Tag Archive for: Security CPR

Posts

Where Have All the Google Workspace Discounts Gone?

/in ,

Where to Find Savings in Google’s New Incentive Model

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

For years, price reductions on Google Workspace subscriptions were standard practice. Organizations regularly secured price breaks by adjusting seat counts or signing multi-year agreements.

Key Takeaways

  • ✓ Routine contract renewals no longer include standard Workspace discounts
  • ✓ Savings require upgrading subscriptions or adding Gemini Business or Enterprise licenses
  • ✓ Mid-term upgrades grant incentive pricing and reset renewal timelines

Organizations regularly secured price breaks by adjusting seat counts or signing multi-year agreements.

The days of standard pricing reductions are behind us.

Google has shifted strategy, and price reductions are no longer a standard part of contract renewals.

How Did We Get Here?

Over the past five years, Google introduced several core structural adjustments to its productivity platform. The transition from G Suite to Google Workspace brought updated tier structures and monthly flexible plan surcharges. More recently, Google embedded Gemini AI directly into core subscription tiers.

These structural updates caused recurring price increases across the board. Some of our clients saw overall software fees double or triple over a short span of time.

To address pushback and retain customers, Google authorized partners to offer pricing breaks. These price adjustments depended on multi-year terms or modest license growth.

Where Are We Now?

The platform transition is complete, and Google established a clear structure for Gemini AI across Google Workspace Business and Enterprise tiers. Google’s market and pricing position no longer focuses on customer retention. Google is focused on Gemini AI adoption and deeper use of Google Workspace and Google Cloud services within organizations.

Google transitioned to an incentive model rewarding AI and utilization growth.

Current Google Workspace Incentives

Currently, you can qualify for incentive savings through specific subscription adjustments:

  • Upgrading your Google Workspace subscription to a higher Business or Enterprise edition with a commitment term of one to three years
  • Adding Gemini Business or Gemini Enterprise services for some or all of your users

If you are planning to add Gemini AI or upgrade your subscription, Google allows mid-term contract changes that give you access and reset your renewal timeline.

Next Steps

Our Cloud Advisors are available to discuss your current subscription and licensing. Assessing your Google Workspace subscription also helps ensure you aren’t paying for unused features.

We’ll help you explore eligible incentives so you can keep your cloud software costs predictable. Connect with our Cloud Advisors today to evaluate your options.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Why AI Agents Never “Go Rogue”

/in ,

The Operational Truth Behind Recent AI Headlines

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Chances are, you have seen headlines about AI tools “going rogue,” such as this recent story from the New York Times about AI software that probed government websites and attempted to access restricted files without human direction.

Although that specific attempt failed, other security incidents involved AI tools successfully accessing sensitive systems.

Media coverage portrays these events as AI taking unauthorized initiative Sensational headlines create a perception that AI agents are evolving and could become beyond our control. In reality, these mishaps don’t happen because an AI agent gained sentience or conscious awareness. While these AI agents execute actions without being prompted, the breakdown stems directly from missing boundary settings and wide system permissions.

Key Takeaways

  • ✓ AI Agents follow literal instructions without using human judgment
  • ✓ Undefined permission rules cause unexpected software behavior
  • ✓ Clear operational parameters keep automated tasks running securely

The Facts Behind the Headlines

Autonomous AI Agents Do Not Possess Intent

AI agents can’t go rogue because they don’t possess consciousness. Although models and agents detect language and behavioral patterns, AI models and agents lack human reasoning, judgement, morals, and ethics.

If an instruction leaves room for interpretation, the software will work to fulfill the instruction without regard to the morality, legality, or consequences of its actions. If you instruct an AI agent to “gather all information about a topic,” the agent lacks the judgement to know that it should not hack a secure government website in search of that information… unless you tell it so.

When an AI agent “goes rogue,” the technology is performing as configured. Damaging behaviors result from a failure to fully define the agent’s role and its limits.

A Failure to Establish Boundaries

During recent security incidents, creators neglected to provide AI agents with specific guidelines detailing which data sources and systems could be accessed. Just as importantly, they neglected to establish firm boundaries around unauthorized behaviors. For example, unwanted edits could be prevented with a clear directive specifying that the agent is not allowed to alter external websites or third-party databases.

Industry Regulation vs. Internal Responsibility

In the case reported by the New York Times, OpenAI did not detect the unauthorized activity of the AI agent, revealing a negligent lack of operational monitoring, management, and control. The AI Agent was not instructed to seek human intervention before taking potentially illegal or damaging actions. OpenAI lacked systems to monitor that AI agent’s activities and notify those responsible or halt the activities.

