this process. Chris agreed with Felicia's points, and they both agreed that a business needs to function as a whole, with all components working simultaneously, to be successful.     Implementing Effective Cybersecurity Measures Felicia and Chris discussed the importance of implementing effective cybersecurity measures in organizations. They emphasized the need for a cultural shift within companies to prioritize cybersecurity, which requires the support of executive management teams. They also highlighted the role of AI tools like Copilot in enhancing cybersecurity, but noted that these tools are only effective if used in conjunction with proper data classification, retention, and management practices. They concluded that partnering with the right MSP and using the right tool set are crucial for successful implementation.     Implementing Effective Strategies for 2025 Felicia and Chris discussed the importance of implementing effective strategies for businesses in 2025. Felicia highlighted the need for policies, operational maturity improvement, AI readiness, and security risk assessment.     Continuous Education and Accountability Chris and Felicia discussed the importance of continuous education and accountability in the technology world. They agreed that traditional once-a-year cyber training is ineffective and that regular updates are necessary. Felicia highlighted the effectiveness of Breach Secure Now (BSN) in improving overall organizational awareness and driving accountability. She also emphasized the importance of empowering managers to manage their teams effectively. Chris and Felicia discussed the integration of BSN with Microsoft Teams and the introduction of AI training in shorter segments called Nanos. They agreed that educating employees on how to use technologies effectively, proficiently, and securely is crucial for business success.     Cyber Security Focus and Training Tools Felicia commended the team for the accuracy of their material, noting a high success rate. She also expressed her appreciation for the platform's newsletters and a cyber security assessment tool, which she has incorporated into her job candidate assessment process. Chris emphasized the importance of demonstrating a cyber security focus culture and providing education to new employees. Felicia further highlighted the effectiveness of the platform's training tools in promoting cultural change, particularly the integration with Teams and the optional nano trainings.     Improving Cyber Posture and Employee Training Felicia discussed the importance of improving the overall cyber posture of employees by presenting solutions directly to them, rather than treating it as an IT problem. She highlighted the use of Keeper Security's Breach Watch component, which alerts users to potential security issues. Chris agreed, emphasizing the need for employees to change their passwords immediately after a data breach and to undergo additional training to protect against sophisticated scams. He stressed the importance of continuous education and staying updated on the latest scams to mitigate risks.     End User Empowerment and Upskilling Felicia and Chris discussed the importance of end user empowerment in their organization. They emphasized the need for tools that implement the right process, rather than relying on traditional methods that involve sending reports to the IT department and chasing managers for time from end users. They highlighted the effectiveness of their current system, which provides unique and actionable data to each individual end user, leading to better accountability and reduced friction. They also discussed the importance of upskilling employees to improve job performance and retention, and the potential for a positive culture within the organization. Felicia shared a personal anecdote about a struggling office that was not utilizing the available training resources, highlighting the cost-effectiveness of investing in employee training.     Training, Accountability, and Workplace Culture Chris and Felicia discussed the importance of training and accountability in the workplace. They agreed that short, regular training sessions of 5 to 10 minutes a week are more effective than longer, less frequent ones. They emphasized the need for a cultural attitude towards training and the expectation that employees will use tools and follow policies competently. They also highlighted the benefits of rewarding employees who go above and beyond in their training. Felicia added that promoting a 15-minute daily training routine can help reduce disciplinary issues and improve payroll efficiency. They concluded that training should be bite-sized, fun, and not overwhelming, with a scoring system to track progress.     Employee Training and Cybersecurity Assessment Felicia and Chris discuss the importance of employee training and proper tools for managers to assess productivity. Felicia emphasizes the value of the Security Risk Assessment product, which helps organizations identify deficiencies and track progress towards improving cybersecurity. Chris adds that the product provides a clear path and templates to address recommendations gradually, rather than overwhelming organizations with too many changes at once. They agree that the risk assessment is beneficial for both HIPAA-regulated and non-HIPAA entities, as it facilitates a comprehensive understanding of an organization's security posture.

In this inspiring episode of Breakfast Bytes, Felicia King delves into the pressing strategies businesses need to adopt to thrive in the year 2025. With intriguing insights, Felicia articulates why companies must stay competitive and adapt to the ever-changing landscape—focusing on the integral role of a Chief Technology Officer and the imperative cultural shift towards continuous staff training. Felicia sheds light on the complexity of finding competent talent, the importance of establishing and enforcing effective policies, and the necessity of blending technology with human oversight. She compellingly emphasizes that regardless of workforce demographics, training needs to become a staple and an evaluated performance metric. The episode is rich with anecdotes and expert advice, warning against the risks of ignoring technological and cultural progression, even as it highlights the detrimental impact of inadequate policy management and technical incompetency in various sectors. Felicia’s narrative provides actionable insights into aligning your organizational structure for maximum efficiency and effectiveness in the looming future. Quick recap Felicia King emphasized the importance of having a Chief Technology Officer (CTO) and a cultural shift towards ongoing training for staff to ensure compliance and productivity in businesses. She also stressed the need for effective utilization of technology, data classification, and vendor risk assessments, and warned against the lack of technical aptitude and security capabilities in marketing agencies. Lastly, she highlighted the importance of executive management teams taking an active role in managing risks and issues within their organizations, and the need for strategic adoption of technology and operational maturity.     Next steps • Executive management team to establish a partnership with a qualified CTO/CISO for strategic technology guidance and risk management. • HR/Leadership to implement a mandatory ongoing training program for all staff, with accountability measures tied to performance evaluations. • IT team to develop and maintain a risk register and project backlog, with monthly budget allocation for addressing identified issues.   Summary Surviving 2025: CTOs, Training, and Payroll In the meeting, Felicia King discussed the key factors for businesses to survive in 2025. She emphasized the importance of having a Chief Technology Officer (CTO) to provide leadership and guidance on technology and policy matters. Felicia also stressed the need for a cultural shift towards ongoing training for staff, regardless of age, to ensure compliance with company policies and improve productivity. She warned against the misconception that a younger workforce automatically solves these issues. Felicia concluded by urging businesses to view their payroll as their primary inventory and to efficiently utilize it to avoid wasting resources.     Lack of Training and Policy Enforcement Felicia shared a scenario where despite providing extensive training, staff members failed to use a technological system effectively due to a lack of enforced policy and cultural shift. She emphasized that if a manager had advocated for a policy and cultural shift, the staff could have taken just 15 minutes a few times a week to move the needle on their problem. However, because the manager did not prioritize training, the staff did not read the instructions and missed out on efficient use of the system. Felicia concluded that if everything else is secondary to sales, as the manager had told the staff, then training is not considered important.     Respecting Employers and AI Implementation Felicia emphasized the importance of respecting employers, coworkers, and company policies for efficient technology utilization. She highlighted the need for understanding best practices and avoiding unnecessary tech support requests. Felicia also stressed the importance of data classification, retention, and policy management systems for AI usage and adoption. She underscored the necessity of a combination of policies, training, technical controls, and accountability to ensure successful implementation and utilization of AI in 2025.     Marketing Agencies' Technical Limitations Felicia expressed her belief that marketing agencies struggle to execute effective marketing services due to a lack of technical aptitude and security capabilities. She attributed this to the agencies' refusal to hire qualified CTOs or CSOs, and their lack of technical training. As a result, they lose business due to ineffective marketing strategies and poor security practices.     Vendor Risk Assessments for All Felicia discussed the importance of vendor risk assessments, highlighting that they are not only relevant to tech companies but also to law firms, accounting firms, medical offices, and investment brokerages. She mentioned that her company, QPC Security, offers vendor risk assessments and counterparty risk assessments, with a baseline cost of $300. Felicia emphasized that failing a basic vendor risk assessment can indicate serious issues within an organization's IT infrastructure.     Addressing Competence in Organizations Felicia expressed her concerns about the lack of competence in various organizations, regardless of their size. She cited examples of IT service providers and larger companies where the collective intelligence of the employees was insufficient to identify and address public-facing security risks. Felicia emphasized the importance of having competent professionals in IT roles and the need for executive management teams to surround themselves with objective, knowledgeable advisors rather than yes-men. She concluded by urging the need for deep paradigm shifts in 2025 to remain competitive.     Maintaining Risk Register and Project Backlog Felicia discussed the importance of maintaining a risk register and project backlog, and the need for organizational commitment to allocate time and budget for these tasks. She emphasized the necessity of regular meetings with the designated CTO and CISO, ideally quarterly or monthly, to discuss planning and initiatives. Annual meeting frequency is insufficient. Felicia also suggested a SWAG number approach for budget allocation, with the goal of completing a certain amount of work each month to address issues on the project backlog and risk register. She stressed the importance of teamwork and collaboration in managing these tasks.     Executive Management's Active Risk Role Felicia emphasized the importance of executive management teams taking an active role in managing risks and issues within their organizations. She warned against the practice of delegating and abdicating responsibilities, which often leads to poor decision-making and unresolved problems. Felicia shared an example of a client who finally resolved a long-standing issue after the CEO took the time to have a crucial discussion. She stressed that the executive management team should be willing to have meetings and be informed about risks, even if they don't become experts in the subject matter.     Strategic Risk Management and Technology Felicia discussed the importance of managing risk and adopting technology strategically. She emphasized the need for a policy and standard around printer technologies, as well as the adoption of wireless technologies, to avoid interference and reliability challenges. She stressed the importance of operational maturity and the need for a partnership with a CTO to achieve this. Felicia also warned that failure to make cultural shifts, adopt AI correctly, and implement technical controls could lead to a loss of competitiveness and potentially even business closure by the end of 2025.

