Joshua Montgomery

We've seen it with startups, enterprises, and even critical infrastructure teams—compliance is met, but actual security? That's another story... Over the past year, we've helped dozens of companies hit their compliance goals. SOC 2. ISO 27001. HIPAA. You name it. Most of them came to us with the same request: "We just need to pass the audit. Can you help us get compliant?" And we did. Policies were written, monitoring was turned on, dashboards looked clean, security awareness and everything the auditors wanted to see was in place. But then comes the question no one really prepares for: Now what? Because here's the thing: compliance is a milestone—not the finish line. You can have a beautifully documented monitoring process… and still get breached. One of our clients had everything on paper: a SIEM in place, monitoring configured, and an internal SOC doing the rounds. They were proud of how audit-ready they were—and rightly so. Every box was ticked. Then, the breach happened. Attackers slipped in quietly. No alerts. No alarms. No response. Why? Because the whole setup was designed to look secure—not actually to be safe. It was built to impress auditors, not stop adversaries. That's the difference we always talk about: audit-ready vs. breach-ready. And it's not just a slogan—it's the reason real threats go unnoticed in "compliant" environments... So if you've already done the hard work—built the stack, documented the processes, checked the boxes—don't stop there. Make it real. Make it work when it matters. And if you're in that "now what?" moment—somewhere between the audit and actual security—let's talk! I'm happy to share what we've seen work (and what quietly fails) out there in the real world.

112

12 Comments

Gmail unveils end-to-end encrypted messages for business customers. Only thing is: It’s not true E2EE. Yes, encryption/decryption occurs on end-user devices, but there's a catch. When Google announced Tuesday that end-to-end encrypted messages were coming to Gmail for business users, some people balked, noting it wasn’t true E2EE as the term is known in privacy and security circles. Others wondered precisely how it works under the hood. Here’s a description of what the new service does and doesn’t do, as well as some of the basic security that underpins it. When Google uses the term E2EE in this context, it means that an email is encrypted inside Chrome, Firefox, or just about any other browser the sender chooses. As the message makes its way to its destination, it remains encrypted and can’t be decrypted until it arrives at its final destination, when it’s decrypted in the recipient's browser. Giving S/MIME the heave-ho The chief selling point of this new service is that it allows government agencies and the businesses that work with them to comply with a raft of security and privacy regulations and at the same time eliminates the massive headaches that have traditionally plagued anyone deploying such regulation-compliant email systems. Up to now, the most common means has been S/MIME, a standard so complex and painful that only the bravest and most well-resourced organizations tend to implement it. Google says that E2EE Gmail abstracts away this complexity. Instead, Bob drafts an email to Alice, clicks a button that turns on the feature, and hits send. Bob’s browser encrypts the message, and sends it to Alice. The message decrypts only after it arrives in Alice’s browser and she authenticates herself. To make this happen, Bob’s organization deploys what Google says is a lightweight key server, known as a KACL, short for a key access control list. This server, which can be hosted on premises or most cloud services, is where keys are generated and stored. When Bob sends an encrypted message, his browser connects to the key server and obtains an ephemeral symmetric encryption key. Bob’s browser encrypts the message and sends it to Alice, along with a reference key. Alice’s browser uses the reference key to download the symmetric key from the KACL and decrypts the message. The key is then deleted. #cybersecurity #business #Gmail #Google #encryption #privacy

112

42 Comments

BreachForums has been down since April 15th, and the chatter is getting intense. Lots of fake Telegram channels, domains, and platforms popping up, claiming to be the real deal. We're also seeing threat actors discuss the FBI's potential strategy of keeping the site offline to flush out the real operators amidst all this noise. Cyberint (now Check Point) is actively crawling and monitoring every new source that emerges. While many claim official status, we're verifying each one. Currently, the forum has not officially resumed activity. Here’s a summarized list of the most discussed domains: breachforums[.]st The site seems to be back online, with a PGP message claiming the forum was taken down because of a possible infiltration by law enforcement using a MyBB 0day. breachforums[.]sx Same address, different suffix. Claims to be the backup forum of the original “.st” It was launched on April 27th, but there is no mention of this domain on any official group. Site is online and looks like the original forum. breached[.]fi This site is an alleged continuation of breached forums, that went online on April 23rd, claiming to be the official forum. However, two owners were allegedly arrested, the website’s management credentials were leaked online, and the site’s infrastructure has been offered for sale. The site was crawled until went offline breached[.]ws This is a forum under construction, created by a Threat Actor called Hasan. Hasan aims to re-create the Breached forum with new features, but lacks credibility. The site is currently offline At the moment, the official site (.st) is still offline and it is yet to be determined what is real and official among the alternatives. We assess that law enforcement agencies are involved in some way, and this situation benefits them by allowing them to apprehend more activity and threat actors. Cyberint, now a Check Point Company keeps adding to crawling whatever we identify and we will continue monitoring changes and discussions of any type of source and update accordingly.

