Centrend

Menu
Facebook Twitter Instagram Linkedin

Cybersecurity

Cloudflare Outage Readiness graphic showing an engineer managing multi-CDN routing, DNS failover, and observability in a server room

Cloudflare Outage Readiness: Multi-CDN and DNS Failover Plan

Cybersecurity, IT Support, IT Tech Tips /

Cloudflare Outage Readiness moved from theory to reality on November 18, 2025, when large parts of the web blinked at once. Sites and apps from X to ChatGPT saw hours of disruption before traffic stabilized. Cloudflare later explained that a massive configuration file triggered a software failure, not an attack. The outage is over; the lesson is not. Why leaders should act now One provider can be a single point of failure for traffic, security, and DNS. A resilient runtime spreads risk across providers so a fault in one path does not stop you from serving users. Outages at core internet platforms are rare, but they move markets and momentum when they happen.  Cloudflare Outage Readiness Goal Keep pages up and transactions flowing during a provider incident using two levers: multi-CDN delivery and DNS failover with health checks. Multi-CDN in plain English Use more than one CDN so traffic can shift if one path slows or fails. A good setup steers users by health and performance and can reach five-nine availability when built well.  How to design it Config parity checklist Caching rules, compression, image transforms, TLS versions, WAF rules, bot rules, edge redirects, WebSockets, HTTP/2 or HTTP/3, and any signed URL logic. DNS failover that works Authoritative DNS decides where users go. Failover updates DNS answers when health checks see an outage. Short TTLs make changes take effect faster.  Build the layer Monitoring Run external probes from more than one network to confirm both CDNs and your origins are healthy. Keep alerts simple and fast. 30-60-90 day rollout 1.Days 1–30 2.Days 31–60 3.Days 61–90 Common pitfalls that break failover What to test before you call it done Lessons from recent incidents Cloudflare’s November 18 outage tied to a config file bug shows how a single platform issue can ripple across the web. Cloudflare has had other incidents this year and publishes technical details and fixes after they occur, which helps teams plan guardrails. The best time to build a second path is before you need it.  Quick template you can copy Traffic: DNS steering to CDN A or CDN B with health checksCDNs: same cache rules, same redirects, same TLSOrigins: two regions, read replicas where neededMonitoring: independent probes and log alertsDrill: once a quarter, record results and fixes Want help mapping this for your stack? Centrend can pair with your team to design a simple multi-CDN and DNS failover plan, test it, and hand you a runbook you can keep.

Cloudflare Outage Readiness: Multi-CDN and DNS Failover Plan Read More »

Centrend graphic titled “C3PAO Readiness Checklist: Level 2 Audit Prep” showing a team marking a checklist in a server room.

C3PAO Readiness Checklist: Level 2 Audit Prep

Cybersecurity, IT Support, Managed Services /

C3PAO Readiness Checklist, award checks are active. A posted score in SPRS helps, but certification is what carries you through evaluation and option years. This guide shows how leaders turn policies into proof that holds up with a C3PAO for CMMC Level 2.  Why This Matters Now What Assessors Look For First POA&M discipline, open items prioritized and tracked to closure within allowed windows. The C3PAO readiness checklist (run this before you book) Scope and boundaryMap CUI data flows, users, apps, devices, vendors.Produce a simple boundary diagram and asset and user inventories. Controls and proofMFA: screenshots or exports showing enforcement for all in-scope accounts.Logging: samples that show useful events retained.Access reviews: add or remove records with approvals.Backups: test logs.IR tabletop: agenda, notes, and follow-ups. DocumentsSSP that reflects the real boundary.Policies and procedures referenced by the SSP.Change control tickets with testing and approvals. SPRS touchpointsPost the self-assessment correctly.Keep the affirmation current.Ensure CMMC UIDs align to the assessed systems. Subcontractors Verify each sub’s level and SPRS status before proposal time; keep a lightweight record. A Simple 30-60-90 Plan 1. Days 0-30 2. Days 31-60 3. Days 61-90 Confirm sub flow-down status; if required, reserve your C3PAO window.  Mock-Audit Script (use in a 60-minute rehearsal) Close: Open POA&M items, owners, and due dates, then next milestones toward certification.  Common Blockers That Slow Certifications What “good” Looks Like On Evidence Where Centrend Fits Get C3PAO-ready: with a short readiness call [Download the Level 2 Evidence Checklist]