In this episode of Breakfast Bytes, host Felicia King sits down with Dr. Eric Woodell, founder of Ameris and a leading expert in data center infrastructure and operations compliance. Dive into the world of data centers as Dr. Woodell reveals the shocking truths behind their operations and the risks that could be lurking behind the scenes. Dr. Woodell shares his journey from nuclear submarines to becoming a key player in the data center industry, highlighting his relentless pursuit of truth and transparency. Discover why he believes that the current standards for compliance, such as SOC 2, may be nothing more than a façade, and how his groundbreaking audit program can change the game. Explore the complexities of counterparty risk management and the importance of having real control over your data infrastructure. Learn about the potential pitfalls of relying on colocation facilities and public cloud services, and why owning your infrastructure might be the most cost-effective and secure option. Join Felicia and Dr. Woodell as they challenge conventional wisdom, offering a fresh perspective on data center management and the critical need for accountability. Whether you're an IT professional, a business decision-maker, or just curious about the hidden workings of the digital world, this episode promises to engage and enlighten. Quick recap Dr. Eric Woodell and Felicia discussed the issues with the co-location industry, the importance of strong leadership in business, and the complexities and costs associated with maintaining multiple sites for redundancy. They also emphasized the need for proper documentation and certification in critical infrastructure and cybersecurity, and the importance of evaluating risks in business decisions. Lastly, they proposed the need for a significant industry alert regarding the unreliability of certain security standards and the development of a new standard in risk management.     Addressing Industry Issues and Certification Process Dr. Woodell discussed the issues with the co-location industry, particularly the lack of proper maintenance and potential for fraud. He mentioned developing an audit program to track these issues but noted that the problem persisted. Eric criticized the SOC2 certification process, suggesting it was designed to generate fees and lacked legitimacy. He highlighted the inadequacy of the current certification process for cyber security, emphasizing the need for pressure to rectify these issues. Eric and Felicia also discussed the lack of a quality control process in their current system, with Eric sharing an example of a compliance issue at Equinix. The conversation ended with Eric expressing concerns about the legitimacy of a situation where a company lost their maintenance records due to a dispute with a labor provider.     Addressing Counterparty Risk in Vendor Evaluation Felicia and Eric discuss the importance of addressing counterparty risk when evaluating vendors, particularly related to data extraction and contract terms. They criticize companies for writing contracts without clearly defining roles and responsibilities, leading to a lack of consequences for service disruptions. Felicia argues for the cost-effectiveness of owning and maintaining servers on-premise over using public cloud services. Eric agrees, acknowledging the potential for lower costs and better control with in-house IT management. They also discuss the challenges small to medium businesses face due to overreliance on public cloud services and the risks of data exposure from negligent co-location companies.     Leadership, Waste, and Oversight in Business Eric and Felicia discussed the importance of strong leadership in business, using Apple as an example of a company that has thrived due to its leadership. They also shared their personal experiences of uncovering waste in organizations and the challenges of addressing it. The conversation then shifted to the issue of conflicts of interest and lack of oversight in the cyber security industry, with Equinix being cited as an example of stock manipulation and fraud. They also discussed the concept of 'unjust enrichment' and the lack of control and standards in the industry. The conversation ended with Eric sharing his positive experience with Vanguard, a company that was meticulous about compliance.     Managing Multiple Sites and Vendor Complexity Eric discussed the complexities and costs associated with maintaining multiple sites for redundancy. He highlighted the exponential increase in complexity and costs as more sites are added, and the potential for introducing new problems. Eric also mentioned the frustration and indirect costs associated with dealing with multiple vendors. Felicia agreed, emphasizing the complexity of managing multiple vendors and the soft, indirect costs involved. They both agreed that having a small core set of sites, properly maintained, could be a more viable option. Eric pointed out the alarming rate of data center outages, likening it to the airline industry, and questioned why IT executives continue to pay for such unreliable services.     Competent Assistance and Counterparty Risk Assessment Felicia and Eric discussed the importance of competent assistance in decision-making for clients in the industry, emphasizing the need for a CTO for contract review. They highlighted the issue of CEOs and CFOs seeking advice from friends rather than professionals, which can lead to legal issues and confirmation bias. The importance of independent audits and assessments in mission-critical facilities was also stressed, with Eric suggesting he could provide a solution for the lack of a standard for evaluating critical facility security. Felicia concluded the discussion by asking for Eric's recommendations for business decision-makers who want to better understand counterparty risk and make more informed decisions.     Industry Alert and New Risk Management Standard Eric and Felicia discussed the need for a significant industry alert regarding the unreliability of certain security standards, particularly for critical facilities and cybersecurity. They highlighted the increasing scrutiny from insurance providers on third-party information security risk management and the importance of a high-quality CTO and CISO or a dedicated compliance manager. They also discussed the need for a new standard in risk management, particularly in the context of vendor and counterparty relationships, and agreed that the current approach was insufficient. 

In this riveting episode of Breakfast Bytes, host Felicia King delves into the often overlooked but crucial aspect of business technology: document management platforms. With a sharp focus on how organizations of all sizes can benefit from these systems, Felicia underscores the importance of operational maturity and strategic decision-making. Through compelling narratives and real-world examples, she illustrates the perils of inadequate technology leadership. From misguided IT directors to costly missteps, Felicia shares stories from her 30-year career, shedding light on the vital role a Chief Technology Officer (CTO) plays in safeguarding a company's resources and ensuring seamless technology integration. Listeners are invited to explore the intricacies of technology planning, from policy formulation to platform selection, and the far-reaching consequences of neglecting expert guidance. This episode is a must-listen for business leaders eager to avoid lighting money on fire and to achieve sustainable growth through informed technology investments.   Quick recap Felicia King discussed the importance of document management platforms and the need for a technology executive in organizations of all sizes. She emphasized the significance of strategic architecture choices, operational maturity, and inclusive decision-making in implementing these platforms. Felicia also highlighted the challenges of managing contracts with consulting firms and stressed the importance of having a clear engineering and implementation plan before purchasing any technology.     Next steps • Business leaders to consult with a qualified CTO before making strategic technology decisions, especially for document management platforms. • Organizations to develop written requirements, document business processes, and create an engineering/implementation plan before purchasing new technology systems. • Companies to review and potentially modify contracts with technology vendors to ensure compliance with organizational policies and support protocols.   Summary Document Management and Operational Maturity In the meeting, Felicia King discussed the importance of document management platforms for organizations with more than one employee. She emphasized the need for operational maturity and the use of systems to scale a business. Felicia also highlighted the necessity of a technology executive, even for small organizations, to navigate complex issues. She stressed the importance of understanding these matters, as they are too complicated to be handled by IT support alone.     Importance of Technology Executives in Orgs Felicia discussed the importance of having a technology executive in organizations, emphasizing that an IT director often lacks the necessary skills and capabilities. She shared a past example where an IT director made a costly mistake due to lack of oversight, leading to significant financial losses and compliance issues. Felicia advised business decision-makers to use their technology executive in an advisory capacity to avoid such problems, particularly when making large purchases or embarking on significant projects.     Avoiding Costly Technical System Mistakes Felicia discussed a long-standing relationship with a client that migrated to a new system, resulting in numerous issues. She reviewed the service contracts and master services agreements, discovering that the client was sold a system that was technically impossible to achieve an effective outcome with. The system violated its own requirements, leading to constant issues and financial losses for the client. Felicia emphasized the importance of using a chief technology officer to avoid such costly mistakes.     Strategic Architecture Choices in Document Management Felicia discussed the importance of strategic architecture choices in document management platforms, emphasizing the need for operational maturity, understanding of business processes, and inclusive decision-making. She highlighted the cost implications of using platforms like Atlassian, Sharepoint, and iManage, and the need for a written set of requirements for any project. Felicia also pointed out the challenges of outsourcing document management platform implementations and the need for a highly qualified CTO for consultation. She suggested that Microsoft 365, with its advanced premium licensing and purview, could be a viable alternative to other platforms.     Managing Contracts With Consulting Firms Felicia discussed the challenges of managing contracts with consulting firms and the importance of having a CTO to navigate these complexities. She highlighted the need for clear communication and contractual agreements to ensure project success, as she has often encountered issues with support protocols and project kickoffs. Felicia emphasized the importance of having a CTO who understands business, legal, and economic aspects to ensure smooth project implementation, completion, and ongoing support.     Clear Engineering Plan for Tech Purchases Felicia emphasized the importance of having a clear engineering and implementation plan before purchasing any technology, likening it to buying a server without understanding its capabilities. She stressed the need for a Chief Technology Officer (CTO) to review proposals and ensure they meet the business's requirements, as well as to avoid potential breaches of contract with other vendors. Felicia also highlighted the value of having a CTO with the right skills, rather than relying on IT personnel, to make informed decisions.

