The Guy You Fired Still Has The Keys
The Guy You Fired Still Has The Keys
He was not fired. He resigned on good terms, and there was a party. That is worse, because when somebody leaves happy, nobody is watching. His login stayed active, since disabling it was a five minute job on a list of four hundred things. That account still had access to the company bank account, and the password on it was sitting in a public credential dump. Nobody was hacked. Somebody just did not do the job.
Host Nick Dreyfus, VP of Business Development at i-NETT, argues that nobody attacks your best system. They attack your cheapest one. And your cheapest one got there one of two ways: a job that never got done, or a budget set by someone who was never given the full picture. Confuse those two and you make the wrong call every time.
In this episode: why your IT director spends the day resetting passwords, and what falls off the list when they do. Which layer of support is worth a senior salary and which two are not. Why the person who knows how bad it is has every reason not to tell you. The technology leader who did not know what business continuity meant, and the one to two week recovery nobody upstairs knew about. How attackers reached one of America's largest retailers through an air conditioning contractor running free consumer antivirus. What happens inside an IT company when margins get squeezed, and which tool quietly gets swapped. And a company that paid zero ransom and still lost two months, hundreds of thousands of documents, and a quarter of its revenue.
Questions answered: How do I know if my IT team is telling me everything? What should I ask before approving another technology budget? Are we running anything that stops getting security updates this year? What happens when someone leaves, and who verifies it? If we were encrypted tonight, how many days until we operate again?
Start here, and it costs nothing. Tell whoever runs your technology that nothing they report will be held against them, and mean it. Ask what happens when somebody leaves, then compare enabled accounts against headcount. Then ask your leadership which three customers would leave if you went dark for six weeks, and what those three are worth as a share of profit. That number is your real security budget.
The full list of fifteen questions, plus every source cited, is at thedigitaldilemma.riverside.com
Nick is not an attorney and this is not legal advice. Breach disclosure duties vary by state and industry. Insurance policies differ, so read yours and get your broker's answer in writing.
AI readiness: https://i-nett.ai | Managed services: https://i-nett.com | Technology Fund: https://nonprofit.i-nett.com | Book time: https://meetings-na2.hubspot.com/ndreyfus | NickD@i-nett.com | (858) 337-2866
00:00 He was not fired, and that is worse 03:45 Why the five minute job never gets done 08:00 The word that scared me 09:15 The air conditioning guy 13:30 Why the cheap thing exists 16:30 What happens when margins get thin 19:00 Two months down, zero ransom paid 24:30 The seven questions 30:30 The ones with the least 32:00 What to do Monday
Tags: cybersecurity, offboarding, business continuity, ransomware, Server 2012 end of life, cyber insurance, managed IT, MSP, CEO, CFO, small business, San Diego, The Digital Dilemma, Nick Dreyfus, i-NETT
