Professor Simon

Did you know that a solid incident response plan can significantly reduce downtime? Running a 90-minute tabletop exercise helps practice roles and responsibilities, ensuring faster recovery during real incidents. Prepare today to protect tomorrow. #CyberSecurity

A severity score describes a weakness in general—not the risk to your specific system. Without accurate asset context, it can’t tell what’s exposed, what matters, or what’s already protected. A useful starting point, not the final word. #Cybersecurity #RiskManagement

A shocking reminder: over 26,000 cloud servers were compromised recently. This incident underscores the need for swift isolation of affected infrastructure. Always keep offline backups and restrict cloud-management access. Is your cloud security up to par? #cybersecurity #dataprotection

Write for the person who’ll act on it, and the manager who may only read two sentences. Lead with the condition and consequence, include exact details, then follow up by asking what’s missing. #Communication #WorkplaceTips

Surprisingly, MFA isn't a silver bullet. It doesn't safeguard application credentials. Service principals and non-human identities need separate monitoring to stay secure. Thinking of all dimensions of identity is key. How's your organization managing this? #Cybersecurity #MFA

An assumption isn't a verified fact. When documenting a security finding, explain what you know, what you haven't confirmed, and what you're assuming. That makes your findings more credible and gives others a chance to clarify.

Did you know that misconfigurations are the leading cause of cloud security incidents? These vulnerabilities can be easily overlooked, making them a prime target for attackers. Regular audits and automation can help keep your cloud secure. Stay vigilant! #CloudSecurity

Account lockout helps slow password guessing. But if an attacker already has the correct password, failed-attempt lockout alone won't stop them. When writing a risk statement, explain what your security controls actually protect against. #Cybersecurity #GRC

Did you know that 35% of people don’t back up their data regularly? This puts you at risk, especially with rising phishing and AI-driven attacks. Ensure you have automated backups in place, and always keep at least one offline copy. Stay safe! #Cybersecurity

“No MFA on the VPN” is a finding. The risk is what makes people act. If the report gets an “Okay, but so what?” it may need more than a technical fact. #Cybersecurity #RiskManagement

Did you know that Sweden is restricting public access to ChatGPT for government employees? They've directed staff to a secure, reviewed AI service instead. It's a move towards better data protection and security. Organizations should consider similar strategies. #AI #Cybersecurity

Good security judgment in an ordinary workday: a minute of looking, a short question to the right person, and a note afterward. No memorized regulation, no investigating anybody, no refusing to help. #SecurityJudgment

Did you know AI is not just a tool for defenders? In Australia, officials revealed AI is accelerating cyberattacks, allowing attackers to find vulnerabilities faster and make their operations more disruptive than ever. Stay vigilant. #Cybersecurity

The person asking for the folder usually isn't the person who decides whether the data can be shared. The owner is accountable for it. For employee details, that's often HR. Asking the owner isn't passing the buck. #DataOwner

Did you know that demand for tech talent has hit a three-year high? This shift toward skills-focused hiring highlights the increasing importance of specialized capabilities in our industry. Now is the time to upskill and prepare for emerging roles in technology. #Cybersecurity #TechTalent

A ticking clock is not approval. If the data owner isn't answering and the project starts tomorrow, hold the data: set up the folder, give the right people access, and leave the spreadsheet out until someone with the authority says yes. #SensitiveData

Did you know that scammers are now exploiting QR codes to steal personal information? They replace real QR codes with fake ones, leading victims to malicious sites. Always verify QR codes before scanning! Stay vigilant and don't fall for 'quishing.' #Cybersecurity #Phishing

Flagging sensitive data does not need an alarm. Name what you saw, ask who can decide, offer a smaller option: "One spreadsheet has employee home addresses. Is HR okay with it being shared? Would names and working emails be enough?" (Made-up example.) #SensitiveData

A staggering vendor breach exposed 1.5 million anonymous reports from Crime Stoppers, highlighting the hidden risks of third-party integrations. Organizations should audit vendor controls and ensure timely incident responses to protect sensitive data. #Cybersecurity

Security interview practice: pick three scenario questions for the role you want, such as a strange sign-in or a reported email. Answer each out loud and record it. Listen for two things: did you explain why, and did you explain how you'd find out what you didn't know?