Ctrl+Alt+Protect

Jason Russell

Cybersecurity and technology for small business owners, explained in plain English. No jargon, no fear, no sales pitch. Hosted by Jason Russell.

Episodes

  1. 3d ago

    Episode 6: Patching, The Boring Habit That Closes the Most Common Way In

    Most breaches don’t need a genius. They need a flaw that already has a fix, at a business that hasn’t installed it yet. Jason Russell follows a made-up Central Florida accounting firm whose firewall sat unpatched for two months, right up to the week before the tax deadline, then shows the boring habits that would have made the attack a non-event. Along the way: why a published fix is also a map for criminals, why small businesses fall behind, and the free government list that tells you what to patch first. In this episode The most common way in. Exploited software flaws were the top entry point in 31% of breaches in Verizon’s 2026 report and 32% of intrusions in Mandiant’s M-Trends 2026.The speed problem. Mandiant estimates attackers now exploit flaws about seven days before a fix is even released, on average.Most businesses are behind. Only 26% of actively exploited flaws were fully fixed, and the median fix took 43 days.Why patching gets skipped. Fear of breaking things, nobody owning it, forgotten devices, vendor software, and equipment that no longer gets fixes.Four habits that fix it. Know what you have, let automatic updates handle the easy stuff, put the firewall and network gear on a calendar, and patch what’s under attack first.CISA’s patch-this-first list. What the Known Exploited Vulnerabilities catalog is, how to get free alerts, and the two questions to ask your IT provider.Your one thing this week: take a picture of every box with a blinking light in your network closet, and find out when each one last got an update. Chapters 0:00 Intro0:10 Three days before the tax deadline1:06 What a patch is, and why it’s also a map2:04 Why patching matters4:12 How the firm got breached5:08 Why small businesses skip it7:06 Four habits that make it routine9:31 The patch-this-first list11:07 The same story, done right12:16 Your one thing this week12:32 How to reach JasonMentioned in this episode Episode 3: How to Vet a Managed IT ProviderEpisode 4: Don’t Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)Episode 5: Ransomware, Explained Without the JargonCISA Known Exploited Vulnerabilities CatalogSources Verizon, 2026 Data Breach Investigations ReportGoogle Cloud / Mandiant, M-Trends 2026Sophos, The State of Ransomware 2026Coveware by Veeam, Q2 2026 Quarterly ReportCISA, Known Exploited Vulnerabilities CatalogWant help building your equipment list? Email Jason directly at jason@harmony-msp.com. Send him your network closet photos, and he’ll help you figure out what’s overdue and what to fix first. Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

    Episode 6: Patching, The Boring Habit That Closes the Most Common Way In

  2. Oct 12

    Episode 5: Ransomware, Explained Without the Jargon

    Ransomware rarely hits in one bad click. It's closer to a burglary that takes weeks, and every one of those weeks is a chance to stop it. Jason Russell follows a made-up Central Florida dental practice through a realistic attack, from one stolen password to a locked office on a Monday morning, then shows what would have changed the ending. Along the way: why attackers mostly log in instead of breaking in, why the ransom usually isn't the biggest bill, and what paying actually buys you. In this episode The four stages of an attack. Get in, look around, take, lock, and why 79% of attacks in Sophos's 2026 survey started with someone's login.The forgotten door. Among victims whose attack began with a stolen password, 97% had MFA turned on somewhere. Somewhere is the problem.What it really costs. Median recovery cost was $375,000 before any ransom, and the average recovery took three weeks.The HIPAA angle. Why HHS presumes ransomware on patient data is a reportable breach, and what that means for medical and dental practices.Should you pay? Why the FBI says no, and what law enforcement found when it took down LockBit.What actually stops it. MFA on every login, someone watching around the clock, backups that can't be deleted, and a plan on paper.Your one thing this week: list every way someone can log in to your business from the outside, and find out which ones don't have MFA. Chapters 0:00 Intro0:10 A Monday morning at a dental practice1:06 Ransomware in plain English2:00 Too small to be a target?2:37 How an attack unfolds5:30 What it really costs7:14 Should you pay?8:12 What actually stops it11:27 The same story, done right12:18 Your one thing this week12:49 How to reach JasonMentioned in this episode Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your PolicyEpisode 4: Don't Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)Sources Sophos, The State of Ransomware 2026Coveware by Veeam, Q2 2026 Quarterly ReportVerizon, 2026 Data Breach Investigations ReportFBI, RansomwareHHS, Fact Sheet: Ransomware and HIPAAFBI Internet Crime Complaint Center (report an attack)Want a second set of eyes on your login list? Email Jason directly at jason@harmony-msp.com. Send him the list, and he'll help you find the doors you forgot about. Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

