Services & Expertise

"The impediment to action advances action. What stands in the way becomes the way."

— Marcus Aurelius, Meditations, Book 5

Cyber Stoics is a small practice by design. What follows is who you will actually be working with, the environments we know best, the tooling we built when nothing off the shelf would do, and the full range of services we offer.

Who You'll Be Working With

Eric Smith, founder of Cyber Stoics

Eric Smith is the founder of Cyber Stoics and personally leads all engagements.

Eric's passion for technology was ignited when he received a Texas Instruments home computer from his parents for Christmas in 1985. Since then, he's never been very far from a keyboard. His professional career began in the early '90s and has progressed through several organizations and various technical and operational roles, ranging from helpdesk and user support to network engineering and information security. Throughout his 30+ years of professional experience, Eric has accumulated numerous industry certifications, including Certified Information Security Professional (CISSP), RedHat Linux Certified Engineer, Microsoft Certified System Engineer, and Salesforce Certified Developer, among others.

A Defcon black badge

Defcon Black Badge

Awarded to each winner of the annual "Hack the Hacker" contest at Defcon, the world's largest security conference. It takes its name from the all-black version of that year's conference badge, is among the most respected accomplishments in the field, and carries free admission to Defcon for life.

Outside of work, Eric enjoys spending time with his two college-age kids and his millions of honeybees. Eric is an Eastern Apicultural Society (EAS) Certified Master Beekeeper and president of the Beekeepers of the Susquehanna Valley.

Deep Roots in Higher Education

Prior to launching Cyber Stoics, Eric served as higher education's first "Shared CISO" — Chief Information Security Officer for a consortium of liberal arts colleges and universities including Bucknell University, Franklin and Marshall College, and Susquehanna University. Before that, he spent twelve years as Associate Director of Networking at Bucknell. He continues to serve on the advisory council for the Computer Networking Technology program at SUN Area Technical Institute.

Information security in the .edu space is an attractive yet complicated challenge, because a university is really a collection of other industries sharing one network and one budget:

  • A bank. Financial Aid and the Bursar's office carry very specific security requirements.
  • A hotel. On-campus housing means systems for room selection, summer camps, guests, and special events.
  • An internet service provider. Stable, secure connectivity across residential, academic, and administrative spaces.
  • A sports arena.Ticketing, physical security, spectator Wi-Fi, and wired connections for visiting media.
  • Retail and restaurants. Bookstores, dining services, and vending all need point-of-sale and card processing.
  • A police station.Public safety runs door access control, parking permits, security cameras, emergency phones, and connected patrol vehicles.
  • A corporate back office.HR, Finance, Accounting, and Payroll each bring their own compliance obligations.
  • And finally, a school.Classroom technology, accounts for students and faculty, grades, transcripts, and evaluations.

Securing all of that centrally, usually with a fraction of a commercial security budget, is a genuinely hard problem — and one we know from the inside.

Healthcare

We work with regional health systems on comprehensive reviews of all three sides of a security program — people, process, and technology. Often the organization already has a capable internal IT and security team, and what they actually need is independent external validation: a second set of eyes with no stake in the decisions that got them where they are.

The findings that matter most tend to be the quiet ones. Any organization that has run Active Directory since the late '90s is carrying two decades of legacy configuration, and those leftovers add up to privilege escalation paths that a threat actor can walk once they have any foothold at all. Surfacing those buried attack paths is consistently where we deliver the most value.

Healthcare also raises the stakes on how an assessment is conducted, not just what it finds. HIPAA-protected health, treatment, and payment data cannot leave the facility — which is the constraint that led us to build the Enclave described below.

We write our reports to be read by two audiences at once: understandable by business leaders and the board, but specific enough to be useful to the security engineers and network administrators who have to act on them. Several healthcare clients have gone on to retain us as Virtual CISO — helping stand up information security committees, navigating overlapping contractual and regulatory obligations, and filling technical skills gaps so security projects don't stall waiting on a hire.