In this compelling episode of Breakfast Bytes, host Felicia King delves into the complex world of cloud computing, exploring the intricacies of public cloud, private cloud, self-hosting, and premise servers. With insights from a newly recognized expert in the field, this episode promises to challenge conventional wisdom and offer fresh perspectives on hosting decisions. Felicia unravels the hidden costs and maintenance challenges of managing workloads, whether in the cloud or on-premise. She highlights the significant financial implications and the importance of competent management, urging listeners to reconsider the assumptions surrounding the efficiency and cost-effectiveness of cloud solutions. The episode takes a surprising turn with revelations from Dr. Eric Woodell, whose groundbreaking work questions the reliability of current data center practices. Felicia discusses how Dr. Woodell's findings, backed by Lloyd’s of London, cast doubt on the presumed dependability of cloud-hosted environments, drawing a startling analogy to the aviation industry’s safety standards. As the narrative unfolds, Felicia emphasizes the critical need for effective vendor risk management and the pitfalls of relying on inadequate compliance certifications like SOC 2. She challenges listeners to rethink their approach to third-party risk management and the true value of certifications in ensuring data security and operational integrity. Join Felicia King in this thought-provoking episode that not only informs but also inspires a reassessment of the assumptions driving today's cloud computing decisions. It's an essential listen for anyone navigating the evolving landscape of IT infrastructure and risk management.       Quick recap Felicia discussed the importance of competent management and cost considerations in cloud hosting, and introduced Dr. Eric Woodell, an expert in physical data center and infrastructure industry. She also highlighted the high failure rate in the data center industry, the challenges of outsourcing workloads, and the limitations and misuse of the SOC 2 certification in the data center space. Lastly, she criticized the inefficiencies in vendor risk management processes and recommended a shift in focus towards real integrity processes.     Next steps • IT teams to reassess their reliance on SOC 2 certifications for vendor and data center evaluations. • Business leaders to review and update their Written Information Security Plans (WISPs) to ensure alignment with actual practices and legal defensibility. • Organizations to develop more robust vendor risk management and counterparty risk assessment processes, considering factors beyond standard certifications.     Summary Discussing Cloud Hosting and Legacy Workloads Felicia discussed the topic of public cloud, private cloud, self-hosting, and premise servers, emphasizing the importance of competent management and the need to consider the cost of capital expenditure when comparing on-premise servers with cloud hosting. She highlighted the historical maintenance costs of legacy workloads, such as servers on-premise and in the cloud, and the potential cost-effectiveness of hosting physical servers in someone else's data center. Felicia also mentioned a newly recognized expert in this technology who is involved with a company that certifies cloud hosting providers for insurance by Lloyds of London.     Limitations of SOC 2 Audits and Expert Insights Felicia discussed the limitations of SOC 2 audits, which are conducted by accountants (CPAs) who may not have the necessary expertise to assess data center operations. She introduced Dr. Eric Woodell, an expert in physical data center and infrastructure industry with extensive experience in auditing major organizations' assets in public clouds and colos. Dr. Woodell expressed his opinion that CPAs are not qualified to audit data centers and their operations, as they lack the ability to build and maintain them from scratch. He also shared his findings from years of audits, indicating that third-party vendors often fail to fulfill their maintenance obligations.     Data Center Industry Failure Rate Comparison Felicia discussed the high failure rate in the data center industry, comparing it to the aviation industry. She used a metaphorical analysis from a speaker, who claimed that if the aviation industry had the same level of failures as the data center industry, there would be approximately 530 plane crashes per day. Felicia emphasized the significance of this comparison, noting that if people knew about these statistics, they might not use airplanes. She also mentioned that Lloyds of London, an insurance company, uses the speaker's certification program to assess data center risk. Felicia concluded that she believes in the speaker's numbers and calculations, and that the data center industry's failure rate is a cause for concern.     Outsourcing Workloads Challenges and Vendor Risk Management Felicia discussed the challenges of outsourcing workloads, particularly in terms of reliability and support. She emphasized the importance of vendor risk management, counterparty risk management, and the underlying assumption of competency. Felicia also highlighted the need for workloads to be hosted where they can be supported by competent individuals. She mentioned the work of Dr. Eric Waddell, which has raised questions about the reliability of cloud-hosted services. Felicia also noted the shift in focus towards vendor risk management and third-party information security risk management, particularly in the insurance industry.     SOC 2 Certification Limitations and Misuse Felicia discussed the limitations and misuse of the SOC 2 certification in the data center space. She highlighted that SOC 2 certifications are often conducted by CPAs rather than infrastructure architects, and thus may not be a reliable indicator of competency. She also pointed out that the certification is often used as a check-box exercise by business decision makers, rather than a genuine evaluation of a company's infrastructure. Felicia also touched on the HIPAA space, noting that the use of Business Associate Agreements (BAAs) is not always appropriate and can lead to unnecessary costs and risks. She emphasized the importance of third-party information security and risk management, and suggested caution when dealing with SOC 2 certifications and BAAs.     Addressing Vendor Risk Management Inefficiencies Felicia discussed the inefficiencies in vendor risk management processes, particularly in relation to compliance certifications and the Written Information Security Plan (WISP) for tax preparers, accountants, and car dealerships. She argued that these processes often lack legal defensibility and do not align with reality, instead being mere theatre. Felicia also mentioned a class action lawsuit against a breached company, suggesting that the focus should shift to real integrity processes around vendor risk management. She recommended watching Joe Brunsman's YouTube channel for more insights on this topic.

