Author: Ali

Quick answer: BYOD (bring your own device) lets staff use personal devices for work, CYOD (choose your own device) lets them pick a company-owned device from an approved list, and COPE (corporate-owned, personally enabled) gives them a company device they may also use personally. COPE and CYOD give the organization the most security control; BYOD is cheapest but hardest to secure. Three device ownership modelsThree device ownership modelsBYODBring your own device: employee-owned, least controlCYODChoose your own device: company-owned from an approved listCOPECorporate-owned, personally enabled: most controlcybersnowden.com Phones and laptops hold email, files and access to business apps, so the device…

Quick answer: Over the Easter weekend of 2025, Marks & Spencer was hit by a cyberattack that forced it to pause online orders for weeks, left some store shelves empty and exposed customer data. M&S expected a hit of about £300 million to operating profit. Reports linked the attack to the Scattered Spider group and said the DragonForce ransomware was used. Key facts DateApril 2025 (Easter weekend), disruption into July 2025 OrganizationMarks & Spencer (UK retailer) Type of attackRansomware with data theft AttackerReported links to Scattered Spider; DragonForce ransomware reported ImpactOnline orders paused for weeks; customer data stolen; about £300…

Quick answer: A CSIRT, or computer security incident response team, is the group responsible for handling security incidents. It prepares for incidents, confirms and analyzes them when they happen, coordinates containment and recovery, communicates with stakeholders and feeds lessons learned back into the organization’s defenses. CSIRTs can be internal teams, outsourced services or national bodies. What a CSIRT doesWhat a CSIRT doesPreparePlans, playbooks, contacts and trainingDetect and analyzeConfirm incidents and judge their scopeContain and recoverStop the spread and restore operationsLearnReview lessons and improve defensescybersnowden.com When a serious incident happens, confusion costs time. A CSIRT makes sure the right people take…

Quick answer: The CIA triad is the core model of cyber security. Confidentiality means only authorized people can access information, integrity means information stays accurate and is not altered without detection, and availability means systems and data are accessible when needed. Almost every security control protects at least one of the three. The three goals of the CIA triadThe three goals of the CIA triadConfidentialityOnly authorized people can see the dataIntegrityData is accurate and cannot be changed without detectionAvailabilitySystems and data are there when neededcybersnowden.com The triad gives security teams a common language for describing risk. A data leak is…

Quick answer: In February 2024, criminals used stolen credentials to log in to a Change Healthcare remote access portal that did not have multifactor authentication. Nine days later the ALPHV/BlackCat ransomware group deployed ransomware, disrupting claims processing and pharmacies across the United States. UnitedHealth Group, Change Healthcare’s parent company, paid a ransom, and the number of people affected was later put at about 192.7 million, the largest healthcare breach in US history. Key facts DateInitial access 12 February 2024; ransomware deployed nine days later (21 February 2024) OrganizationChange Healthcare, part of UnitedHealth Group Type of attackRansomware with data theft AttackerALPHV/BlackCat…

Quick answer: Triage in cyber security is the process of quickly reviewing security alerts or incidents to decide which are real, how serious they are and what should happen next. Analysts validate each alert, add context about the affected user and system, rate its severity and either close it, monitor it or escalate it to incident response. The alert triage processThe alert triage process1. ValidateIs the alert real or a false positive?2. EnrichAdd user, asset and threat intelligence context3. PrioritizeRate severity by impact and urgency4. RouteClose, monitor or escalate to incident responsecybersnowden.com Security teams receive far more alerts than they…

Quick answer: Layered cyber security, also called defense in depth, protects an organization with several independent layers of controls so that if one fails, others still stop or detect the attack. Common layers are people and policy, the network perimeter, the internal network, endpoints, identity, applications, data, and monitoring with incident response. The layers of defense in depthThe layers of defense in depthPeople and policyTraining, policies and clear responsibilitiesPerimeter and networkFirewalls, segmentation and secure accessEndpoint and identityEDR, patching, MFA and least privilegeApplication and dataSecure code, encryption and backupsMonitoring and responseSIEM, alerting and an incident plancybersnowden.com No single control is perfect.…

Quick answer: In August 2026, a cyberattack cut off Boston Scientific’s global network, causing what the company described as a global disruption. Manufacturing and order processing on its systems were disrupted, shipping and new orders were halted, and immediate recovery took about two weeks, with work continuing into September. Key facts DateAugust 2026, recovery into September 2026 OrganizationBoston Scientific (medical devices, United States) Type of attackCyberattack causing a global operational outage AttackerNot publicly named ImpactGlobal network cut off; shipping and new orders halted; some patients affected; about two weeks to recover ResponseIncident response supported by CrowdStrike, according to the CSIS…

Quick answer: Not always. Many cyber security roles, such as governance, risk and compliance, security awareness and some SOC analyst jobs, need little or no coding. Other roles, including penetration testing, security engineering, application security and malware analysis, rely on programming. Learning basic scripting in Python and a shell language helps in almost every security career. Coding needed by roleCoding needed by roleLowGRC analyst, security awareness, auditorModerateSOC analyst, incident responder, cloud securityHighPenetration tester, security engineer, malware analystVery highApplication security, exploit and tool developercybersnowden.com The question worries many beginners, but the answer depends on the role. This guide shows how much…

Quick answer: Most people take between 6 and 24 months to get their first cyber security job. People already working in IT support, networking or development often move across in 6 to 12 months, while complete career changers usually need 12 to 24 months of study, practice and job searching. A degree takes two to four years but is not the only route. Typical timelines by starting pointTypical timelines by starting pointAlready in ITAbout 6 to 12 months to move into securityCareer changerAbout 12 to 24 months with focused studyBootcamp routeRoughly 3 to 9 months of training, then a job…