Cover of Ctrl+Alt+Protect

Ctrl+Alt+Protect

Ctrl+Alt+Protect

By: Jason Russell
Listen for free

Season's Savings | 0.99 €/month for 3 months

5.99 €/month thereafter - terms apply. Cancel monthly.
Cybersecurity and technology for small business owners, explained in plain English. No jargon, no fear, no sales pitch. Hosted by Jason Russell.© 2026 Harmony MSP, LLC Economics
Episodes
  • Episode 5: Ransomware, Explained Without the Jargon

    Episode 5: Ransomware, Explained Without the Jargon
    12 Oct 2026

    Ransomware rarely hits in one bad click. It's closer to a burglary that takes weeks, and every one of those weeks is a chance to stop it. Jason Russell follows a made-up Central Florida dental practice through a realistic attack, from one stolen password to a locked office on a Monday morning, then shows what would have changed the ending.

    Along the way: why attackers mostly log in instead of breaking in, why the ransom usually isn't the biggest bill, and what paying actually buys you.

    In this episode

    • The four stages of an attack. Get in, look around, take, lock, and why 79% of attacks in Sophos's 2026 survey started with someone's login.
    • The forgotten door. Among victims whose attack began with a stolen password, 97% had MFA turned on somewhere. Somewhere is the problem.
    • What it really costs. Median recovery cost was $375,000 before any ransom, and the average recovery took three weeks.
    • The HIPAA angle. Why HHS presumes ransomware on patient data is a reportable breach, and what that means for medical and dental practices.
    • Should you pay? Why the FBI says no, and what law enforcement found when it took down LockBit.
    • What actually stops it. MFA on every login, someone watching around the clock, backups that can't be deleted, and a plan on paper.

    Your one thing this week: list every way someone can log in to your business from the outside, and find out which ones don't have MFA.

    Chapters

    • 0:00 Intro
    • 0:10 A Monday morning at a dental practice
    • 1:06 Ransomware in plain English
    • 2:00 Too small to be a target?
    • 2:37 How an attack unfolds
    • 5:30 What it really costs
    • 7:14 Should you pay?
    • 8:12 What actually stops it
    • 11:27 The same story, done right
    • 12:18 Your one thing this week
    • 12:49 How to reach Jason

    Mentioned in this episode

    • Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
    • Episode 4: Don't Make It Easy for Them (10 Cybersecurity Moves for Small Businesses)

    Sources

    • Sophos, The State of Ransomware 2026
    • Coveware by Veeam, Q2 2026 Quarterly Report
    • Verizon, 2026 Data Breach Investigations Report
    • FBI, Ransomware
    • HHS, Fact Sheet: Ransomware and HIPAA
    • FBI Internet Crime Complaint Center (report an attack)

    Want a second set of eyes on your login list?

    Email Jason directly at jason@harmony-msp.com. Send him the list, and he'll help you find the doors you forgot about.

    Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com
    Show more Show less
    13 min
  • Episode 4: Cybersecurity Awareness Month Top 10 Countdown

    Episode 4: Cybersecurity Awareness Month Top 10 Countdown
    5 Oct 2026
    October is Cybersecurity Awareness Month, and this year's theme is Don't Make It Easy for Them. Jason Russell counts down ten moves that make a small business a harder target, from locking down your Wi-Fi to the one setting Microsoft's research found cuts the risk of account compromise by more than 99%.First, he retires a statistic you've probably seen: that 60% of small businesses close within six months of a cyberattack. Reporters found no study behind it, and the organization it's usually credited to has asked people to stop using it. What does hold up: the FBI logged more than one million internet crime complaints in 2025, with nearly $21 billion in reported losses, and Florida ranked third in the country for both.The countdown#10 Lock down your Wi-Fi and retire the old router. Why the FBI says end-of-life routers should be replaced.#9 Protect the devices themselves. Screen locks, encryption, remote wipe, and why EDR watches for what antivirus misses.#8 Give people only the access they need. Separate admin accounts, same-day offboarding, and the vendors who can still log in.#7 Use a password manager. A unique password for every account, and why to take the passkey when a site offers one.#6 Write a one-page incident plan, and print it. Who to call first, and how the FBI froze $679 million in 2025 for victims who reported fast.#5 Train your team for the scams they'll actually get. In Verizon's phishing tests, text and phone scams drew a 40% higher click rate than email.#4 Keep everything updated, and retire what can't be. Software flaws are now the top way attackers get in, plus what Microsoft's Windows 10 extension does and doesn't change.#3 Back up like you'll actually need it. Offline, immutable and tested, because a backup you've never restored from is just a hope.#2 Verify every payment change with a phone call. Business email compromise cost victims more than $3 billion in 2025, and voice cloning is now part of the playbook.#1 Turn on multi-factor authentication, starting with email. Why email comes first, which kinds of MFA are strongest, and what to cover next.Chapters0:00 Intro0:10 The 60% statistic that isn't real1:17 Don't Make It Easy for Them2:01 #10 Wi-Fi and old routers2:53 #9 Protecting the devices3:43 #8 Access and offboarding4:44 #7 Password managers and passkeys5:39 #6 The one-page incident plan6:47 #5 Training for texts and calls8:04 #4 Updates and end-of-life tech9:37 #3 Backups10:37 #2 Verifying payment changes12:08 #1 MFA, starting with email13:24 Recap and where to start14:16 How to reach JasonMentioned in this episodeEpisode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your PolicyEpisode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)Episode 3: how to find and vet a managed service providerSourcesFBI Internet Crime Complaint Center, 2025 Internet Crime ReportVerizon, 2026 Data Breach Investigations ReportVerizon, 2026 DBIR and Breach Impact Study insights for SMBsNational Cybersecurity Alliance, Cybersecurity Awareness Month 2026FBI, Operation Winter SHIELDFBI, Cyber Criminal Proxy Services Exploiting End of Life RoutersMicrosoft Research, How Effective Is Multifactor Authentication at Deterring Cyberattacks?Microsoft, Windows 10 Extended Security UpdatesTom's Hardware on the Windows 10 extensionNextgov, How a Fake Cyber Statistic Raced Through WashingtonNeed help with your list?If you couldn't check off more than a few, email Jason directly at jason@harmony-msp.com. Tell him which numbers you're stuck on, and he'll help you figure out where to start.Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com
    Show more Show less
    15 min
  • Finding The Best Managed Services Provider For Your Business