In this riveting episode of Breakfast Bytes, host Felicia sits down with Crystal Redmann, the inquisitive Operations Director from Redmann Farms, to dive into the intricacies of network security. Crystal brings forth compelling questions about network segmentation, shedding light on how this fundamental security measure can protect even the smallest of organizations. As the conversation unfolds, Felicia and Crystal explore the evolving landscape of cybersecurity threats, particularly focusing on the alarming use of AI by cyber criminals. Through vivid analogies and real-life examples, Felicia illustrates the critical need for advanced security measures and the role of zero trust in safeguarding digital assets. This episode promises to not only educate but also captivate listeners with its deep dive into the world of cybersecurity, making complex topics accessible and engaging for all. Tune in to discover practical insights and proactive strategies to protect your digital world.   Quick recap Felicia and Crystal discussed the importance of network segmentation and micro segmentation for enhancing security, and the challenges of balancing security and functionality in an organization. They also explored the potential risks of deep faking in financial transactions, the evolving threat landscape, and the need for vigilance in device maintenance. Lastly, they emphasized the concept of zero trust in computer security, the significance of personal data protection, and the need for enterprise-grade security for home use.     Understanding Network Segmentation and Security Crystal expressed her need to understand more about network segmentation and its benefits, particularly in terms of security. Felicia explained the concept of network segmentation, emphasizing its foundational role in network layer security. She elaborated on the concept of micro segmentation, which involves treating different assets differently based on their needs and requirements. Felicia highlighted that this approach can bring enterprise-grade security to even the smallest organizations, making it economically feasible and sustainable.     Security Profiling for Device Segments Felicia discussed the importance of creating a security profile for different segments of devices, such as printers, to prevent unauthorized access, data leakage, and the spread of malware. She emphasized the need to restrict communication between devices to enhance security. However, she pointed out the challenges in implementing this approach across various devices, including TVs, printers, and corporate laptops, on the same subnet, stating that it would be practically and economically impossible. Crystal agreed with Felicia's assessment.     Balancing Security and Functionality in AI Felicia discussed the importance of balancing security and functionality in an organization, using the example of the unregulated use of AI leading to potential risks. She emphasized the need for a governance system and leadership that prioritize risk management. Felicia also highlighted the potential of AI being used by cybercriminals, mentioning its use in creating deepfakes and its ability to collect and analyze vast amounts of data. She suggested using services like Abine's Delete Me to reduce the number of lists an individual is on and advised against publicly listing employees on company websites.     Deep Faking Risks in Financial Transactions Felicia discussed the potential risks of deep faking in the context of financial transactions. She highlighted an instance where seven people at a company were deep faked, with one legitimate participant, who was the only one to realize the fraud. Crystal expressed her concern after learning about this case. Felicia further explained that AI could potentially execute a video conference call deep fake to manipulate financial decisions, emphasizing the importance of having proper protocols in place.     AI Training and Evolving Threat Landscape Felicia emphasized the importance and effectiveness of the AI training they offer, highlighting its practicality and relevance. She also discussed the evolving threat landscape, particularly the increasing sophistication of malware and the emergence of ransomware kits that allow even novice users to generate their own variants. Felicia pointed out the limitations of signature-based detection in the face of such evolving threats and advocated for a zero trust approach. She also expressed skepticism about the effectiveness of paying ransomware demands, suggesting it to be a naive approach.     Computer Maintenance and Device Integrity Concerns Felicia explained the challenges and potential threats in computer and device maintenance, emphasizing the need for vigilance and dynamic live updating databases. She highlighted the risks associated with malware and the need to question the integrity of peripherals like USB devices, keyboards, and monitors. Felicia also discussed the importance of procurement policies that prevent the use of unverified or potentially compromised devices. Crystal expressed concern about the threats posed by USB phone chargers, leading Felicia to suggest the use of wireless chargers as a safer alternative.     Zero Trust Concept in Computer Security Felicia explained the concept of zero trust in computer security, emphasizing the importance of assuming all unknown or unclassified computer behavior is malicious until it's been inspected. She detailed how this approach, coupled with machine learning and AI, has led to no breaches among clients under their full management. Felicia also clarified the term's significance, stating that 'antivirus' only represents a small portion of the necessary protection capabilities for an individual computer. Crystal, on the other hand, questioned the effectiveness of antivirus software and its impact on machine learning.     Personal Data Protection and Enterprise-Grade Security Crystal and Felicia discussed the importance of personal data protection and the need for enterprise-grade security for home use. Felicia emphasized the risks of using unverified or low-quality devices and highlighted the significance of brand reputation in ensuring security. Crystal acknowledged her previous naivety about these threats and expressed her commitment to further inquire about these issues. Both agreed to continue this discussion in future meetings.

Welcome to Breakfast Bytes with Felicia King. Today, we delve deep into the often-misunderstood realm of penetration testing. As business owners grapple with the necessity and costs associated with these tests, Felicia demystifies the process, drawing from her three decades of cybersecurity expertise. In this episode, discover why traditional penetration testing might just be a costly theater act and learn the importance of continuous vulnerability assessments. Felicia shares compelling anecdotes and practical advice on how to genuinely safeguard your business without burning through your budget. Join us as we explore the intricate dance between IT teams, automated tools, and the critical decisions that can make or break your company's security posture. This is not just another tech talk; it’s a narrative that could redefine how you view cybersecurity investments.     Quick recap   Felicia emphasized the importance of understanding the objectives of the test, and cautioned against overpaying for tests that may not be necessary or effectively scoped.   Next steps • IT team to implement continuous vulnerability assessment and penetration testing platforms for regular, automated security checks. • CTO/CSO to assess and oversee the implementation of security tools like Tenable One and Senteon for secure configuration management. • Executive management team to allocate budget and provide support for IT department/MSP to implement necessary security changes and tools.   Summary Test Scope and IT Consultancy Management Felicia also advised that the test should be scoped correctly and conducted by the IT consultancy that manages the company's networks, servers, and applications. She cautioned against overpaying for tests that may not be necessary or effectively scoped.   External Testing Approach and Cots Definition She argued that the approach of bringing in an external third party to conduct a test without proper consultation and scope can lead to incorrect results. She emphasized that this approach would be more effective in identifying and addressing vulnerabilities, and would provide demonstrable results. Felicia also clarified the term 'COTS' as defined by the National Institute of Standards and Technology in the context of information security technology.   Enhancing IT Configuration for Business Acquisition She argues that this approach provides more meaningful and actionable information, enabling IT configuration personnel to effectively address identified gaps. Felicia also highlights the importance of using recognized and professional tools like Tenable One and Senteon for secure configuration management. She emphasizes that this approach offers a better return on security investment and is more beneficial for businesses seeking to be acquired.   IT Testing and Business Decision Makers' Guidance She suggests that business decision makers should provide clear direction and funding for IT before such tests are conducted.  

Good morning and welcome to another episode of Breakfast Bytes. I'm your host, Felicia King, and today, I'm joined by my colleague, Jeff Birner, hailing from Florida. Our riveting discussion centers around the recent CrowdStrike incident that has sent shockwaves through the cybersecurity community and beyond. This episode promises to offer insights and perspectives you won't find in the typical news coverage. As we delve into the conversation, Jeff and I explore the core issues surrounding CrowdStrike, including its lack of trustworthiness as a counterparty and the legal implications of delayed security updates. We discuss the broader impacts of the incident, such as the staggering $5.8 billion in losses faced by companies worldwide, and discuss how technology decisions could have eliminated the impact. Through engaging storytelling, Jeff and I break down the complexities of cybersecurity, offering practical solutions and strategies for organizations to consider. From the importance of testing updates to the choice of operating systems for critical infrastructure, this episode is packed with valuable takeaways for IT professionals and business leaders alike. Join us as we navigate the nuances of the CrowdStrike controversy, highlight the lessons learned, and provide actionable advice to help you safeguard your organization against similar pitfalls. Whether you're a seasoned cybersecurity veteran or just starting your journey, this episode of Breakfast Bytes is a must-listen.  

Good morning, you're listening to Breakfast Bytes, and I'm Felicia King. Today's episode takes a deep dive into the world of artificial intelligence, offering a perspective that challenges the mainstream narrative. Instead of jumping on the AI bandwagon, we'll explore the importance of cautious engagement and risk management when dealing with this powerful technology. We'll delve into the profound implications of AI, discussing the potential risks and the measures you can take to mitigate them. From the economic challenges of running closed AI systems to the dangers of data leaks and professional pitfalls, this episode covers it all. Hear about real-world examples, such as the attorney sanctioned for relying on faulty AI-generated content, and learn how to navigate these treacherous waters. Discover how AI is reshaping industries and the critical need for policies and training to ensure safe and effective use. We'll discuss the importance of governance, accountability, and transparency in adopting AI, and how regular, ongoing training can make a significant difference in risk management and productivity. Join us as we uncover the darker side of AI, from its role in technocratic control to the enhanced capabilities it provides to bad actors. Learn how to protect yourself and your business in this rapidly evolving landscape. Whether you're a small business owner or part of a large corporation, this episode is packed with insights and strategies to help you make informed decisions about AI. Tune in to Breakfast Bytes for a thought-provoking discussion that will leave you better prepared to navigate the AI frontier with caution and confidence.   Quick recap     Felicia discussed the potential benefits and risks of artificial intelligence (AI), emphasizing the need for caution and thoughtful risk management in its use. She highlighted the importance of operational maturity and the role of technology executives in developing customized policies for clients. Felicia also underscored the significance of maintaining relationships with service providers, having consistent policies and strategies, and regular training to effectively manage risks and improve productivity.     Next steps     • Business owners to develop and implement an AI policy for their organization, including staff training on AI risk management. • Organizations to consult with technology executives (CTO/CISO) to create appropriate AI usage guidelines and risk mitigation strategies. • Companies to implement regular (preferably weekly) cybersecurity and technology training programs for all staff to reduce risks and improve productivity.     Summary     AI Risks and Potential Applications Discussed Felicia discussed artificial intelligence (AI) in her radio show, "Breakfast Bytes." She emphasized the need for caution and thoughtful risk management when using AI, highlighting its potential implications and the importance of understanding its deep impacts. Felicia pointed out that AI could be beneficial in areas like marketing content and sales promotions, but warned against using it for financial, medical, or legal matters due to the potential risks. She also advised against using AI chatbots, citing the lack of security and the risk of data leakage.     Felicia's Operational Maturity and AI Advice Felicia argued that over 80% of businesses, regardless of size, lacked operational maturity and were not utilizing AI appropriately. She claimed that smaller companies could more easily achieve operational maturity and consistency in policy, while larger companies struggled with governance, accountability, and transparency. Felicia also highlighted the potential cost of not seeking advice, relating numerous examples of organizations that had incurred significant expenses due to their lack of consultation with technology executives. She further indicated that operational maturity not only reduced costs but also increased profits, efficiency, and reduced waste.     AI Policy and Risk Management Strategies Felicia discussed the importance of providing clients with an AI policy and risk management courses to mitigate potential risks. She emphasized that these tools, which are part of their Vcto and Vc services, are designed to help clients proactively manage risks. Felicia further pointed out that having a technology executive, such as a CTO or CISO, is crucial in developing policies that are customized to the client's specific needs, as opposed to relying on a generic template. She criticized the use of templates and reliance on attorneys to develop policies, stating that this approach is ineffective and can lead to non-compliant and misleading policies.     Managing Relationships With Service Providers Felicia discussed the importance of managing relationships with service providers such as lawyers, tax advisors, and recruiters. She highlighted the benefits of having ongoing relationships with these providers, allowing for budget planning and better service. Felicia also raised concerns about the misuse of AI, particularly in the staffing industry, emphasizing the need to carefully consider the nature of the relationships with customers and the confidentiality of information. She suggested that if information is non-confidential, it is acceptable to use AI, but organizations should always approach AI usage with a risk management approach.     Consistency, Accountability, and Transparency in AI Governance Felicia discussed the importance of having consistent policies and strategies across an organization to prevent conflicts and unproductive activities. She emphasized the need for organizations to consult with their technology executives to devise such policies and to provide training to their staff. Felicia pointed out that a lack of governance, accountability, and transparency could lead to challenges, particularly with AI, which could be exploited by bad actors. She highlighted the importance of driving accountability within the organization and utilizing technology effectively.     Regular Training for Risk Management and Productivity Improvement Felicia emphasized the importance of regular, ongoing training for individuals and organizations to effectively manage risks and improve productivity. She suggested that training should cover both company policy recommended strategies and how to use technology, such as Outlook and OneDrive. Felicia also highlighted the increasing threat of scams due to lowered technological barriers, advocating for proactive measures to combat this. She warned against over-reliance on AI, which could lead to digital control and profiling of individuals, and encouraged further research on this topic. Lastly, she offered her assistance in developing a sophisticated, highly effective risk-reducing program for businesses.

Felicia stressed the importance of informed decision-making in technology services and products, and the need for involving skilled professionals in decision-making processes. She also discussed the longevity of structural furniture, the challenges in network switch installation, and the need for a formal procurement process in the IT department. Furthermore, she highlighted the issues with current wall-mount cabinets and open racks, the business impact of operations beyond regular hours, the need for proper equipment maintenance, and the importance of having an on-site technical point of contact at every facility. Action items • Felicia recommends ensuring the IT department follows a defined procurement process with oversight from a technology executive. • Felicia recommends establishing written requirements and standards for IT infrastructure like racks and cabinets. • Felicia recommends implementing a policy for designating on-site technical contacts to handle basic equipment issues.   Summary Informed Decision Making in IT Services Felicia emphasized the importance of informed decision making in technology services and products, which is beneficial for all IT stakeholders. She pointed out the persistent negative financial impact caused by ill-informed decisions, often made by business leaders delegating to inexperienced internal IT departments. Felicia advocated for the involvement of skilled professionals, such as CTOs or senior architects, in decision-making processes to mitigate these adverse effects. She also cautioned against the common practice of selecting the cheapest bid as a decision-making criterion, highlighting it as a recipe for failure.     Structural Furniture Longevity and Design Felicia discussed the longevity and durability of structural furniture, particularly cabinets and racks. She emphasized that these pieces, often made of steel, aluminum, glass, and possibly plastic, can last for decades if not physically damaged. Felicia argued that considering a 20-year life cycle for such hardware is a more realistic approach than starting from an acquisition cost requirement. She also highlighted the advantages of a four-post full floor standing cabinet over a two-post rack, especially for secure and critical infrastructure. Finally, she noted the importance of wheels in cabinets from a maintenance perspective and referred to cabinet design as an art form.     Felicia's Network Switch Installation and Maintenance Insights Felicia shared her extensive experience and insights on the challenges and considerations in network switch installation and maintenance. She emphasized the preference for a 4-post configuration due to the weight and depth of modern switches, and the issues that may arise with alternative setups. Felicia also highlighted the importance of understanding the ramifications of equipment placement, sharing a troubling example of a poorly executed setup. She suggested ways to prevent such issues from occurring in the future.     Improper Procurement Process in IT Felicia discussed the lack of a formal procurement process in the IT department, which leads to inefficient and often unnecessary purchases. She explained that the department, composed of individuals not highly proficient in business value justification or total cost of ownership articulation, often sourced items themselves using credit cards, without proper checks and balances. Felicia emphasized the need for a written requirements list to facilitate better decision-making and prevent the focus on apparent acquisition cost. She indicated that she would provide two examples to illustrate these points.     Addressing Inadequate Infrastructure and Procurement Felicia discussed the recurring issues with the current wall-mount cabinets and open racks in the infrastructure, which were not deep enough to accommodate modern switches. She emphasized that this problem wasn't new and had been ongoing for at least a decade. Felicia pointed out that previous investments in these inadequate setups were essentially wasted, not just in terms of money but also project time and potential business unit outages. She underscored the need for an appropriate procurement process and oversight to avoid such issues in the future.     Managing Operations Outside Regular Hours Felicia discussed the business impact of operations extending beyond regular business hours. She highlighted that this not only affects payroll and product but also has implications for business continuity outside of IT. Felicia emphasized that IT personnel, such as PC technicians and IT managers, often only consider their own needs, which differs from the perspective of a technology executive. She stressed the importance of a different mindset, drawing from her experience as a chief operating officer and service manager, to effectively manage a large number of remote offices.     Client's Server Outage Due to Unauthorized Access Felicia shared a story about a client who opted not to spend $350 on an idrac enterprise card, a decision that led to a server issue causing an outage. She emphasized the importance of proper equipment maintenance and restricting unauthorized access to technology cabinets. Felicia pointed out that allowing staff without proper training or maintenance responsibilities to have access to such spaces can lead to unintentional damage, as seen in the case of the client where a staff member put a box on a server keyboard, causing an outage. She underscored the significance of having a mature policy in place regarding remote support and access to technology cabinets.     On-Site Technical Point of Contact Importance Felicia stressed the necessity of having an on-site technical point of contact at every facility to handle minor technical issues. She used the example of rebooting cable modems, which she stated often require physical intervention and should not disrupt other equipment. Felicia also emphasized the importance of setting up the facilities in a way that allows easy access for the on-site technical point of contact to perform these tasks without causing further problems. She underscored that this is a common requirement and should be considered in the facility's setup.     Technology Executive's Role in Procurement Felicia emphasized the importance of having a technology executive oversee procurement policies and standards in IT departments to ensure good outcomes. She highlighted that the IT department alone should not be making procurement decisions, as they often lack an understanding of the total cost of ownership. Felicia also rejected the idea that a dollar amount should be the sole determinant of procurement decisions, citing the potential for malware to compromise the system. She advocated for a designated technology executive to establish policies and standards, warning that failing to do so could lead to adverse financial outcomes for the organization.   For more information, review this resource about racks and cabinets. https://www.qpcsecurity.com/2024/04/26/why-buy-racks-and-cabinets-from-qpc-security/ Peruse the value of vCISO services. https://www.qpcsecurity.com/vciso-services/  

Welcome to an insightful episode of Breakfast Bytes, featuring an in-depth discussion about Zero-Trust Cybersecurity, a vital approach to modern cybersecurity practices. Understand why this network layer protection strategy is essential to guard your business and residential networks against harmful threats. From a reflective analysis of the cybersecurity landscape four years ago, Felicia highlights the repercussions of a weak cybersecurity posture, emphasizing the necessity of a resilient and efficient cybersecurity stack. She elaborates on the integration of various concepts like endpoint protection product (EPP), endpoint detection and response (EDR), and managed detection and response (MDR) into a single efficient agent, stressing the significance of regular patch management and advanced reporting. Dive deeper into specific cybersecurity products that embrace the robust Zero-Trust model, like Panda Adaptive Defense 360 and ThreatLocker, and understand how they can suitably fit into varying scales of businesses and homes. Felicia additionally debunks a common misconception about technology by default ensuring security and clarifies the crucial need for actively adopting an apt security profile catering to specific contexts. In this episode, we also discuss the importance of equitable administrative access, insist on local data collection and prevention of unauthorized data file collection, and delve into the need for stringent network security in the face of growing security breaches and ransomware attacks. Understand the comparison between different products, their cost differences, and the underlying need to harmonize cybersecurity mechanisms with operational structures, concluding with an open invitation for consultations on effective and budget-friendly cybersecurity solutions.

