Network Assessments: Cybersecurity, quackery and fraud

The talk takes a skeptical look at network assessments, a term the speaker argues has become vague, and at a vendor marketing claim that managed service providers close seven in ten new deals with them. Karl Jankowski, speaking from a managed service provider's perspective, traces the history of configuration checking tools and then tests the claim by searching for images, reviewing a product's user guide and running its scanner in a lab. He describes the resulting report as alarming by design, relying on red flags and urgency to push buyers toward a fast purchase.

The middle of the talk reframes the work as cybersecurity evaluation built on a chosen framework. He covers plain-language policies, a written incident response plan, and a short list of controls such as multi-factor authentication, periodic access and software reviews, and a 3-2-1 backup rule. He suggests simple documentation, a relational database for tracking assets and vendors, and free tools such as CSET. He also notes that vulnerability scans and CVE lists only matter once the business knows what it is trying to protect.

He closes by urging small companies to decide what level of security they can sustain, break the problem into small steps, and stay curious and methodical. The practical takeaway is that a scan is useful only after the organization understands its own risks and has committed to a process.