C3PAO Readiness Checklist: Level 2 Audit Prep Read More »

CMMC Level 2 Certification Guide hero with engineer on laptop, audit badge, and document in a server room, Centrend

CMMC Level 2 Certification Guide: Be Audit Ready

Cybersecurity, ERP Consulting, IT Support, IT Tech Tips /

CMMC Level 2 Certification award checks are here. The next step is Level 2 certification that holds up under review. This guide gives leaders a clear path scope, evidence, SPRS, and C3PAO readiness without busywork. Status is recorded in SPRS. Many solicitations will require a C3PAO certification as the rollout advances.  What Decision Makers Need to Know Now What Level 2 Really Means Level 2 is proof that controls are implemented and working, not just written. To be taken seriously at award and through performance, you will need: A Simple Plan Leaders Can Run First 30 daysIdentify where CUI resides. Record people, apps, devices, vendors. Baseline against NIST 800-171 and collect existing artifacts.  Days 31 to 60Post your self-assessment in SPRS. Add the required details and complete the affirmation. Prioritize fixes for access control, MFA, logging, backups, incident response.  Days 61 to 90Run a short audit rehearsal. Hold brief interviews, walk through artifacts, confirm subcontractor alignment. If required, reserve a C3PAO window.  Evidence Assessors Ask For First (These align to the families and assessment approach of NIST SP 800-171 and its companion assessment guidance.)  Pitfalls That Stall Awards Prime and Sub Alignment Level requirements flow down. Primes must verify that subs have the correct status in SPRS at the same level. Build a light check: collect each sub’s CAGE, level, score date, and affirmation.  How Centrend Helps Next step: Get CMMC Level 2 Cert Ready! Book a short CMMC Level 2 Certification readiness review. Leave with a plan your team can start this week. Meet with a Centrend readiness lead. We map your scope, set your next three steps, and outline timing and effort. [Book Your CMMC Level 2 Readiness Call]

CMMC Level 2 Certification Guide: Be Audit Ready Read More »

CMMC Enforcement Nov 10 blog hero showing a compliance checklist and DoD contract award board with approved stamp

CMMC Enforcement Nov 10: Are You Award-Ready?

Cybersecurity, ERP Consulting, IT Support, IT Tech Tips, Managed Services /

CMMC Enforcement Nov 10, the Department of Defense (DoD) can enforce CMMC at the time of award or extension. If your self-assessment is missing or your SPRS status is wrong you risk getting ruled out before you’re even considered. And the rule is final. The clock is ticking. And if you’re not tracking what’s changing, your pipeline could dry up faster than you think. Why This Matters Now Your eligibility isn’t just about pricing or past performance anymore. Contracting officers will now check your SPRS entry before award. And if you’re not showing a valid Level 1 or 2 self-assessment?You may never make it past evaluation. What’s Changing with CMMC – Final Rule Effective Nov 10– CMMC UID assigned in SPRS to each system that handles FCI or CUI– Applies to both primes and subs– COTS-only contracts are exempt Even for smaller awards or renewals, SPRS visibility matters now. The Phased Timeline (What’s Required and When) Phase 1 Starts Nov 10, 2025:Level 1 and many Level 2 self-assessments must be posted in SPRS. Some Level 2 contracts may already require C3PAO certification. Phase 2 Nov 10, 2026:Third-party Level 2 assessments show up in more solicitations. Phase 3 Nov 10, 2027:Level 2 C3PAO certification becomes the norm across most relevant awards. Level 3 begins appearing for high-priority programs. Phase 4 Nov 10, 2028:Full rollout. Every DoD award involving FCI/CUI enforces CMMC compliance. Why Waiting Is a Risk SPRS entries must be accurate now.Self-assessments take time especially for Level 2.C3PAO assessment slots are limited.Delays = missed awards. How to Get Started Now Flow compliance downstream to subs. Where Centrend Comes In We don’t just consult we help GovCons get award-ready and stay that way: Scoping & Segmentation – Clarify where FCI/CUI lives, reduce risk exposureLevel Identification – Map contract needs to the correct CMMC levelSPRS Self-Assessment Support – We guide the process and ensure accurate postingLevel 2 Readiness – