Cyber Security Solutions

TTS Cyber takes a multi-layered approach: firewalls, endpoint detection and response, and intrusion detection systems, plus help designing and implementing security policies and procedures such as password policies, user access controls, and data encryption.

IT support keeps your systems running. Cybersecurity is the specific discipline of protecting them from unauthorized access, data theft, and attack. TTS Cyber scopes them as two separate parts of an agreement, Managed IT and Managed Security. A business can take the depth of security work it actually needs rather than a fixed bundle.

That turns on two questions. The first is whether the drive was encrypted. Ohio Revised Code 1349.19 covers an Ohio resident’s name paired with a Social Security number, a driver’s license or state ID number, or a financial account or card number with the code that unlocks it, and only where those data elements are not encrypted, redacted or otherwise altered so as to be unreadable. The second question is whether the loss causes, or is reasonably believed to cause, a material risk of identity theft or other fraud to those residents.

Where both are true, the statute requires notice in the most expedient time possible and no later than 45 days after discovery of the breach or notification of it, and above 1,000 affected Ohio residents it also requires notice to the nationwide consumer reporting agencies. The encryption status of a particular machine is a question of fact rather than an assumption. Account sign-in records age out on their own schedule.

The statute itself is ORC 1349.19, worth reading with counsel, because the 45-day clock runs from discovery rather than from the day an investigation finishes.

Not if the honest answer is ’most people.’ The load-bearing word on that form is enforced, which underwriters read as: it is technically impossible for a user to authenticate without a second factor. Available, encouraged, or enabled for most of the staff does not meet it. The gap is almost always an exception list: an executive who found it annoying, a service account nobody wanted to break, a legacy sign-in protocol left enabled temporarily. Those are exactly the accounts an attacker looks for.

Pull the actual exclusion list from your conditional access or equivalent policy rather than trusting memory, then either close it or answer honestly, because an overstated control on an application is a written representation the insurer relied on, and misstatements of that kind are a recognized reason claims get denied.

The order matters. The reason is evidentiary. Incident-response practice captures the evidence before remediation: the mailbox rules and forwarding settings exactly as found, the account’s sign-in and audit records, and the time each was collected, because those are what establish what was actually taken and most of them age out on their own schedule. Password resets and revocation of active sessions follow, from a device known to be clean, with nothing deleted and no machine wiped in the meantime.

The line between an IT incident and a reportable breach often comes down to how good the logging and documentation were before the attack. So this is the record an insurer, a client or an attorney later asks to see. Deciding the sequence in advance is what written security policies and procedures are for.

MFA worked exactly as designed. The attacker simply asked a person to complete it. A push prompt or a code is only as strong as the moment somebody decides to approve it. That is why attackers running these calls aim at help desks and front desks rather than at the software. The countermeasures are unglamorous: phishing-resistant multi-factor authentication that cannot be handed over by approving a prompt, a verification script staff follow before any password reset or new MFA enrollment, conditional access on email and on the systems that hold your data, and alerting that catches a sign-in from a place your team has never worked.

TTS Cyber covers user access controls and password policies as part of its cybersecurity work. It helps design and implement the policies and procedures behind them, including the verification steps a help desk follows before a password reset or a new enrollment.