Matt Nappi

CISO/AVP @ Stony Brook University. SANS Instructor (SEC566). Lawng Island, NY. Keep it real. Have fun.

[Matt Nappi @mattnappiciso]

@roham @DisneyPinnacle Mtidda

[Matt Nappi @mattnappiciso]

You don’t need to be an expert to present at the 2026 EDUCAUSE Cybersecurity and Privacy Professionals Conference. Some of the most impactful sessions come from frontline practitioners, and early-career staff. 1/12/2026 deadline!

https://t.co/TMMEYNVVtc

[Matt Nappi @mattnappiciso]

Cyber adversaries are getting bolder…

[Matt Nappi @mattnappiciso]

It’s a good thing @educause #CybersecPriv25 is wrapping up today because the content was so🔥that it was starting to boil over, just like the cobbler during snack time. 😆 Sorry for the #dadjoke. If you’re staying for RIMM, have a great time connecting with @renisac’s top-notch members. See you all next time!

[Matt Nappi @mattnappiciso]

AI web crawling bots driving up your @amazon cloud hosting costs? Consider using bot control using @awscloud CloudFront if you’re an #aws shop. #CybersecPriv25 https://t.co/zsvOjfgQKa

[Matt Nappi @mattnappiciso]

Building your #cybersecurity controls program on the @CISecurity #criticalsecuritycontrols works exceptionally well in a variety of sectors, including #highered. The #InfoSec OG @randymarchany is here at #CybersecPrivacy25 explaining how VT is getting a monumental amount of work done with very limited staff.

[Matt Nappi @mattnappiciso]

International data privacy laws are numerous and broad in scope, including regulations such as the GDPR, PIPL, LGPD, and DPDDA. In contrast, the U.S. primarily relies on sector-specific regulations like HIPAA and GLBA. However, state-level privacy laws are becoming increasingly common. Be sure to check for threshold or volume-based exceptions. #CybersecPrivacy25

[Matt Nappi @mattnappiciso]

Effective communication to the board requires taking into account the 360 degree structure of the organization, board member personalities, and their expertise. Never forget “why” we are speaking to the board and be thoughtful about how we use that time. #CybersecPrivacy25

[Matt Nappi @mattnappiciso]

Avoid burnout by identifying personal values and protecting them with mental health “firewalls.” #CybersecPrivacy25

[Matt Nappi @mattnappiciso]

@flakpaket The SOC vs NOC section is the most profound. 🤦‍♂️

[Matt Nappi @mattnappiciso]

Behind the scenes from the @SANSInstitute all virtual Cyber Security Mountain training event. I am teaching SEC566: Implementing and Auditing CIS Controls with course author @brianwifaneye this week! https://t.co/ZsAEV09Z6B

[Matt Nappi @mattnappiciso]

Mitigating controls be like…

[Matt Nappi @mattnappiciso]

Can someone tell me if this is a legitimate email? Should I open the attachment? 🤦‍♂️
At least they aren’t all using ChatGPT or Grok already…

[Matt Nappi @mattnappiciso]

Cybersecurity professionals study adversaries’ motives to prioritize efforts. We must also check our own—misalignment can tank performance or derail effectiveness.

[Matt Nappi @mattnappiciso]

@vxunderground This has seminal paper written all over it. Suggested title: “Smashing ‘add to cart’ for fun and McChickens”

[Matt Nappi @mattnappiciso]

@aboutsecurity Well said. Encouraging an “SBOM mentality” is one way to emphasize the need to employ tight control over packages and versions. If not, malicious npm packages targeted to be “integrated into developer workflows” can do some serious damage.

[Matt Nappi @mattnappiciso]

Configuration drift—systems slipping from secure baselines—is a hidden risk often overlooked. CIS CSC 7 (Continuous Vulnerability Management) and CSC 4 (Secure Configurations) are your defense. Monitor, enforce, fix fast.

[Matt Nappi @mattnappiciso]

@JackRhysider Clippy says the memory is properly installed in the slot. Should be fine…😆

[Matt Nappi @mattnappiciso]

@sans_isc It’s super interesting that the most common port was Dropbox LanSync Discovery. From Dropbox’s FAQ - “We recommend only turning on LAN sync when you need it. If you have it on all the time, it may increase congestion on your local network and cause slower internet connection.”

[Matt Nappi @mattnappiciso]

@AccidentalCISO Correct, but someone has to take our place eventually...🤫🤓😆

[Matt Nappi @mattnappiciso]

A career in cybersecurity is challenging, fun, rewarding, and meaningful, but if you’re looking to break into the field because it pays well, there are much easier ways to make money.