Category: Education

Good Tools, Wrong Threats: Why Your Security Setup May Be a Step Behind.

Most small businesses run antivirus software and have a firewall in place. But there’s a good chance someone along the way let you walk away thinking those two things had you covered. And if you’ve had a nagging feeling they might have oversold it a…

Five Attack Types Hitting Small Businesses Right Now

If someone asked you right now what the most common way is that small businesses get breached, what would you say? A lot of people guess ransomware, or maybe a sophisticated hack of some kind. The answer is usually a lot more ordinary than that,…

You Moved to the Cloud. Hackers Moved with You.

In 2019, Capital One discovered that 106 million customer records had been exposed through a single misconfigured AWS firewall rule. Cloud providers like AWS and Azure are excellent at securing the infrastructure they operate. This includes the physical data centers, the hardware, and the underlying…

What Is Trafficheap.cc? The Referral Spam Hitting Google Analytics and What It Means for Your Website Security.

We recently logged in to Google Analytics and noticed something that didn’t belong. A domain we’d never heard of (trafficheap.cc) showed up in our page list like it was part of our website. As a cybersecurity company, we went on high alert immediately. Our first…

Cybersecurity Keeps Getting Pushed to Next Quarter. Here’s Why That Happens, and How to Make It Easier.

You already know cybersecurity matters. You’ve read the articles. You’ve probably had the conversation with your IT person or your insurance agent at least once. And you may have even opened a tab with some security checklist at some point, fully intending to get back…

The Password Policy Nobody Follows And What to Do Instead

There’s a good chance your organization has a password policy that looks something like this: passwords must be at least eight characters, contain uppercase and lowercase letters, a number, and a special character, and be changed every 90 days. There’s also a reasonable chance your…

Physical Security: What a Pen Tester Notices When They Walk into Your Office

Most people imagine cybersecurity threats arriving through the internet, like a phishing email, a brute-forced password, or ransomware from a malicious link. But some of the most direct paths into an organization’s systems don’t require any hacking at all. They just require walking through the…

What to Expect During Your First Penetration Test

Most organizations that reach out to MainNerve about a penetration test have been thinking about it for a while. Sometimes months. They know they need one because an insurance carrier asked for it, a client required it, or they’ve been reading about breaches in their…

What Does a Penetration Test Cost and What Are You Really Paying For?

Price is almost always the last question in a penetration testing conversation, and it’s usually the one that makes people the most uncomfortable, on both sides of the table. Clients don’t want to seem like they’re shopping on price alone. Vendors don’t always want to…

Why Your Penetration Test Severity Ratings Might Be Misleading You, and a Better Way to Think About Them

If you’ve ever received a penetration test report and felt like the severity ratings didn’t quite match your intuition about what was serious, you’re not imagining things. Severity ratings are one of the most consequential parts of any pen test report. Organizations use them to…