In this episode of Breakfast Bytes with Felicia King, we navigate the complex but crucial realm of cyber security. We explore the emerging menace of supply chain attacks and underscore the vital need for proactive incident response planning. Felicia reveals the staggering average cost of a cyber-attack, per employee and endpoint, and explains why smaller businesses might suffer even greater losses. King sheds light on the often unnoticed aspect of incident response planning: the critical period between discovering a potential compromise and confirming a successful attack. She also scrutinizes the implications and expenses of in-house response strategies for sizable businesses and outlines how smaller establishments could face heftier costs. Offering valuable advice, Felicia provides business-centric recommendations on methods of dealing with a reported incident. She addresses important issues such as identifying data breaches and managing downtime during a crisis, stressing the importance of having a contingency plan for extended recovery periods. Moving on to supply chain risks, King critiques the increasing trend of outsourcing in the IT sector. She cautions against granting upstream providers unrestricted access to systems, noting counterparty risk as an area demanding heightened vigilance. Deeper discussions on access control, audit logs, automated compliance reporting, and other factors in selecting an efficient identity and access management system also unfold. King further navigates the topic of APIs - the lifeblood of numerous industrial integrations - offering crucial insights into associated risks. She concludes with a call for a mindset shift required to tackle supply chain attacks effectively. In contemporary threat landscapes, relying solely on the cybersecurity kill chain is a losing battle. This episode underscores the need for encompassing multiple defensive strategies for cybersecurity, such as multi-factor authentication, and conditional access for all accounts. Real-time analytics, endpoint protection strategies, and a zero-trust posture are championed as critical for preventing malicious activities and providing swift threat responses. We delve into the pros and cons of network layer security, a powerful yet complex technique requiring specific expertise. When appropriately utilized, it presents a scalable solution managing traffic filtering and robust protection from supply chain attacks. The episode concludes with the importance of having a solid incident response plan as a vital proactivity measure in cybersecurity.

In today's episode of Breakfast Bytes, hosted by Felicia King, we delve into the pressing issue of cybersecurity in K-12 education with special guest, Chris Rule, a Technology Director with 25 years of experience. We discuss the urgent need for tangible action in this area and explore operational maturity practices like third-party information security risk management, vendor risk management, vulnerability management, and password management. A focus of the episode is the need to translate cybersecurity concerns into strategic actions at the executive level. We also discuss the impact of cyber insurance programs and the severe disconnect between cybersecurity compliance requirements and their implementation at the school level. We dive into the critical necessity of creating operational structures that prioritize cybersecurity, incorporating crucial regulatory compliances such as CIPA, FERPA, and COPA. A poignant part of our discourse is managing the 'human element' of cybersecurity as cyber-attacks are increasingly centered on social engineering. This necessitates not just a technical solution, but a cultural shift in organizations, making cybersecurity training a mandatory part of human resource management. This episode also touches on the challenges of implementing IT security measures in small school districts. It emphasizes the importance of an institutionalized onboarding program that includes both technology aspects and basic legal knowledge. We highlight the need for better collaboration between board professional organizations and security companies, and discuss parental demands and voluntary programs that schools can utilize to assure their commitment to student data protection. In conclusion, we explore the practice of hiring fractional CISOs and CTOs to help IT directors manage their various responsibilities within limited resources. Tune in to this comprehensive episode to learn more about the challenges of and solutions for implementing cybersecurity in K-12 education.

In this episode of Breakfast Bytes, vCISO Felicia King of QPC Security uses an example of dark web data and how it can be leveraged. She describes how operational maturity in an organization can make that organization more competitive, lower risk, improve collaboration, improve culture and employee retention, while reducing risk.   She explores why actioning relevant, specific data is more critical than simply having it available. Learn how the combination of constant training and right data can effectively reduce risks and add value in a business of any size. These methods are practical for large and small organizations. QPC has deployed these tools and methods for orgs as small as one user! This episode takes you through the potential uses of dark web data and platforms like Telegram, leading to better risk mitigation strategies. Felicia, with her hands-on approach, shares the best practices adopted for her own clientele. She emphasizes empowering end users by presenting them the relevant information at the opportune moment. By fostering a culture promoting consistent training, businesses can enhance operational efficiency and employee satisfaction while reducing conflict. The episode also stresses upon a culture of shared responsibility to make risk management more cohesive and less confrontational. The responsibilities lie not only with the CEO, but also under the active purview of CTO, CIO or CISO in an organization.  With the advent of affordable cybersecurity training platforms capable of dark web monitoring, organizations can now lower risks attributed to their data. But what makes the real difference is how these platforms are utilized. The episode extensively discusses the gap between compliance and security, drawing focus towards the need for proactive, contextual security measures. Discover the significance of a cultural shift, with due attention to training, policy enforcement and personal responsibility in maintaining top-notch information security. A well-informed staff equipped to deal with real-time issues, not only boosts productivity but also helps in managing IT costs. Tune in to this episode and delve into the world of dark web data, risk management, and securing a technology-driven business environment today. Check out our supporting article on getting value from dark web data. https://www.qpcsecurity.com/2024/04/25/dark-web-value/  

"Unlocking Strategic IT Investments and Information Security: Expert Insights with Gina King" dives into the critical aspects of IT investments and infrastructure. Felicia King, host of 'Breakfast Bytes', engages in a captivating conversation with Gina King, a leading Chief Information Security Officer. The extensive dialogue sheds light on necessary expenditures on Information Systems and Technology, managing and optimizing security investments, and realigning perceptions of IT as a valuable strategic asset. Through their enriching discussion, Felicia and Gina tackle widespread issues of underinvestment in IT, encouraging businesses to understand and optimize their IT expenditures. Pointing to the risks of non-compliance and inadequate IT security measures, they illustrate how a thorough approach to IT spend analysis can tremendously impact a company's financial bottom line, customer satisfaction, and overall client experience. The episode highlights the importance of a proactive and continuous IT security investment to nurture an effective information security risk management program. Felicia and Gina underscore the significance of considering cybersecurity as an aspect of overall business risk, rather than an isolated problem. They also emphasize the value of tech-savvy leadership and security education in fostering a vigilant workforce and strengthening an organization's security posture. Switching gears to effective risk management amidst the digital landscape, the episode ends on a call for creating clear policies, continuous vigilance, and an understanding of organizational identity to safeguard online infrastructures. This engaging discussion is a must-listen for anyone involved in IT procurement, investments, security, and overall business operation.

Join us in this insightful episode of Breakfast Bytes with Felicia King, along with our guest Kyle Wentworth of the Wentworth Group. We delve into a balanced exploration of business needs vs IT security needs, demonstrating the magnitude of this issue with a case study of a massive spam operation hijacking over 8000 trusted brand domains. https://thehackernews.com/2024/02/8000-subdomains-of-trusted-brands.html In this detailed conversation, our experts elucidate steps towards prevention and emphasize the significance of effective domain ownership and control. Kyle highlights the central role of Technology Management departments in mitigating IT risks and stresses the importance of a comprehensive understanding of orderly processes for DNS management, timely publishing of DNS records, and the related cost implications. This episode underscores the need for operational maturity in businesses, and how maintaining domain infrastructures and adhering to robust protocols can protect your business from digital threats. Listen to gain invaluable insights into how businesses of all sizes can level up their understanding of the intersections of business and IT security systems. The episode also draws attention to the potential vulnerabilities of newly registered domain names and the common pitfalls relating to outsourcing these functions. We underscore the necessity to take caution or face serious losses and discuss the ramifications of transferring control of key business aspects to external vendors. With a candid look at the dangers of ill-considered network security and the hazards of transferring all risks to an external IT service provider, we make a strong case for integral security measures. Listen in to gain an understanding of the importance of viewing technology as a business partner rather than an expense and to learn how focusing on strengthening your network security can pave the way for business success.