    Episode 5: Ransomware, Explained Without the Jargon

  3. Oct 5

    Episode 4: Cybersecurity Awareness Month Top 10 Countdown

    October is Cybersecurity Awareness Month, and this year's theme is Don't Make It Easy for Them. Jason Russell counts down ten moves that make a small business a harder target, from locking down your Wi-Fi to the one setting Microsoft's research found cuts the risk of account compromise by more than 99%. First, he retires a statistic you've probably seen: that 60% of small businesses close within six months of a cyberattack. Reporters found no study behind it, and the organization it's usually credited to has asked people to stop using it. What does hold up: the FBI logged more than one million internet crime complaints in 2025, with nearly $21 billion in reported losses, and Florida ranked third in the country for both. The countdown #10 Lock down your Wi-Fi and retire the old router. Why the FBI says end-of-life routers should be replaced.#9 Protect the devices themselves. Screen locks, encryption, remote wipe, and why EDR watches for what antivirus misses.#8 Give people only the access they need. Separate admin accounts, same-day offboarding, and the vendors who can still log in.#7 Use a password manager. A unique password for every account, and why to take the passkey when a site offers one.#6 Write a one-page incident plan, and print it. Who to call first, and how the FBI froze $679 million in 2025 for victims who reported fast.#5 Train your team for the scams they'll actually get. In Verizon's phishing tests, text and phone scams drew a 40% higher click rate than email.#4 Keep everything updated, and retire what can't be. Software flaws are now the top way attackers get in, plus what Microsoft's Windows 10 extension does and doesn't change.#3 Back up like you'll actually need it. Offline, immutable and tested, because a backup you've never restored from is just a hope.#2 Verify every payment change with a phone call. Business email compromise cost victims more than $3 billion in 2025, and voice cloning is now part of the playbook.#1 Turn on multi-factor authentication, starting with email. Why email comes first, which kinds of MFA are strongest, and what to cover next.Chapters 0:00 Intro0:10 The 60% statistic that isn't real1:17 Don't Make It Easy for Them2:01 #10 Wi-Fi and old routers2:53 #9 Protecting the devices3:43 #8 Access and offboarding4:44 #7 Password managers and passkeys5:39 #6 The one-page incident plan6:47 #5 Training for texts and calls8:04 #4 Updates and end-of-life tech9:37 #3 Backups10:37 #2 Verifying payment changes12:08 #1 MFA, starting with email13:24 Recap and where to start14:16 How to reach JasonMentioned in this episode Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your PolicyEpisode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)Episode 3: how to find and vet a managed service providerSources FBI Internet Crime Complaint Center, 2025 Internet Crime ReportVerizon, 2026 Data Breach Investigations ReportVerizon, 2026 DBIR and Breach Impact Study insights for SMBsNational Cybersecurity Alliance, Cybersecurity Awareness Month 2026FBI, Operation Winter SHIELDFBI, Cyber Criminal Proxy Services Exploiting End of Life RoutersMicrosoft Research, How Effective Is Multifactor Authentication at Deterring Cyberattacks?Microsoft, Windows 10 Extended Security UpdatesTom's Hardware on the Windows 10 extensionNextgov, How a Fake Cyber Statistic Raced Through WashingtonNeed help with your list? If you couldn't check off more than a few, email Jason directly at jason@harmony-msp.com. Tell him which numbers you're stuck on, and he'll help you figure out where to start. Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com

