Frontline Consultant

Hello my name is Kevin and I am the CEO of Frontline Consultant where we offer a wide range of managed services.

[Frontline Consultant @FrontlineTalks]

Can someone send email that looks like it came from your domain? SPF and DMARC decide that, and plenty of small businesses have them half set up. Our Security Scan gives you a priority list for IT. https://t.co/xtRw5EnK90 #EmailSecurity #SmallBusiness

[Frontline Consultant @FrontlineTalks]

@iPingIT Yeah, push and SMS codes get proxied right through now. I'd start with phishing-resistant MFA like passkeys or hardware keys on the admin and finance accounts. We've been walking small teams through that at https://t.co/nBIo81OWfK. Are you seeing clients push back on the keys?

[Frontline Consultant @FrontlineTalks]

@CRN A week without your backup console is a long time if something else breaks. Good reminder to ask your MSP where the second copy lives and when they last tested a restore from it. Curious how many MSPs had a copy sitting outside ConnectWise.

[Frontline Consultant @FrontlineTalks]

@GenxBonVivant Point 4 is the one that bites people. The main site gets patched and the old staging box from 2021 is still sitting there. Fellow Army guy here, and that's a lot of what we do at https://t.co/nBIo81OWfK, finding stuff nobody remembers owning. Hearing from many owners on this?

[Frontline Consultant @FrontlineTalks]

@ClouthierBuilds The cheap hosting part is the real story. Plenty of owners don't even know who controls their PHP version because the old web guy set it up years ago. Step one is just finding out who has the keys. How many of the sites you build are still on hosts like that?

[Frontline Consultant @FrontlineTalks]

@CrashCarlito That 95% hiding their version is the part that gets me. Hiding it is good hygiene, but most of those owners probably couldn't tell you what they're running either. You planning to rescan in a week to see how many actually moved?

[Frontline Consultant @FrontlineTalks]

@reercetin That's the right instinct. "We handle updates" isn't a patch level. I'd ask them in writing for the exact PHP build and whether the fix is in it, and put a WAF in front until they answer. If they can't tell you, that kind of tells you. Thinking about moving any of the three?

[Frontline Consultant @FrontlineTalks]

@AndreasHerss @runcloud Good catch, I stand corrected on that one. If Forge is pulling builds from the ondrej PPA, you're covered. Still worth running php -v on the box and checking the build date so you know the patched package actually landed. Any plans to move off 7.4 down the road?

[Frontline Consultant @FrontlineTalks]

CMMC Phase 2 (Nov 10) is suspended.

Still required: self-assessments, SPRS scores, annual affirmations, NIST 800-171 for CUI.

Paused isn't optional. Use the time to get your docs mission-ready.

https://t.co/9WPBfv73Ey

#CMMC #GovCon

[Frontline Consultant @FrontlineTalks]

PingCAP's breach reportedly started with service-account credentials committed to code. If your team or a contractor builds anything for you, ask this week: are there passwords or API keys sitting in our code? https://t.co/nBIo81OWfK #CyberSecurity #DevSecOps

[Frontline Consultant @FrontlineTalks]

@AndreasHerss @runcloud Good push. Worth noting those 7.4/8.0/8.1 backports are source-only, so it comes down to whether RunCloud ships builds. If they don't, I'd move those apps up to 8.2.35+ and put a WAF rule in front in the meantime. Has RunCloud given any timeline yet?

[Frontline Consultant @FrontlineTalks]

@Reigen_Raju If the page is served by PHP, yes, it's in scope. Easy check: ask the host or look in the hosting panel for the PHP version. Patched is 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If it's a static page or a site builder, you're likely fine. Want a hand checking? DM us.

[Frontline Consultant @FrontlineTalks]

@getpseudoed @mkenenra @KeyserSozeBluth Not a WordPress thing, so updating WP or plugins won't fix it. It's PHP on the server, so it's on your host. Ask them which PHP version your site runs. You want 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. Most big hosts are patching now, but it's worth getting a yes in writing.

[Frontline Consultant @FrontlineTalks]

@bringonthezings @dhstatus Fair question to ask them. While you wait, check your PHP version in the panel. 8.5.12, 8.4.27, 8.3.36 or 8.2.35 means you're patched. Older and no answer yet? A WAF like Cloudflare in front buys time. Happy to help if you get stuck, just DM us.

[Frontline Consultant @FrontlineTalks]

PHP2Shell: two critical PHP flaws let attackers run code on your web server with no login. If your site runs PHP (WordPress included), patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

Not sure where to start? Frontline can help. https://t.co/nBIo81Pu5i

#PHP2Shell #CyberSecurity

[Frontline Consultant @FrontlineTalks]

ConnectWise just suspended its Cloud Backup after attackers hijacked its app identities and hit M365 tenants.

Your backup vendor is a single point of failure too.

3 copies. 2 media. 1 offline. Test the restore.

https://t.co/9WPBfv73Ey

#backup #infosec

[Frontline Consultant @FrontlineTalks]

Microsoft's October Patch Tuesday: ~1,400 fixes.

One Outlook bug (CVSS 9.8) fires from the preview pane alone.

Patch. Reboot. Log it. If it's not documented, it didn't happen.

Templates: https://t.co/9WPBfv73Ey

#PatchTuesday #infosec

[Frontline Consultant @FrontlineTalks]

Need security leadership but not a full-time hire? Part-time security or IT leadership (vCISO / vCIO) can set the strategy without the full-time salary. https://t.co/nBIo81OWfK #vCISO #CyberSecurity #SmallBusiness

[Frontline Consultant @FrontlineTalks]

15-min Friday audit:
MFA · passwords · phishing near-miss · patches · backups

Write it. Own it. Repeat.
https://t.co/9WPBfv73Ey
#cybersecurity #smallbiz