Government efforts to establish regulations may provide clarity, but these regulations cannot replace organizational accountability. If your team deploys autonomous AI agents without safeguards against illegal acts, harmful damage, or predictable errors, your organization assumes direct liability.

You can protect your operations by establishing administrative boundary rules:

  • Specify if your agent is allowed to use internal or external resources
  • Ensure users interacting with an AI Agents hold proper authorization and permissions
  • Establish clear conditions for if and when an AI agent can alter data
  • Require human approval before the AI agent accesses secure data or modifies any data
  • Define strict rules for AI interactions with other agents and software, categorizing actions into three levels: allowed, requiring human approval, and prohibited.

We Can Help You Set AI Guardrails

Adopting AI and automated tools should strengthen your team’s operations without introducing unmanaged risks and liabilities. Setting clear boundary rules and oversight routines ensures your technology serves your business safely.

If you want your AI services to be productive, secure, and affordable, our Cloud Advisors are here to help. You can schedule a brief intro call to discuss your goals and explore practical next steps.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

What Every SMB Needs in a Managed Cloud Partner

/in ,

Finding Cloud Support That Fits Your Business

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Moving your operations to the cloud was supposed to make things easier. You cleared out the noisy server closets and gave your team instant access to work from anywhere. Although cloud providers keep physical infrastructure running, daily cloud environments don’t manage themselves on autopilot.

Key Takeaways

  • ✓ Managing cloud systems in-house creates operational bottlenecks for growing SMBs
  • ✓ Unmonitored apps lead to license bloat, software overlap, and hidden costs
  • ✓ Flexible co-management provides expert IT support while keeping you in control
  • ✓ Right-sized cloud oversight protects your data without straining your budget

As small and midsize businesses (SMBs) grow, managing cloud systems in-house creates daily friction. Internal staff get stuck fixing minor user issues, tracking billing changes, and handling complex security settings.

Understanding your in-house IT struggles makes it easier to find a managed cloud service partner who fits your needs.

The Limits of In-House Cloud IT

Business leaders don’t set out to under-resource their technology. Cloud platforms evolve quickly, and maintaining daily settings takes more time than a small team usually has.

The Jack-of-All-Trades Trap

Most SMBs rely on a small internal team for all things technology. Balancing daily help desk tickets with cloud security and compliance gets overwhelming fast. When routine support absorbs all their time, administrative updates fall behind.

Software Overlap

Growing teams regularly adopt specialized cloud applications for different projects. Without administrative oversight, organizations end up paying for inactive user licenses, overlapping software features, and unmonitored tools. Monthly credit card statements quickly start to reflect these hidden charges.

Security as an Afterthought

Keeping cloud platforms secure requires continuous maintenance. Setting up email and file storage is only the initial step. Busy internal teams rarely have time to review external file access, adjust identity settings, or configure email threat protection before a security incident happens.

The Operational Impact of IT Overwhelm

When internal staff get stretched thin, valuable work hours disappear into troubleshooting standard technical issues. Unplanned software changes and emergency fixes make IT budgeting unpredictable.

At the same time, minor setting oversights in Google Workspace or Microsoft 365 leave data vulnerable to credential theft and phishing attacks. Right-sizing your cloud oversight lets your internal team focus on work that moves your organization forward.

What SMBs Should Look for in a Managed Cloud Services Partner

The right external partner works alongside your team to deliver security, reliability, and clear business value. When evaluating your IT support, look for these key qualities:

Flexible Co-Management

Traditional IT service providers often take an “all-or-nothing” approach. A modern partner offers flexible co-management instead. They handle complex tier-two support, administrative policies, and system updates while allowing your internal staff to maintain control of daily operations.

Cross-Platform Knowledge

Your organization relies on specific software platforms to keep daily operations moving. Whether you run Microsoft 365, Google Workspace, or a hybrid environment, your partner should understand how these systems connect and help you maximize the tools you already have before pushing new software purchases.

Layered Cloud Security

Security works best when integrated directly into daily administration. A strong partner includes practical safeguards as standard practice, including:

  • Automated cloud backup and disaster recovery for file storage and email accounts
  • Multi-Factor Authentication (MFA) policies and administrative identity safeguards
  • Active monitoring of file permissions and deliverability settings

Pragmatic Cost Alignment

Most traditional IT providers design their services for larger corporations. They often avoid SMBs or push them into costly, rigid plans. The right partner focuses on practical options built around your operational size and budget, so you get real value without extra overhead.

