Under Construction
June 25, 2026
Cyber Security, Press Release, Welcome Ed Gardner 0Doing a little housecleaning, stay tuned!
Getting start with SOC 2 for Startups – Resmo Webinar
We were happy to participate in this webinar where Serhat from Resmo sat down with NESP’s Ed Gardner to talk about all things SOC 2. Our conversation ranged from what a SOC 2 is, how the process might look for a start-up when you should consider pursuing one, and many other topics. Enjoy the recording!
ChatGPT-Written Malware
I don’t know how much of a thing this will end up being, but we are seeing ChatGPT-written malware in the wild.
…within a few weeks of ChatGPT going live, participants in cybercrime forums—some with little or no coding experience—were using it to write software and emails that could be used for espionage, ransomware, malicious spam, and other malicious tasks.
“It’s still too early to decide whether or not ChatGPT capabilities will become the new favorite tool for participants in the Dark Web,” company researchers wrote. “However, the cybercriminal community has already shown significant interest and are jumping into this latest trend to generate malicious code.”…
Another breach at LastPass?
LastPass sent this note out today. As you may recall, they had a pretty significant event earlier this year with their source code and development environments, and have had some on-and-off security issues going back to at least 2015. Here’s the thing, even if these events were unrelated, once the bag guys know you have […]
ChatGPT and AI describes SOC 2 Audits
AI is all the rage, we’ve tried a couple of different platforms, but we wanted to see what it looked like when nothing but AI was used to create a video. This was scripted using ChatGPT with the question “What is a SOC 2?” and fed into Synthesia’s video generation platform. We did no additional […]
The Decoupling Principle
This is a really interesting paper that discusses what the authors call the Decoupling Principle:
The idea is simple, yet previously not clearly articulated: to ensure privacy, information should be divided architecturally and institutionally such that each entity has only the information they need to perform their relevant function. Architectural decoupling entails splitting functionality for different fundamental actions in a system, such as decoupling authentication (proving who is allowed to use the network) from connectivity (establishing session state for communicating). Institutional decoupling entails splitting what information remains between non-colluding entities, such as distinct companies or network operators, or between a user and network peers. This decoupling makes service providers individually breach-proof, as they each have little or no sensitive data that can be lost to hackers. Put simply, the Decoupling Principle suggests always separating who you are from what you do…
CryWiper Data Wiper Targeting Russian Sites
Kaspersky is reporting on a data wiper masquerading as ransomware that is targeting local Russian government networks.
The Trojan corrupts any data that’s not vital for the functioning of the operating system. It doesn’t affect files with extensions .exe, .dll, .lnk, .sys or .msi, and ignores several system folders in the C:\Windows directory. The malware focuses on databases, archives, and user documents.
So far, our experts have seen only pinpoint attacks on targets in the Russian Federation. However, as usual, no one can guarantee that the same code won’t be used against other targets…
CAPTCHA
This is an actual CAPTCHA I was shown when trying to log into PayPal.
As an actual human and not a bot, I had no idea how to answer. Is this a joke? (Seems not.) Is it a Magritte-like existential question? (It’s not a bicycle. It’s a drawing of a bicycle. Actually, it’s a photograph of a drawing of a bicycle. No, it’s really a computer image of a photograph of a drawing of a bicycle.) Am I overthinking this? (Definitely.) I stared at the screen, paralyzed, for way too long.
It’s probably the best CAPTCHA I have ever encountered; a computer would have just answered…
LastPass Security Breach
The company was hacked, and customer information accessed. No passwords were compromised.
Sirius XM Software Vulnerability
This is new:
Newly revealed research shows that a number of major car brands, including Honda, Nissan, Infiniti, and Acura, were affected by a previously undisclosed security bug that would have allowed a savvy hacker to hijack vehicles and steal user data. According to researchers, the bug was in the car’s Sirius XM telematics infrastructure and would have allowed a hacker to remotely locate a vehicle, unlock and start it, flash the lights, honk the horn, pop the trunk, and access sensitive customer info like the owner’s name, phone number, address, and vehicle details…