In today's episode of Breakfast Bytes, we are delighted to have Joe Brunsman from Brunsman Advisory Group as our special guest. Known for his extensive knowledge on the intersecting worlds of insurance and cybersecurity, Joe offers beneficial insights on the evolving sphere of insurance exclusions and how businesses can navigate these changes amidst the increasing threats of cyber warfare. Tune in as we explore the importance of adopting risk mitigation strategies with tangible security investment returns rather than relying solely on insurance coverage. Join our profound discussion on the role of senior management in establishing a secure digital environment, starting from understanding IT risks and challenges, creating actionable plans, and sticking to a consistent policy. We also delve deeper into topics like legacy technical debt, the role of a Chief Information Security Officer (CISO), gaps in current insurance policies, and breaches of customer contracts owing to the lack of managerial insight in the IT sector. In this knowledge-packed episode of Breakfast Bytes, we help you understand the intricate relationship between insurance and cybersecurity, and how enhancing comprehension in these two areas can secure your business in this fast-paced digital age. Listen as we unwrap various complexities surrounding cyber insurance and the emergence of warranties as an alternative, exploring their potential pitfalls and inconsistencies. From diving deep into the history of insurance to shedding light on the impending exclusions in the upcoming insurance policies, we've got it all covered. Moreover, we highlight the need for skepticism and caution while dealing with Cyber Insurance, emphasizing comprehension over rushing headlong into the risky space of cyber warranties. Also, discover the correlation between proactive security measures and reduced insurance coverage needs, and understand why more insurance doesn't guarantee better safety. Lastly, our guest Joe Brunsman sheds light on the seldom-discussed aspect of cyber insurance and data security. Learn how states are regulating insurance companies for holding sensitive data and the shockingly minimal regulations surrounding warranty companies. Get enlightened about the real-world realities of cybersecurity and how, despite utilizing SaaS platforms, corporations are not as secured as they think. This episode guarantees both enlightenment and critical thinking around cyber insurance and data security. Tune in to gain a wealth of knowledge on this important but often unexplored domain!

Welcome to another eye-opening episode of Breakfast Bytes hosted by Felicia King. In this episode, we dissect prevalent misconceptions in the IT industry particularly regarding services like NOC, SOC, XDR, and SOAR. Explore the conundrum between cybersecurity checkbox exercises and the pivotal need for legitimate risk reduction efforts. Moreover, discover potential pitfalls of co-managed IT and strategies to sidestep them. We delve extensively into co-managed IT services, illustrating their significance, pitfalls, financial risks associated with improper executions, and real-life challenges and liabilities. Emphasis is also laid on the involvement of the clients and their responsibilities in relevant scenarios. Our host Felicia does not just spotlight the issues in the IT sector but equally provides insightful solutions and pragmatic advice. Crucial facets like service evaluation, defined requirements, discrepancies between 'theater' and real risk mitigation are discussed at length. This episode includes a discussion about shared responsibility, a cornerstone to successful IT operations. Unravel the importance of clients understanding policies, embracing HR enforcement, and being proactive in managing potential IT and security risks. We further cover the vital part they play when ensuring efficient IT systems and cybersecurity. We question the practice of delegating SOC to third parties due to its contribution to fragmented security operations and poor risk management. Instead, we advocate for a converged NOC and SOC model. Explore how greater comprehension and collaboration paired with user training, self-reliance, and policy adherence can prevent catastrophes like litigation. Beyond outlining potential risks and solutions, this episode offers practical advice for managing complex escalations and ensuring secure configurations, all through the converged NOC and SOC model.

Felicia is joined by fellow CISO Dawn Montemayor, partner at PureCyber, which is a security minded business consulting firm. Learn from two CISOs about how vital it is to use operationally mature processes in requirements definitions in order to achieve effective outcomes while avoiding toxic behavior in complex entities. the importance of vulnerability assessment and management requirements in contracts It is imperative for resource owners to be designated and held accountable to outcomes. Exit strategies must be established as part of the procurement process Lack of right to audit clauses in cloud services contracts How the lack of an effective paradigm leads to destructive decision-making IT must not be seen as the dumping ground or janitor. Instead the business must be charged back for the real proportional costs for the cost of service. True TCO calculations must be made as part of the procurement requirements definition. Systems integration and interaction maps are incredibly valuable IT must be seen as a business partner and involved in decision-making. Just because IT wants to say yes to help the business does not mean the business gets to disrespect IT standards. Talking to the CISO can lead to utilization of an already vetted, approved platform making the pace of business faster. Why procurement justification statements are imperative Why it is necessary to track TCO and actual costs for product and services associated with a business function Why it is essential to use operationally mature processes in a paradigm focused on governance, accountability, and transparency Why the CISO and CTO should sign off on procurement of anything for which there is not already an approved policy standard on. Why your CISO needs to review the contracts for a service or product before an officer of the company signs the contract Why business leaders must consider how their revenue is event driven Why the shared responsibility model is imperative. Resource owners must be defined and made accountable.

Felicia is joined by Laura Conrad, a Security Architect with 30 years of experience in enterprise environments. Laura currently reports directly to a CISO, and has been an integral part of the information security program at two large enterprises. Felicia has consulted with 26 large enterprises and numerous SMB organizations in the last 30 years. She finds that the same problems occur in every organization that lacks operational maturity.  Are you a person working in information security frustrated by the lack of progress of a security program in an organization because of the org's lack of operational maturity? Do you struggle in dealing with toxic, unproductive people? What approach could address these problems and more? Learn from two experts how they have seen companies engage in self-destructive and resource wasting approaches simply due to the lack of drive by executive leadership to install a structure for governance, accountability, and transparency in the organization.  Org structure required for CISOs to be effective This article and its impact are briefly covered as they are related to this topic. https://www.darkreading.com/cybersecurity-operations/cisos-struggle-csuite-status-expectations-skyrocket It is quite a good article, but it implies that if the CISO reports directly to the CEO, the problems in an organization will be reduced. While that is partially true, that by itself will absolutely not fix the problems. Felicia and Laura deep dive the decision-making failures that occur throughout an organization and what drives them. Also discussed are methods to truly and structurally correct the problems across an entire company. 95% of information security risk management issues are HR management issues Executive management want to run the company, not manage people. This leads to toxicity and unproductivity being tolerated when personnel issues are not fully investigated and actioned. The desire to make an emotional problem go away cannot override the need to get to the core of the issue and put a system in place to prevent it from happening again. This is not about firing people. This is about instilling a culture where the facts matter, personnel issues will be investigated, and structural systems will provide the governance to drive productive staff behavior. Org executives are unaware of the real costs of inputs It seems to be a pervasive problem across most organizations that there is no financial management structure which facilitates the tracking of expenses as inputs to a service or product delivery to customers. Without this real understanding, leaders persistently price products and services incorrectly. This leads to one business division or a product line losing money and needing to be subsidized by another. Executives rarely understand that by tolerating operational immaturity in their organization, they are actually failing in their duty to stakeholders to effectively manage the assets of an organization to maximize value. Drive change and org-wide staff effort alignment with dashboards that drive transparency and healthy internal competition Felicia and Laura discuss in detail the how and why of dynamically updating dashboards which help CTO, CIO, CISO manage upward to the CEO and board, while driving downward alignment to objectives. Governance, Accountability, Transparency in IT Security Felicia and Laura discussed the importance of governance, accountability, and transparency in IT security and business processes. They emphasized that these principles could help prevent problems caused by a lack of collaboration and understanding between IT and business units. Felicia cited instances where poor prior planning led to unnecessary expenses and internal toxicity, which she believes could be avoided with a more mature approach to operations. Laura added that these principles could also lead to cost savings and risk reduction.  Harden the procurement policies Felicia and Laura provide many examples of problems that could have or were avoided by having an enforced procurement policy which resulted in all technology purchases being signed off on by the CISO or security architect and often the enterprise architect. It is infinitely easier to rectify issues before an implementation and before signing a contract than to do so after a purchasing decision has already been made.

Felicia shares insights on the pitfalls of changing IT service providers or MSPs for both clients and the IT service providers themselves. This content is based upon a number of questions that other MSPs have posed to Felicia asking for advice as well as numerous first hand experiences on the subject. This podcast is primarily for IT service providers or MSPs, but business decisions makers who are considering making a change would also benefit from the content.