4 Questions to Audit Your Cloud Setup

  1. Can your team quickly recover lost Google Workspace or Microsoft 365 data if files get deleted?
  2. Do user access permissions update automatically once an employee leaves your organization?
  3. Are you regularly reviewing software statements to identify and remove unused user licenses?
  4. Do you have active monitoring in place to catch email threats and suspicious logins?

Give Your Team Room to Focus

Your cloud setup should simplify your daily operations. At Cumulus Global, we specialize in delivering productive, secure, and affordable Managed Cloud Services tailored specifically for SMBs, local governments, and K-12 schools. We co-manage your environment, keep your systems secure, and ensure your cloud solutions adapt as your needs evolve.

How We Deliver Reliable Cloud Oversight

  • Managed Cloud Service Plans: Scalable service options designed to support your team, secure your infrastructure, and respect your budget.
  • Security CPR® Framework: Layered cybersecurity policies, proactive monitoring, and data recovery built directly into your routine IT operations.

Ready to simplify your cloud service challenges and give your team reliable tech support? Schedule a chat with a Cumulus Global Cloud Advisor today to explore practical paths forward.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Cyber Attack Recovery Starts Before the Breach

/in , ,

No prevention is perfect. No protection is perfect. You are already a target for cyberattacks, and eventually, one will likely succeed. When that happens, you need to know what comes next.

Event or Incident? Know the Difference

Understanding the distinction between a cybersecurity event and an incident is critical because they carry different operational and legal implications.

A Cybersecurity Event is an observable change in the status of a network, system, application, or data. You should investigate these events to determine if they qualify as an incident. Not all events become incidents.

A Cybersecurity Incident is a confirmed event, or series of events, that jeopardizes the confidentiality, integrity, or availability of data or systems. It causes harm or disruption and requires an immediate, formal response. Incidents trigger legal, regulatory, and contractual obligations, such as reporting, that must be managed.

Connect with a Cloud AdvisorYour Next Steps

With this distinction in mind, follow these steps to manage the situation effectively.

1 Do NOT Panic

Stay calm.

Quick, smart action serves you better than panic.

2 Disconnect and Isolate

Notify your IT team and service providers immediately.

Enlist their assistance to secure every impacted or potentially impacted system:

  • Log out users on all devices.
  • Change passwords or disable accounts.
  • Disconnect systems from your network and the internet.
  • Document all actions and changes with a timestamp.

3 Document the Event

Take a few moments to document everything you know.

Create a clear timeline of the situation:

  • What did you notice and when?
  • What happened and when?
  • What actions did you take (e.g., links clicked, reports made to IT)?

4 Do NOT Start Fixing Things

Your cyber insurance carrier, legal counsel, or law enforcement may need to preserve your systems for forensics.

Restoring systems or recovering data prematurely could destroy evidence and impede criminal investigations. Furthermore, altering systems might provide a reason for your insurance carrier to deny or limit your claim.

5 Make These Calls

Connect with resources that can help you navigate your next steps.

Your Cyber Insurance Agent and/or Carrier

Advise your insurer that you are responding to a cybersecurity event that may be an incident. They will want to know the nature of the event and any actions you have taken. If they determine the event is an incident, they will initiate a response.

Your insurer may: (1) Require you to report the event to law enforcement (FBI or CISA.GOV); (2) Require you to hold systems for forensic analysis; (3) Hire a specialized firm to manage recovery efforts; and/or (4) Direct you to complete other specific actions.

Your insurer may also ask for validation that you follow your security policies and procedures. Depending on your coverage, they may also provide assistance with: (1) Required legal and/or regulatory reporting; (2) Client communications; (3) Client response services (e.g., credit monitoring); and (4) Other response-related services.

Your Legal Counsel

Work with counsel knowledgeable in cybersecurity response.

They will help you with: (1) Compliance with state and federal laws and industry regulations; (2) Stakeholder and customer notifications; (3) Contractual obligations; and (4) Interactions with law enforcement.

Law Enforcement

We recommend opening a report with law enforcement in coordination with your cyber insurance carrier and legal counsel.