101

4 Comments

Entropy, network security and vanity metrics. Quick, between 'X3pj@0oQz' and 'correcthorsebatterystaple' , which is the more secure password? If you picked the first, read up on the concept of Entropy. The (highly simplified) explanation is, brute force attacks have lessened but still exist. They operate on guessing your password by going through a bunch of characters. For example, the first has an Entropy of 57 bits, the second is 118. The first would take around 1 day to hack. The second, 100+ years. We've trained ourselves to use passwords that are REALLY hard for us to remember, but really easy for a computer to guess. Similarly, I've seen several businesses use the most RANDOM metrics to track, thinking it's an indicator of a healthy business. From being obsessed with GMV (Gross Merchandise Value), recording GMV as Revenue, hell, I've seen businesses record 'financed' transactions as revenue! If your only value add in a transaction is financing it, it's Total Payment Volume, NOT Revenue. There are a few fundamental truths that distill what a business is doing and what defines it's success: - How do you make money? Detailed channels - How much does it cost to make the money? Fixed Expenses - How much does it cost to get the client? Variable expenses - To make another Rupee / Dollar, how do expenses rise? Is it a fixed percentage or declining? - What's the ratio between increase in Money and Expenses? How to reduce? - How long do clients keep paying? Is it increasing or decreasing? EVERY part of business, from financing costs to logistics to marketing, fits in the above 6 points. Everything else is window dressing. Identifying the most important metrics in your business that tie into these points and obsessing over them is, in my opinion, a key driver of success. Views are personal #venturecapital #startups #growth #scale #business

52

9 Comments

Twingate ships a lot 🚢🚢🚢 Excited to share that the Twingate client now supports fast switching between multiple accounts 🔥 On the surface, it might look like a small feature. In reality, it solves one of the most common patterns we’ve observed from the start: many of you need access to more than one Twingate network. The use cases are everywhere. Engineers often need to jump between staging and production. Remote workers want secure access both to their company network and to their home lab. Contractors and consultants regularly collaborate across multiple organizations and need to switch contexts without friction. Until now, that often meant awkward workarounds or logging in and out. This update makes those transitions seamless. What excites me most is what it says about how people use Twingate. It’s not confined to a single environment. It spreads. People adopt it at work, then bring it home. Or they discover it personally, then advocate for it at their company. That “network effect” (pun intended 😜) is one of the strongest signals of value. And now, with multi-account support, we’ve made that experience dramatically better. A small change in the client, but a big unlock for the way modern teams and individuals really work 😊 🙌 Lior Rozner Eran Kampf Shirley Wu Alexey Lapuka Iwan Protchenko Anton Shkurenko William Katcher Dmitry Bel Anna Liu Andrew R. Harding

57

4 Comments

Too many founders with compliance requirements still treat cybersecurity like a “big company problem.” You’ll hear things like: “We’re too small, people will understand.” “We don’t have the budget for that yet.” But if your business touches sensitive data—HIPAA, PCI, or anything else— you’re not just taking a risk. You’re violating an expectation. One that regulators, clients, and your future acquirer will not overlook. Cyber requirements aren't an IT line item. They are in fact a regulatory requirement. The cost of getting it wrong goes far beyond ransom payouts or downtime. You’re putting your team, your customers, and your valuation at risk. Boards need to push harder. Founders need to act sooner. Because if you’re waiting until something breaks— you’re not just behind. It is called willful neglect and it can result in much more than a slap on the wrist. #cybersecurity #founders #leadership #riskmanagement #compliance #startups #scaling

