The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
PwnEscape: When Your VM Breaks Out - What to Do Now
A critical Linux kernel vulnerability, PwnEscape, allows guest VMs to read host memory, directly challenging the isolation of your virtualized environments. This flaw demands immediate attention to prevent host compromise and data breaches.
Read Full Article
Why UK and EU Enterprises Demand ISO 27001 from Vendors
UK and EU enterprise buyers prioritize ISO 27001 certification from vendors primarily because it provides a globally recognized, auditable framework for managing information security risks. This certification demonstrates a vendor's commitment to robust security, essential for mitigating supply chain risks and ensuring compliance with stringent data protection regulations.
Beyond the Patch: Ivanti Connect Secure and Your Remote Access Security Posture
CISA's urgent Ivanti Connect Secure patch alert highlights critical lessons for remote access security. This isn't just about applying a patch; it's about re-evaluating your entire perimeter defense and incident response strategy.
GDPR Article 32 in Practice: What Auditors Actually Check for Security
GDPR Article 32 mandates robust security for personal data processing. Auditors rigorously examine your technical and organisational measures, focusing on concrete controls like encryption, resilience, and incident response readiness.
When Your Vendor Gets Breached: Protecting Your Data from Downstream Risk
A third-party security incident isn't just their problem-it's yours too. Learn how to minimize your exposure when a vendor's breach threatens your organization's data and reputation.
ISO 27001 vs SOC 2: Which Certification to Pursue First?
Deciding between ISO 27001 and SOC 2 for your SaaS company depends on your market focus and strategic goals. This guide provides a direct comparison to help you prioritize your compliance efforts.
When Your Trusted Partner Becomes the Threat: Hard Lessons from Recent Arrests
Recent arrests involving a ransomware negotiation firm highlight the critical need for extreme due diligence on third-party vendors and robust internal defenses, even against sophisticated insider threats.
What ISO 27001 Certification Actually Costs and Takes for Small Teams
A realistic breakdown of ISO 27001 implementation costs, audit fees, and timelines for SaaS and services companies with fewer than fifty employees.
When Your Ransomware Negotiator Is Just Buying Decryptors Silently
Recent indictments against ransomware recovery vendor CEOs expose a dangerous industry dark pattern: paying threat actors quietly while billing clients for proprietary decryption magic.