  • If your local law enforcement agency lacks a dedicated cybercrime unit, they can still open a report and refer you to the cybercrime unit of your local FBI field office. You can also report directly to the FBI or CISA.GOV.
  • Please be aware that law enforcement may collect computers or other devices as evidence. While this can be disruptive to daily operations, the long-term benefits far outweigh the temporary inconvenience.
  • Reporting the crime provides you with an official record that often assists insurance claims, and law enforcement may also be able to assist with recovery. For example, federal agencies maintain a database of decryption keys for ransomware attacks which could help you recover data without paying a ransom.

The Event

Human action triggered all three of these recent events. While it is easy to claim that the individuals involved should have known better, the reality is that even knowledgeable people succumb to these tricks when they are tired or distracted.

How many times have you replied to or acted on an email that you skimmed or quickly read without focusing on the content? We are all busy, and an email often feels like just another task to check off.

When you combine a false sense of security with a momentary lack of attention, it is very easy to click the wrong link, enter credentials into a fake site, or share private information.

Technology is vital for protection, but your people must also understand the risks. They should be able to identify suspect interactions and know exactly what to do when faced with a suspicious email, text, call, or web page.

After The Event

In every recent event we have handled, the business and IT leaders were unsure how to proceed. Given the urgency and stress of the moment, none of them referred to an existing Information Security Plan because they did not have an incident response checklist or strategy in place.

We tend to focus on recovery, such as getting systems back online and restoring data. While this is an urgent and tangible response, it is only one part of the equation.

Your cyber insurance carrier may need to verify your security measures, conduct a forensics analysis, or direct your recovery efforts. You likely have legal, industry, or contractual reporting requirements, and you may even need law enforcement to investigate.

Response and recovery from a cyberattack requires having the technology in place to get your systems, apps, and data back in operation as well as having resources in place to get you through the legal, regulatory, contractual, marketing, and customer relationship challenges you will face.

Help is Here

Responding to an attack requires a plan before the attack occurs. Our Security CPR® model provides the framework your business needs:

  • Communicate and Educate: Ensuring your team stays knowledgeable, aware, and prepared through appropriate policies and procedures.
  • Prevent and Protect: The right mix of security solutions to prevent cyberattacks and protect against active and successful attacks.
  • Recover and Respond: The services needed for business continuity, resilience, and a quick return to operations, along with the resources to assist with the insurance, regulatory, legal, and communication aspects of a cyber incident response.
About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America.

Cumulus Global Recognized as a 2025 Inc. Power Partner Award Winner

/in ,

The annual list recognizes the leading B2B companies that have proven track records of supporting entrepreneurs and helping companies grow.

2025 Inc. Power PartnerWestborough, MA, November 5, 2025 – Cumulus Global proudly announces its recognition on the Inc. Power Partner Awards 2025. The prestigious list honors business-to-business (B2B) organizations that have proven track records supporting entrepreneurs and helping startups grow across a range of evaluation criteria. Inc.’s recognition of Cumulus Global spans three categories: Small & Mighty, Technology & Development, and General Excellence.

“We are incredibly proud of our team for earning national recognition for our work with small businesses,” noted Cumulus Global CEO, Allen Falcon. “As a small business ourselves, we appreciate receiving recognition for the value we bring to our small business clients and for the quality of our managed cloud services and solutions.”

Companies on the Inc. Power Partner list received top marks from clients for being instrumental in helping leadership navigate the dynamic world of startups. These B2B partners support entrepreneurs across various facets of the business, including hiring, compliance, infrastructure development, cloud migration, fundraising, and more, allowing founders to focus on their core missions. 

“The entrepreneurial journey and community are core to Inc.’s mission, and it’s a true honor to celebrate this year’s Inc. Power Partners — the companies dedicated to helping small businesses and entrepreneurs,” says Bonny Ghosh, editorial director at Inc. “Whether they’re coordinating complex marketing campaigns or reliably supporting the day-to-day infrastructure of growing companies, these honorees aren’t simply B2B providers — they are true partners in helping businesses grow and succeed.” 

 

While most IT service firms prefer to work exclusively with larger clients, Cumulus Global offers solutions and services that scale for any small or midsize business – including sole practitioners and solopreneurs. The company’s Managed Cloud Services and Security CPRⓇ managed security model and services provide secure and affordable solutions that improve productivity and empower teams to excel.

For more information or to view the complete list of honorees, visit https://www.inc.com/power-partner-awards. 

About Cumulus Global

Nationally recognized as a leader in managed cloud services and security, Cumulus Global delivers productive, secure, and affordable managed cloud services to small and midsize businesses, governments, and K-12 schools. Translating business objectives into technology needs and priorities, we design, deploy, manage, and support services that help our clients thrive and grow.