21

4 Comments

If you have a static IP address for your internet connection, this public service announcement is for you! The internet connection timed out repeatedly in my office Wednesday morning through Thursday. The ISP technician arrived 8:15am Thursday morning and returned 30 minutes later (and two more times, leaving at 4:45pm) because the problems persisted: · Frozen video and audio feeds for meetings in Microsoft Teams and Zoom · Dropped connections to remote desktop sessions over a VPN · Loss of dial tone for my VoIP telephone on my desk · Anything internet-related timed out every minute · Slow browser loads all day long He replaced the router, two battery backups, various ethernet cable connectors and the ethernet cable connecting the router to the magic box on the outside wall. He tried everything in his field tech tool bag. He also spent a couple hours on the phone with his support team to reconfigure the account and re-install my static IP address after replacing the router. Finally, they realized the problem had nothing to do with equipment. Another customer fat-fingered the static IP address that he configured on his computer yesterday and entered MY static IP address instead of his. Apparently, he has done this before, so they recognized his “pattern”. That other customer’s computer and mine battled for that static IP address for two days. If you experience the problems listed above, ask your ISP to search for another customer possibly poaching your unique static IP address. You might save yourself a couple days of troubleshooting, rebooting router, PC, etc. and getting to know your local ISP tech. (Shout out to Jon, by the way. Good dude!) Hope this helps!

197

44 Comments

Last week, I informed a CISO at a Fortune 500 company that their website—as is—could trigger an enforcement action from the California AG. Here’s what I found in 10 minutes: 1/ 𝗕𝗿𝗼𝗸𝗲𝗻 𝗰𝗼𝗼𝗸𝗶𝗲 𝗯𝘂𝘁𝘁𝗼𝗻𝘀 If Californians can’t manage preferences or see “Your Privacy Choices,” that’s a likely violation. 2/ 𝗢𝗽𝘁-𝗼𝘂𝘁 ≠ 𝗽𝗿𝗶𝘃𝗮𝗰𝘆 𝗽𝗼𝗹𝗶𝗰𝘆 Their “Do Not Sell” link just led to the privacy policy. Worse: the opt-out form required a customer ID. You shouldn't need to be a customer to exercise your rights. 3/ 𝗧𝘄𝗼 𝗗𝗦𝗥 𝗳𝗼𝗿𝗺𝘀, 𝗼𝗻𝗲 𝗺𝗲𝘀𝘀 One built in-house, one from the vendor. Confusing for users, risky for compliance. Users aren’t just looking at your policies, and neither is the California AG. But the good news? We’re all figuring this out together. If you’re running into similar issues, let’s connect.

52

7 Comments

I'm really proud of the work that the NetRise team did on the recent research we published related to the Pixie Dust attacks. A special shout out to Craig Heffner who led these efforts and brought these issues to light. The point that I really want to get across from this research is how common this is. I know how difficult it is for people to grapple with the fact that there are 10+ year old vulnerabilities out there that can be trivially exploited from large brand name manufacturers, but I'm sorry to tell you this is the reality. Also, this is not a router problem, or a TP-Link problem or a <fill in the blank, any compiled code> problem, this is an everything, everywhere problem. Think about every library, every dependency, every open source component that makes up all the software, firmware, containers, mobile applications running in your environment. Do you have confidence they are all up to date? No exploits available? Software producers have had a difficult time (because it is hard) knowing exactly what libraries, what dependencies, what third party software they have and where they are. When a vulnerability gets reported it is not uncommon for the software producers to not have a perfect inventory of where a given component with a given vulnerability is, so they don't get patched. This is precisely what happened here. If you are the consumer of this software, firmware, containers, mobile applications - how do you know if these issues exist in your environment? Bottom line, full stop...you DON'T. Vulnerability scanners don't pick these issues up, endpoint security solutions don't pick this up, asset inventory solutions don't pick these up. Only going down to the component level can give you the insights required to find risk in your organization you didn't even know you were accepting, but you are. Thanks to Eduard Kovacs at SecurityWeek for doing a great write up on this research. If you want to find the many needles in your haystack, reach out. More to come. https://lnkd.in/g-AnSQY8

63

1 Comment