    Finding The Best Managed Services Provider For Your Business
    28 Sep 2026
    Description Search for IT companies near you and every website makes the same four promises: proactive monitoring, fast response, security built in, and local support. Those words can't tell you which managed service provider is actually good. Evidence can.Jason Russell founded Harmony MSP, the firm that sponsors this show, so he says up front that he has a stake in how you choose. Then he walks through the seven-step vetting process he'd want you to run on his own company. It starts with the one-page requirements list you write before any sales call and ends with the scorecard you use to pick a winner.Along the way:Why Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, and why that number is easy to misreadWhat federal cyber agencies told MSP customers to requireThe difference between response time and resolution timeThe contract terms that decide whether you can ever cleanly leaveFlorida listeners get three local specifics: hurricane planning, the state's 10-day breach-notice clock for IT providers, and the cybersecurity safe harbor Florida still doesn't have.In this episode 00:00 Every IT company makes the same promises 00:43 A disclosure, and a promise 02:11 Step 1: Write down what you need before you call anyone 03:41 Step 2: Build your shortlist on fit, not ad spend 05:12 Step 3: Ask for documents, not demos 08:08 Step 4: Check references like an investigator 09:16 Step 5: Treat the sales process as a preview 09:59 Step 6: Read the contract for the exit 11:30 Step 7: Score your finalists on evidence 12:25 For Florida listeners: hurricanes, breach notice, and a myth 14:41 What vetting can't tell you 15:32 The short version, and how to reach usKey takeawaysWrite a one-page requirements list before any sales call: headcount and locations, critical software, regulated data, hours, onsite needs, and last year's cyber insurance application.Ask for documents, not demos: a sample MSA and SLAa real monthly reporta written description of how they secure their own accesscertificates of insurancethe date of their last full restore testa written breach-notice commitmentResponse time means someone acknowledged your ticket. Resolution time means it's fixed. Check which one the SLA actually promises.Your domain, Microsoft 365 or Google Workspace tenant, firewall, and backups should be in your company's name, with your own people holding top-level access.Score finalists only on what they showed you, not what they told you.ResourcesFull written guide, with the weighted scorecard: https://harmony-msp.com/it-companies-in-orlando-how-to-vet-an-msp/Episode 1 companion, on cyber insurance applications: https://harmony-msp.com/how-to-answer-cyber-insurance-renewal-questions-without-voiding-your-policy/Sources referenced in this episodeVerizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/CISA, NSA, FBI, and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131aHHS Office for Civil Rights, Business Associates: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.htmlFTC Safeguards Rule, 16 CFR 314.4: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4The Florida Bar, Ethics Opinion 12-3: https://www.floridabar.org/etopinions/etopinion-12-3/Florida Information Protection Act, s. 501.171, Florida Statutes: https://www.flsenate.gov/Laws/Statutes/2025/501.171Florida CS/CS/HB 473 (2024), vetoed: https://www.flsenate.gov/Session/Bill/2024/473Florida CS/SB 692 (2026), died in committee: https://www.flsenate.gov/Session/Bill/2026/692Florida Division of Corporations (Sunbiz) business search: https://dos.fl.gov/sunbiz/search/Davis Wright Tremaine, on state cybersecurity safe harbor laws: https://www.dwt.com/blogs/privacy--security-law-blog/2023/07/iowa-cybersecurity-breaches-safe-harborWant a second set of eyes?If you have IT proposals on your desk and want someone to go through them with you, call (407) 720-6540 or email Jason directly at jason@harmony-msp.com.About the hostJason Russell is the founder and CEO of Harmony MSP, a managed IT and cybersecurity firm in Lake Mary, Florida. A former Navy cryptologic technician and NSA network security consultant, he's spent more than two decades translating security problems into decisions business owners can actually act on. He's the author of Secured: The Cybersecurity Survival Guide.SponsorCtrl+Alt+Protect is brought to you by Harmony MSP: managed IT, network security, and compliance for small businesses, law firms, medical and dental practices, and accounting firms across Central Florida. https://harmony-msp.comTags managed service provider, MSP, how to choose an IT company, how to vet an MSP, managed IT services, IT support contract, service level agreement, SLA, third-party ...
    Show more Show less
    15 min
adbl_web_anon_alc_button_suppression_t1
No reviews yet