About Inc.  

Inc. is the leading media brand and playbook for the entrepreneurs and business leaders shaping our future. Through its journalism, Inc. aims to inform, educate, and elevate the profile of its community: the risk-takers, the innovators, and the ultra-driven go-getters who are creating the future of business. Inc. is published by Mansueto Ventures, along with fellow leading business publication Fast Company. For more information, visit www.inc.com. 

About Cumulus Global

Nationally recognized as a leader, Cumulus Global delivers productive, secure, and affordable managed cloud services to small and midsize businesses, governments, and K-12 schools. Translating business objectives into technology needs and priorities, we design, deploy, manage, and support services that help our clients thrive and grow.

Cumulus Global Awarded Cybersecurity Trademark: Security CPR®

/in , ,

The Security CPR® Model and Services Focus on Cybersecurity Needs of Small and Midsize Businesses

Westborough, MA, October 20, 2025 – Cumulus Global proudly shares that the our Security CPR® model and services received a Trademark (Registration Number 7,966,747) from the United States Patent and Trademark Office. The trademark recognizes our unique expertise and leadership. Security CPR® includes our cybersecurity risk management technical consulting; training and education; and services covering threat analysis, prevention and deterrence, remediation, and governance.

“We are excited and proud that our Security CPR® model and services received this recognition,” stated Cumulus Global CEO Allen Falcon. “Security CPR® defines and delivers cybersecurity solutions that small businesses can rely upon, understand, and afford.”

Most small businesses struggle to meet current cybersecurity demands. Without expertise or the resources of larger organizations, small businesses still need to follow state and federal laws, industry regulations and standards, and contractual obligations. Security CPR® encompasses three core components of an effective cybersecurity program.

  • Communication and Education
  • Prevention and Protection
  • Recovery and Response

“As a model and a set of services, Security CPR® adapts to your specific business needs,” notes Falcon. “We tune your cybersecurity services to match your requirements, risks, business operations, and budget.”

As part of our commitment to helping small businesses protect themselves from cybersecurity threats, we recently launched our Cybersecurity Landing Zone. The zone collates blog posts, web events, eBooks, and other resources to help small business owners navigate the ever-changing cybersecurity landscape.

To assess, plan, and improve your cybersecurity, book a free, no obligation meeting with one of our Cloud Advisors.

About Cumulus Global

Nationally recognized as a leader, Cumulus Global delivers productive, secure, and affordable managed cloud services to small and midsize businesses, governments, and K-12 schools. Translating business objectives into technology needs and priorities, we design, deploy, manage, and support services that help our clients thrive and grow.

Debunking Cyber Insurance Myths

/in ,

Cyber Insurance Risk Assessment

Your business faces an ever-increasing array of cyber threats. Beyond protections, cyber insurance is an essential component of a robust risk management strategy. Therefore, understanding cyber insurance realities is necessary for you to make sound security and business decisions. In this post, we focus on debunking common cyber insurance myths.

1MYTH: Cyber Insurance Policies Offer the Same Level of Protection

In reality, policies vary significantly with respect to coverages and services. Opting for bundled policies generally results in coverage gaps, as most general liability policies treat cyber coverage as an add-on.These gaps leave your businesses vulnerable to liabilities and losses.

Standalone cyber insurance policies, provided by financially strong carriers, offer comprehensive protection tailored to the specific needs of your business. They address unique risks associated with cyber threats given your industry, business size, and other risk factors. Standalone policies also often include coverage of forensics, temporary resources, and other recovery needs. Dedicated coverage helps you respond more effectively to a cyber incident.

2MYTH: Your IT Security Measures Dictate Your Premiums.

While robust security practices can positively impact premiums, broader industry trends and company-specific factors play a more significant role in determining pricing.

Industry-wide loss ratios have a substantial impact on insurance costs. Peer group averages impact premiums as well. Insurers assess the risk profile of businesses within sectors. As insurers issue more policies and analyze claims, insurers refine actuarial, incorporating additional factors and risks.

3MYTH: Cyber Insurance Policies do Not Pay Out

Many businesses hesitate to buy standalone cyber insurance policies out of fear that their policy will not pay out in the event of a claim. Reputable cyber insurers with strong financials rarely deny claims with a valid cause..

Inaccurate, or fraudulent, applications are the most frequent reasons for claim denials or reductions. 