NGOs & Nonprofits

We have worked with international humanitarian organizations supporting people living in — and seeking asylum from — active conflict zones. Organizations doing that work inherit their clients' enemies. They face well-resourced nation state actors and near-constant technical and social engineering campaigns aimed squarely at the frontline staff carrying out the mission.

That threat model changes what a good assessment looks like. We have reviewed infrastructure across multiple international office locations, because the risk in this sector is rarely evenly distributed — a well-run headquarters means very little if a field office is the soft entry point. Alongside the technical work, we examine the information security governance program itself, since recurring vulnerabilities are usually a symptom of an operational gap rather than an isolated mistake.

Budget reality matters here more than anywhere else. Every dollar spent on security is a dollar not spent on the mission, so our recommendations start from what an organization already owns. Where a client's stack is already modern, our guidance is frequently limited to configuration changes and better use of licensed capability rather than new spend.

We are also comfortable presenting directly to boards and nontechnical leadership — laying out what we found, demonstrating concretely how it could be used against the organization, and giving them a prioritized plan they can actually approve and fund.

Purpose-Built Tooling: The Cyber Stoics Enclave

The Cyber Stoics Enclave, a portable assessment device

Remote assessments have a quiet accuracy problem. Traditional VPN access introduces packet filtering, NAT, and other controls that sit between the assessor and the environment — quietly concealing the very vulnerabilities the assessment is meant to surface.

So we built our own answer. An enclave is a protected space with its own boundary, and that is exactly what this device creates. The Cyber Stoics Enclave is a portable, self-contained system that ships to the client site and gives our team the same quality of access we would have standing in the server room — without opening a path back out.

That boundary is the point. All analysis happens on the device itself, so protected health information and other regulated data never leave the client's facility. For organizations bound by HIPAA and similar obligations, this turns a difficult conversation about remote access into a straightforward one.

Each unit is fully encrypted with separate boot and data drives. At the end of an engagement we remotely wipe the data drives and issue a certificate of destruction — or hand the client the wipe procedure to run in-house when their policy requires it.

Schedule A Consultation with Eric

Our Services

  • Vulnerability Assessments

    We use the same tools, techniques, and procedures as real-world threat actors to identify vulnerabilities in your technical environment.

  • Security Architecture and Design

    The best way to build a secure system is to design it to be secure from day one. We can help you to incorporate secure design principles into any upcoming deployments.

  • Incident Response

    Does everyone know what to do in the event of a cybersecurity incident? We'll help your team design, test, and deploy a robust incident response plan.

  • Risk Management

    We apply a risk management philosophy to our work with clients. A vulnerability rating score is meaningless if not considered in your organization's unique context.

  • Virtual CISO Services

    Need a part time Chief Information Security Officer to help build, guide, or advise your security team? We can help.

  • Security Analytics and Threat Intelligence

    Want to know if the security of a product or service is up to your standards? We regularly perform independent evaluations against cloud and software providers to identify gaps between their offerings and your policy requirements.

  • Secure Cloud Computing

    Using services like Google, M365, AWS, Azure, or Salesforce? Security of your data in these platforms is still largely your responsibility. We can help.

  • Security Awareness and Training

    Do your users know what to do when they encounter a cyber security threat? Do they know how to identify one? We'll help you to build an effective training program that isn't seen as an annual chore by your staff.

  • Continuous Monitoring

    While prevention of threats is important, detection is critical. We'll help you to find a continuous monitoring solution that fits your needs. We are not a solutions reseller and will work with you to find the best product or solution for your organization.

  • Compliance and Regulatory Knowledge

    Many of our clients are inundated with questionnaires asking about their PCI, HIPAA, or SOX compliance, or are being asked detailed cybersecurity questions by auditors or insurance. We don't believe in checkbox compliance, rather we'll help you build an information security governance program that makes compliance obligations a breeze.