Why I Keep Mixing Up Due Care and Due Diligence
One of the concepts that repeatedly tripped me up while studying for the Certified Information Systems Security Professional exam was the difference between due care and due diligence.
At first, the distinction seemed simple. One term involved deciding what an organization should do, while the other involved actually doing it. Then I would read another practice question, both answers would sound reasonable, and suddenly the distinction disappeared.
It reminded me of the famous Spider-Man meme where two nearly identical characters point at each other.
Due care.
Due diligence.
Which one is which again?
The frustrating part was that I could explain both concepts in a conversation and still second-guess myself during a test. Because the terms are closely related—and are sometimes used differently outside certification materials—it is easy to understand why they become tangled together.
Ransomware: The New Reality of Cyber Threats and What Organizations Can Do
Ransomware is often described as malicious software that encrypts a victim’s files and demands payment in exchange for a decryption key. While that definition is technically accurate, it no longer captures the full scope of the threat.
Modern ransomware attacks frequently involve more than encryption. Threat actors may spend days or weeks inside an environment, steal sensitive information, disable security tools, compromise backups, and disrupt business operations before the ransom demand appears. In some cases, attackers may not encrypt anything at all. Instead, they threaten to publish or sell stolen information unless the victim pays.
This combination of system disruption, data theft, and extortion has transformed ransomware from a malware problem into a broader business-resilience crisis. CISA’s current ransomware guidance addresses both traditional ransomware and data-extortion incidents because organizations must be prepared for either—or both—to occur during the same attack.
Cybersecurity Strategies to Secure Your YouTube Channel Business
As a small YouTube channel creator, you’ve invested time, creativity, and energy into growing your channel. Unfortunately, cyber threats are a growing risk in the digital creator space, especially for channels with limited resources. You might think that only big accounts are targeted, but threat actors see smaller creators as easier targets—and the consequences of a breach can be devastating.
In this guide, we’ll explore practical cybersecurity strategies to protect your YouTube channel, focusing on low-cost solutions tailored for small creators.
AI Privacy Risk: Closing the Gap Between Policy and Practice
Artificial intelligence is changing how organizations collect, process, analyze, and act on data. It is also forcing businesses to reconsider whether their existing privacy and security controls are prepared for systems that can operate with increasing speed, scale, and independence.
The central challenge is not simply whether an organization uses AI. The greater concern is whether the organization understands what its AI systems can access, what those systems are permitted to do, and whether their actual behavior matches documented policies.
That gap between policy and operational reality may become one of the most significant risk management issues of the decade.
Organizations have spent years developing privacy notices, access-control policies, data-retention standards, and incident response procedures. However, AI systems introduce new questions that many of those policies were not originally written to address.
Bug Bounty Breakdown: If at First You Don’t Succeed
Bug bounty programs can be an important extension of an organization’s cybersecurity program. They give independent security researchers an opportunity to examine applications in ways that internal teams and automated tools may not. More importantly, they can uncover vulnerabilities before someone with malicious intent finds them.
As a cybersecurity practitioner, I find public bug bounty reports especially valuable. They provide real-world examples that can help security teams, business leaders, and clients better understand how vulnerabilities are discovered, how seemingly minor weaknesses can create meaningful risk, and what organizations can learn from the disclosure process.
This article may become the first in a series examining noteworthy bug bounty reports: what the researcher found, how the vulnerability worked, how the organization responded, and what lessons others can take from it.