Your application must accurately reflect your cyber insurance risk profile. The information you provide on your cyber insurance application should reflect a thorough review process. Cybersecurity tools offer verification of your security profile.

4MYTH: Cyber Insurance is All You Need

Many businesses, including yours, may need additional layers of protection for specific cyber risks. These additional coverages may not be available within a traditional cyberinsurance policy.

Cyber warranties offer additional layers of protection by covering these specific elements of cyber risk. Combining cyber warranties with cyber insurance creates a more comprehensive safety net. This approach bolsters your overall security strategy and ensures appropriate coverage.

5MYTH: Robust Cybersecurity Measures Eliminate the Need for Cyber Insurance

Investing in strong cybersecurity defenses provides crucial protection for your business. No security profile or system, however, will stop every cyber attack, data breach, or data loss incident. Cyber threats continually evolve. Even the most secure systems fall victim to sophisticated attacks.

Cyber insurance serves as your financial safety net. Beyond covering direct financial losses, better policies help you recover from incidents that slip through the cracks of your security measures. These resources include forensics, data recovery, customer relations, legal expenses, and more. Cyber insurance protects you financially if and when a cyber attack gets past your defenses.

6MYTH: Obtaining Cyber Insurance is Complicated and Time-Consuming

The thought of obtaining cyber insurance deters many businesses from seeking the coverage they need. Horror stories of complex applications, surveys, and audits create anxiety and fear of the process. 

Unfortunately, this myth can come true. Businesses that apply through general insurance agents and fail to leverage knowledgeable IT resources often run into issues during the underwriting process.

Cumulus Global partners with cyber insurance specialists that offer streamlined application processes and non-committal quotes. Our partners work with more than two dozen carriers, ensuring you have options to choose the policies that meet your business needs and budget. Non-biased policy reviews help you understand your coverages and make informed decisions.

Related Information

Cyber Security Requirements for Cyber Insurance (eBook)

5 Questions for Lower SMB Cyber Insurance Premiums (Coffee & Clouds)

Security CPR® (Cloud Burst)

Security CPR® Managed Security Services (Service Overview)

Your Next Step 

Avoid falling prey to cyber insurance myths. Contact us and let us introduce you to our cyber insurance partners.

We can provide you with a Cyber Insurance Risk Assessment and help you assess your cybersecurity profile.

About the Author

Bill Seybolt bio pictureBill is a Senior Cloud Advisor responsible for helping small and midsize organizations with cloud forward solutions that meet their business needs, priorities, and budgets. Bill works with executives, leaders, and team members to understand workflows, identify strategic goals and tactical requirements, and design solutions and implementation phases. Having helped over 200 organizations successfully adopt cloud solutions, his expertise and working style ensure a comfortable experience effective change management.

Security Best Practices to Protect Your Admin Accounts

/in ,

Data Protection & SecurityIn any client environment, it is critical for you to protect your admin account with current security best practices. Most cloud services have multiple levels of admin accounts, including a super admin with the ability to access, manage, and change every configuration and security settings.  In many cloud services, “super admin” accounts also have blanket access to your data.  In effect your super admin and admin accounts hold the keys to your kingdom.

Protecting and managing admin accounts is critical for keeping your data and your business secure.

Here are four security best practices for managing and protecting admin accounts.

1 Multi-Factor Authentification

While we recommend multi-factor authentication (‘MFA”, also known as Two Factor Authentication or Two-Step Verification) for all user accounts, the added protection of MFA is critical for super admin and admin accounts.  MFA helps to protect your admin account by preventing somebody from using stolen or compromised credentials to access your cloud services, your data, and your business.

For Super Admin accounts, consider a FIDO-compliant security key.  These keys, or fobs, are physical devices that provide a timed access code required to log in. Keys provide the most secure method for multi-factor authentication, and are our number one recommendation when it comes to security best practices for administrator accounts.

2Secondary Super Admin Access

Even a super admin account can be lost or compromised.  Should this happen, you need a way to perform critical admin tasks while you recover the super admin account.  You have a few options, as follows.

  • Create a second, dedicated, super admin account.  While this comes with a licensing cost, you are not giving additional privileges to other admins or users.
  • Assign super admin rights to an existing admin or user. You avoid any increased fees, but grant privileges which can be accidentally or intentionally misused. These privileges can include access to sensitive data, archives, and the ability to alter security settings.
  • Engage your cloud partner/reseller. If your cloud partner/reseller has the ability to recover super admin accounts and/or reset super admin passwords, make sure you have a service or support agreement in place that covers admin account password reset and account recovery.