    Episode 4: Cybersecurity Awareness Month Top 10 Countdown

  4. Sep 28

    Episode 3: Finding The Best Managed Services Provider For Your Business

    Description  Search for IT companies near you and every website makes the same four promises: proactive monitoring, fast response, security built in, and local support. Those words can't tell you which managed service provider is actually good. Evidence can. Jason Russell founded Harmony MSP, the firm that sponsors this show, so he says up front that he has a stake in how you choose. Then he walks through the seven-step vetting process he'd want you to run on his own company. It starts with the one-page requirements list you write before any sales call and ends with the scorecard you use to pick a winner. Along the way: Why Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, and why that number is easy to misreadWhat federal cyber agencies told MSP customers to requireThe difference between response time and resolution timeThe contract terms that decide whether you can ever cleanly leaveFlorida listeners get three local specifics: hurricane planning, the state's 10-day breach-notice clock for IT providers, and the cybersecurity safe harbor Florida still doesn't have. In this episode  00:00 Every IT company makes the same promises 00:43 A disclosure, and a promise 02:11 Step 1: Write down what you need before you call anyone 03:41 Step 2: Build your shortlist on fit, not ad spend 05:12 Step 3: Ask for documents, not demos 08:08 Step 4: Check references like an investigator 09:16 Step 5: Treat the sales process as a preview 09:59 Step 6: Read the contract for the exit 11:30 Step 7: Score your finalists on evidence 12:25 For Florida listeners: hurricanes, breach notice, and a myth 14:41 What vetting can't tell you 15:32 The short version, and how to reach us Key takeaways Write a one-page requirements list before any sales call: headcount and locations, critical software, regulated data, hours, onsite needs, and last year's cyber insurance application.Ask for documents, not demos: a sample MSA and SLAa real monthly reporta written description of how they secure their own accesscertificates of insurancethe date of their last full restore testa written breach-notice commitmentResponse time means someone acknowledged your ticket. Resolution time means it's fixed. Check which one the SLA actually promises.Your domain, Microsoft 365 or Google Workspace tenant, firewall, and backups should be in your company's name, with your own people holding top-level access.Score finalists only on what they showed you, not what they told you.Resources Full written guide, with the weighted scorecard: https://harmony-msp.com/it-companies-in-orlando-how-to-vet-an-msp/Episode 1 companion, on cyber insurance applications: https://harmony-msp.com/how-to-answer-cyber-insurance-renewal-questions-without-voiding-your-policy/Sources referenced in this episode Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/CISA, NSA, FBI, and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131aHHS Office for Civil Rights, Business Associates: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.htmlFTC Safeguards Rule, 16 CFR 314.4: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4The Florida Bar, Ethics Opinion 12-3: https://www.floridabar.org/etopinions/etopinion-12-3/Florida Information Protection Act, s. 501.171, Florida Statutes: https://www.flsenate.gov/Laws/Statutes/2025/501.171Florida CS/CS/HB 473 (2024), vetoed: https://www.flsenate.gov/Session/Bill/2024/473Florida CS/SB 692 (2026), died in committee: https://www.flsenate.gov/Session/Bill/2026/692Florida Division of Corporations (Sunbiz) business search: https://dos.fl.gov/sunbiz/search/Davis Wright Tremaine, on state cybersecurity safe harbor laws: https://www.dwt.com/blogs/privacy--security-law-blog/2023/07/iowa-cybersecurity-breaches-safe-harborWant a second set of eyes? If you have IT proposals on your desk and want someone to go through them with you, call (407) 720-6540 or email Jason directly at jason@harmony-msp.com. About the host Jason Russell is the founder and CEO of Harmony MSP, a managed IT and cybersecurity firm in Lake Mary, Florida. A former Navy cryptologic technician and NSA network security consultant, he's spent more than two decades translating security problems into decisions business owners can actually act on. He's the author of Secured: The Cybersecurity Survival Guide. Sponsor Ctrl+Alt+Protect is brought to you by Harmony MSP: managed IT, network security, and compliance for small businesses, law firms, medical and dental practices, and accounting firms across Central Florida. https://harmony-msp.com Tags managed service provider, MSP, how to choose an IT company, how to vet an MSP, managed IT services, IT support contract, service level agreement, SLA, third-party risk, vendor risk, cyber insurance, HIPAA business associate agreement, FTC Safeguards Rule, Florida Information Protection Act, hurricane preparedness, small business cybersecurity, Orlando IT support, Central Florida, Ctrl+Alt+Protect

    Episode 3: Finding The Best Managed Services Provider For Your Business

  5. Sep 21

    Episode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)