Special guest Tobias Musser of MNS Group generously shares with the Breakfast Bytes audience his wisdom and insight into what is a challenging and nuanced regulatory landscape that has far reaching business implications. https://mnsgroup.com/ A vigorous discussion of the implications of the latest DoD memo about DFARS 7012 FedRAMP or FedRAMP moderate. FedRAMP Compliance Challenges and Hybrid Approach Tobias and Felicia discussed the implications of a DOD memo mandating FedRAMP compliance for all products used by a DOD contractor or subcontractor. They explored the potential challenges, especially for small businesses, and the difficulties in achieving equivalence. They considered the idea of using on-premise solutions as an alternative, but noted the need for specific documentation and careful implementation. Tobias and Felicia also deliberated on the potential benefits of this approach, including the severability benefit of on-premise solutions. They discussed the challenges of finding cost-effective, user-friendly FedRAMP tools, noting their high cost and complexity. They also touched upon the implications of a recent memo that increased the requirements for FedRamp compliance and the potential security issues associated with it. Tobias emphasized the need for increased security to protect soldiers and the country. They concluded that a hybrid approach was necessary, but the current tools were not up to the task.

Tom Dean of Consulting Adventures joins Felicia for part three of the analysis on mobile devices and the problems with them. OKTA breach, IT admin’s password getting stored in gmail password synced manager Two-way problems. Personal on business and business on personal Lack of clarity around device wipe, device use policies, apps running on devices Compliance is easier when business owns the asset and delineation of ownership of asset and data is clear. If the configurations are not managed, the cost profile to the company is a lot higher. Credentials and MFA spill over in both directions Data compliance issues DLP and encryption issues Lack of ability to define device security settings like PINs How are you doing effective device configuration backups? How do you prevent malicious apps from being installed on the devices? How do you have leveraged support capabilities from the mobile devices? Asset inventory is mandatory Compliance costs can be drastically reduced by having company owned assets that only get approved applications. This is another reason why end users CANNOT have admin access. No VPN access until someone has been part of the company for 30 days. Onboarding and offboarding is crucial to information security Information security is not a technical controls issue, it is a HR management issue.   Verizon fell for fake “search warrant,” gave victim’s phone data to stalker https://arstechnica.com/tech-policy/2023/12/verizon-fell-for-fake-search-warrant-gave-victims-phone-data-to-stalker/ As if all that wasn't bad enough, if an employee of a company has issues in their personal life, it will spill over to business and especially in the context of allowed personal use of company assets.

Part 2 of a series on threats to mobile devices and through mobile devices. Tactics and techniques to deal with those threats. Cohost: Tom Dean – Consulting Ventures Tom has decades in capital goods manufacturing industry (fortune 500 scale) Years of experience in marketing, sales & interfacing with independent dealers/distributors (small/medium scale) Current focus is strategy & risk management consulting Lifelong learner and an interest in technology. Strategy + risk management ---> mobile devices Topics: Apple find my network; useful feature, but privacy considerations SSO risks where there are too many items that can be compromised if there is a single compromise of a single system Out of band SMS Problems with Twilio and 10DLC for VOIP SMS Know your customer regulations, implications with SMS validation for ownership establishment Synology came up with their own Synology MFA app and the problems with that Do not call registry updates; Good news!

Part 1 of a two-part series on threats to mobile devices and through mobile devices. Tactics and techniques to deal with those threats. Cohost: Tom Dean – Consulting Ventures Tom has decades in capital goods manufacturing industry (fortune 500 scale) Years of experience in marketing, sales & interfacing with independent dealers/distributors (small/medium scale) Current focus is strategy & risk management consulting Lifelong learner and an interest in technology. Strategy + risk management ---> mobile devices Personal travel: Laptops have transformed to mobile devices (phones and tablets) Risk was more contained with laptops, but the impact is much higher with mobile phones. A lot of nuances around "was the password revealed?" Biometrics are convenient but quite dangerous Biometrics are a proxy for a numeric passcode on a mobile device. Physical compromise is a 5-alarm fire situation. Physical loss when it is not compromised is not that big of an issue as long as authenticators are backed up. Must have erase after 10 bad password attempts. Turn off notifications on screen lock. Do not have notifications turned on to display on the lock screen. Avoid banking apps. The first things that the baddies go after are Venmo, Apple Pay, Cash apps. Out of band SMS for MFA SIM swapping risk, or eSIM embedded in the phone Put a PIN on your physical SIM. MySudo – Can clone that instance to other phones. Password manager on phone Disaster if this is based upon your biometric. You can use a different or secondary PIN. You can use Yubikey. Password manager helps you recover. Segmentation strategies They can see all the emails on your phone and change passwords or password reset is typically done via email Screentime on Apple can be helpful, but there are weaknesses there. The only way to really secure the device is to use a MDM. You still need to be concerned about MFA and account takeovers. Need to have an out of band mechanism to receive alerts and ability to remove kill the device. Microsoft Authenticator and Google Authenticator do not have a separate PIN. Authy is free. It has its own separate PIN. Yubikey is great but assumes that you can manage controlling the physical access to that. Do not store on your key chain. Diversification strategy with inventory. MDM Kill apps Apple configurator – small scale Apple Business Manager Jamf – requires Apple Business account for security Inexpensive “Jamf Now” for small businesses. Minimum is one device. The first 3 are free. Still affordable beyond that. Don’t let anyone change the account on this device. You have to figure out a lot on your own and block URLs that you don’t want accessed. Apple devices need to be in supervised mode, so it matters how you buy them. Intune Risk examples loss of device (resiliency e.g. MFA) theft of device involving passcode surrender (loss mitigation) SIM swap (cellular store employees) SIM card theft (removal of SIM card from phone) Risk reduction / resiliency OS decision (iOS vs. android) Note that one is not better than the other Risk reduction is all about an individual's ability to manage the risks based upon platform selection MDM (remote data wipe): small-scale co (Apple Configurator or JamfNow) vs. corporate MDM MFA backup/diversification (SMS via cell or VOIP providers vs. TOTP vs. passkey/yubikey etc.) App selection (OS-based or Independent) App protection (‘independent’ PIN protection vs. face/touch ID) ‘Attack Surface’ – minimization of exposure (e.g. banking apps, cash apps, findmyfriends etc.) Resources https://www.darkreading.com/application-security/okta-flaw-involved-mgm-resorts-breach-attackers-claim https://arstechnica.com/security/2023/09/a-phone-call-to-helpdesk-was-likely-all-it-took-to-hack-mgm/amp/  

The process of determining how workloads should be hosted is very complex and not a decision that should be abdicated to the IT service provider. Business decision-makers must be involved in those decisions as only they are able to define the key criteria that all other factors are dependent upon.  

CTO Kyle Wentworth joins Felicia for a discussion about how businesses can avoid adverse financial impacts.   Lack of understanding of the language of technology It changes so incredibly fast that it takes a sea of people who understand the pieces Complete perspective of how the business of technology should be run   Understand what governance and compliance standards your business is held to That dictates how you do business.   Some tangible examples of how things can and should be done: Justification statement annually for expenses How it is being used and how the costs were arrived at Assignment of the resource owner Misallocation of funds paying for items that should not be paid for takes resources from other needed items.   Walk through your business. Identify what you don't understand about the business? Do you understand every function of the business? You have to entire your entire business as a whole if you are the leader of the business. Gaps in your understanding indicate where you need an auditor to identify that your people doing the processes are doing it properly.

Why it is critical to have an email security expert managing and monitoring email security configurations and delivery of email on an ongoing basis. Instructions from marketing automation platforms are not adequate. It matters A LOT what you are trying to do with email. Getting these items configured is an art form. Vendors are continually failing vendor risk management analysis and losing business over their email not being properly configured.   New website resource:   https://kb.qpcsecurity.org

Kyle Wentworth of Wentworth Consulting Group joined Felicia to compare/contrast three C-suite level IT/IS related roles. Kyle has 35 years of business experience and has been working on computers since 1976. He is a: Fractional CTO Business coach Business process modeler Kyle has a great resource on his website to help people understand the differences between these C-suite roles. https://wentworthconsultinggroup.com/cto-cio-ciso-consulting/ Listen to the podcast for some Kyle truth bombs such as: "Technology runs your business. You don't. We facilitate technology to run our business. IT is the most critical function of your business." "Technology is harder to manage than brain surgery. Then why are you having conversations with technologists? Technology footprint is harder to identify and manage than brain surgery." We talked about Felicia's hot button which is a lack of a quality, enforced procurement policy. "The reason you give someone the ability to purchase the product is because you don’t understanding why they should NOT buy it."