3Force Logout Super Admins

Day to day admin services can and should be performed by Admin accounts with permissions to perform specific sets of tasks.  User your Super Admin account for specific administrative and security tasks not permissioned to other Admin accounts.

As a Super Admin: Log in. Perform the specific task. Log out.

If possible, set your system to automatically log out Super Admin accounts if idle for a short period of time.

4Privileged Access Management

Our final best practices to protect your admin account includes Privileged Access Management, or PAM, which limits access to critical security and administrative functions. Permission is granted to specific functions, upon request by another Admin or the system, for a limited amount of time. Using PAM provides additional tracking of who/when/why for critical settings and tasks.

Call To Action

Take a look at your cyber security. Complete our Rapid Security Assessment (free through June 2023) for a review of your basic security measures.

Contact us or schedule time with one of our Cloud Advisors to discuss your cyber security protections and/or your broader security needs, priorities, and solutions.

About the Author

Chris CaldwellChristopher Caldwell is the COO and a co-founder of Cumulus Global.  Chris is a successful Information Services executive with 40 years experience in information services operations, application development, management, and leadership. His expertise includes corporate information technology and service management; program and project management; strategic and project-specific business requirements analysis; system requirements analysis and specification; system, application, and database design; software engineering and development, data center management, network and systems administration, network and system security, and end-user technical support.

Cloud Computing Trends, Challenges & Provider Insights in 2023

/in ,

Cloud Computing Trends

Earlier this month, CRN published a story covering Flexera’s 2023 State of the Cloud Report.  Flexera provides software and systems to manage enterprise private and public clouds.  The report on cloud computing trends originates with an annual survey of 750 technology leaders across sectors, geographies, and size of the business.  While the report classifies small and midsize businesses as those with under 1,000 employees, we still find the results interesting and relevant.

As small businesses, our concerns are spending, security, compliance, and managing cloud services. The cloud model hits our income statements and balance sheets differently than historical IT services. The need to protect our businesses, and our customers, has never been greater. And, we find it difficult to understand if we are spending efficiently and effectively.

We take a look at the top 3 cloud challenges, discuss managing clouds, and explore cloud waste.  Understanding these issues, you will better understand how to create better cloud solutions. You will also be better able to set expectations from those providing cloud solutions and related services.

Top 3 Cloud Computing Challenges

For 2023, SMB respondents identify the top three cloud computing challenges as:

  • Managing Cloud Spend (80%),
  • Security (73%), and
  • Compliance (71%).

These concerns make sense. The spending model for managed cloud services, based on subscriptions or usage, is an operating expense.  Most smaller companies are used to making capital expenditures and paying for service contracts and managed services.  Additionally, many of the IT firms working with small businesses will replicate on-premise networks and servers in a public cloud service. They may lack the expertise and tools to actively manage costs.

Concerns about security and compliance reflect the increasing need and demands of protecting sensitive business and personal information.  We face the same increased regulations and expanding industry standards as larger enterprises. But we do not have the in-house resources or the same access to experts. We place our trust on local or regional IT service firms.

Latest Trends and Developments in Cloud Computing

Undefined Cloud Management

Following closely behind the top 3 cloud challenges, governance (67%) and subscription management (61%) indicate that small businesses are not sure how to best manage their cloud services.  As cloud infrastructure matures, the number of options expand.  To make simple decisions, such as whether to subscribe monthly or make an annual commitment at a lower per unit price, we need to understand the operating cost models.  We need standard operating procedures, such as on/off-boarding and access controls, in place.

Cloud is still new. We need our IT service firms and managed service providers to guide, if not lead, our cloud management efforts. Co-management is a viable strategy, provided it includes policies and procedures as well as products and services.

Cloud Waste

On average, the survey results show that businesses spent 18% more than budgeted on public cloud services last year.  The greatest contributor to the overspend appears to be Cloud Waste.

Cloud waste is spending on cloud services that go unutilized or are under-utilized.  Reducing cloud waste can be as simple as

  • Shutting down unused resources after hours
  • Selecting lower cost regions / data centers
  • Periodically right-sizing systems and resources

Policies that scale resources in real-time based on usage will increase efficiency, but require expertise and planning during the solution design process, monitoring, and refinement over time.

How to Pick a Cloud Computing Provider

Traditional managed service providers, or MSPs, are experts in buying, monitoring, and managing things. They focus on network components, servers, systems software, and end user devices.  To get the most value from our cloud services, we need partners that understand service and cost management.