    Without any special tools and without breaking into anything, a stranger can send an email that appears to come from your business. Your domain in the From line. A short, reasonable request: pay this invoice, or update the account we send payments to. Your client opens it, because why wouldn't they. In this episode, Jason Russell walks through why email was built this way, and the three DNS records that make spoofing much harder to pull off: SPF, the list of servers allowed to send for your domain; DKIM, the tamper-proof signature on every message; and DMARC, the rule that ties them together and tells receiving servers what to do when something fails. Then the part most businesses miss. DMARC has three policy settings, and the most common mistake is stopping at the first one. A domain sitting at p=none gets you reports about being spoofed — not protection from it. CISA treats that setting as a temporary step toward reject, not a finish line. The episode closes with what these records genuinely cannot stop: lookalike domains and display-name spoofing, both of which show up constantly in wire fraud aimed at law firms and title companies. Records handle the easy version of the attack. A verification habit handles the rest. You'll finish this one knowing exactly what to ask your IT provider, and how to tell whether the answer you get is a real answer. In this episode (0:00) Why someone can send mail in your name right now(1:40) The envelope analogy: why email never verified senders(3:30) SPF — the list of who's allowed to send(5:00) DKIM — the signature that proves nothing was altered(6:15) DMARC — the rule that ties it together(8:15) The p=none trap, and why it isn't protection(10:00) What these records don't stop: lookalike domains and display-name spoofing(12:00) Why this matters even if you barely send email(13:30) The three-step rollout, in order(15:00) What to do this weekKey takeaways Email doesn't verify senders on its own. Your domain is forgeable until you configure it otherwise.SPF lists authorized servers, DKIM signs messages, DMARC decides what happens on failure and reports who's using your domain.p=none is monitoring, not protection. Real protection starts at quarantine and lives at reject.Free checkers confirm records exist — not that they're configured correctly, which is where most problems hide.Neither DMARC nor anything else catches lookalike domains or display-name spoofing. Verify payment changes by phone, using a number you already have.Resources Companion article: How to Stop Someone From Sending Email in Your Company's Name — https://harmony-msp.com/how-to-stop-someone-from-sending-email-in-your-companys-name/CISA Binding Operational Directive 18-01, Enhance Email and Web Security — https://www.cisa.gov/binding-operational-directive-18-01Google Email Sender Guidelines FAQ — https://support.google.com/mail/answer/14229414Microsoft, "Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders" — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730Law firm IT and security — https://harmony-msp.com/industries-we-serve/law-firm/Medical and dental practice IT and security — https://harmony-msp.com/industries-we-serve/medical-dental-practices/

    Episode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)

  6. Sep 14

    Episode 1: How Not To Void Your Cyber Insurance Policy

    Your cyber insurance renewal questionnaire got longer this year, and it isn't because you did something wrong. It's because carriers paid out on a run of very expensive claims and started asking sharper questions. Here's what most business owners don't realize: that application is a warranty document. Every box you check is a legal promise about how your business actually operates. If a forensic investigation after a claim finds your environment didn't match what you wrote down, the carrier can rescind the policy, which means your claim is denied and prior payouts can be clawed back. Some courts have held that the carrier doesn't even have to prove the misrepresentation caused the loss. In this episode, Jason Russell walks through the three incidents that rewrote the modern cyber insurance application, what underwriters are really asking in each section, and how to answer accurately when you know you have a gap. You'll learn: Why MOVEit, Change Healthcare, and the Arup deepfake fraud are behind nearly every new question on your formWhat "immutable" and "air-gapped" actually mean, and why "we back up Microsoft 365" no longer clears the barThe five places MFA has to be turned on to pass clean, and why SMS codes are now the weak answerThe privileged access management question most owners have never seen beforeCallback verification for wire transfers, and what carriers now refuse to cover at allThe difference between EDR and MDR, and how to answer when you don't have MDR yetWhy rescission is a worse outcome than any premium increaseA 30-day pre-renewal checklist you can work through before you signThe short version: an honest application with a couple of gaps and a plan is a policy that will still be there when you need it. A perfect-looking application that doesn't match your network is an expensive piece of paper.

    Episode 1: How Not To Void Your Cyber Insurance Policy

  7. Episode 1

    Trailer

    Most small business owners didn't sign up to run security for their company. They signed up to practice dentistry, represent clients, file returns, or build something. The technology came with the job — and so did the risk. Ctrl+Alt+Protect is a show for those owners and the people who keep their offices running. Host Jason Russell spent more than eight years in the U.S. Navy as a cryptologic technician, running shipboard networks and encrypted communications during tactical operations. He went on to work at the National Security Agency as a network security consultant, then spent four years in Iraq leading the Multi-National Division–Baghdad Tactical Biometrics Cell and a team of forty field support engineers. In 2011 he brought that work home to Central Florida and founded what is now Harmony MSP, where he works with small businesses, medical and dental practices, law firms, and accounting firms. In this trailer, Jason lays out what the show covers and how: one topic per episode, explained plainly. Why the email from your bookkeeper might not be from your bookkeeper. What a cyber insurance application is actually asking you to certify. Which items on a vendor's proposal matter, and which you can pass on.

    Trailer
  • 1 Trailer
    6 Episodes

Trailer

About

Cybersecurity and technology for small business owners, explained in plain English. No jargon, no fear, no sales pitch. Hosted by Jason Russell.

Information

  • Creator
    Jason Russell
  • Years Active
    2026
  • Episodes
    7
  • Rating
    Clean
  • Copyright
    © 2026 Harmony MSP, LLC
  • Show Website
    Ctrl+Alt+Protect