Managed cloud service providers, or MCSPs, understand how the “as-a-Service” model is different. Security, compliance, and cost management only work when they are built into the requirements, design, and management of your cloud services.

Before picking your cloud provider, ask about their management and co-management models. Understand if they actively work to monitor and manage security, compliance, and costs. Ask them to explain how.

Call To Action

Get a copy of our recent eBook, Cloud Strategies for Small and Midsize Businesses. In this eBook, we: set the stage by looking at how small and midsize businesses acquire and use technology and IT services; explore the challenges we face moving into the cloud; and map out four strategies for enhancing your use and expansion of cloud services.

To discuss how your business can better utilize a broader range of cloud services, please contact us or schedule time with one of our Cloud Advisors at your convenience.

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

A Notable Shift in Cyber Attacks

/in ,

As we proceed into 2023, we begin receiving reports and analysis of 2022, the year that was.  Now is a time when we gather data and perspectives on the past year. This new information helps guide us to better decisions in the year ahead. With respect to Cyber Attacks, the information is definitely both positive and negative in nature.

Mixed News

As reported recently in CRN, SonicWall reports in their 2023 annual Cyber Threat Report that ransomware attack volume dropped by 21% worldwide last year. In the US, the volume dropped by 48%.  While this is good news, we see some serious caveats in the data.

  • 2021 was the worst year on record for ransomware attacks, with more than 600 million worldwide.
  • Even with the 21% drop, 2022 still had the second largest number of ransomware attacks in history.
  • Ransomware attack volume in 2022 was 50% more than in 2020, and more than 2019 and 2022 combined.
  • SonicWall also reports that the last quarter of 2022 had a spike of attacks with an increase over Q4 in 2021.

What does this mean?  Ransomware attack volumes have dropped, but they are still at historical highs.  It is too soon for us to predict a change that would alter how we protect and respond these attacks.

Shifting Landscape

Related data suggest the cyber attack landscape is shifting. This information suggests that cyber criminals are focusing on other types of attacks. In 2022,

  • Cryptojacking attacks jumped by 43%
  • IoT malware attacks increased by 87%

Similarly, CRN reported that security vendor CrowdStrike noted a 20% increase in data theft and data extortion attacks that did NOT deploy encryption. More attackers are avoiding the protections against ransomware and simply threatening to expose or release sensitive data.

What does this mean? Businesses with solid cyber security and business recovery solutions in place can avoid paying ransoms. Collecting ransoms to decrypt files has become less attractive.  By quietly identify and collecting sensitive information, cyber attackers regain the upper hand.  They can release portions of the data if the victim hesitates to pay.

The Impact on Your Business

While we may see some encouraging signs, your business remains at risk. Our Security CPR® model guides decisions on cyber security solutions. The model offers a holistic approach that begins with communication and education, ensures protection and prevention, and includes your ability to restore and recover.

To ensure your business has the resiliency it needs, focus on threats most likely to impact your business and those that will be the most damaging if successful. We have a number of blog posts, webcasts, and whitepapers in our Resource Center.

Call To Action

For a look at your cyber security, complete our Rapid Security Assessment (free through June 2023) for a review of your basic security measures.

Contact us or schedule time with one of our Cloud Advisors to discuss your cyber security protections and/or your broader security needs, priorities, and solutions.

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Webcasts

Cloud Cover: Strategies for Small Businesses

/in ,

(04/18/2023) – As small businesses, we can do more with the cloud then Microsoft 365 and Google Workspace. But if we want to take advantage of the benefits of managed cloud services, we need better cloud strategies.

Read more

Cyber Security: 3 Questions and Shared Responsibility

/in ,

(03/21/2023) – The cloud’s Shared Responsibility Model places most of the security and data protection burden on you. Our webcast explores 3 key questions and the shared responsibility model to help you plan, deploy, and manage effective, and cost-effective, security..

Read more

Hybrid IT for SMBs

/in ,

(02/21/2023) – A sound Hybrid IT strategy creates better collaboration, cost efficiencies, security, and resiliency. Review your hybrid business strategy and supporting IT services. Address your business, technology, security, and cost challenges.

Read more

Security CPR®

/in ,

(01/24/2022) – Cybersecurity requires policies, procedures, supporting technologies, and a culture of awareness. This webcast is a deep dive into our Security CPR® model for preventing and surviving cyber attacks.

Read more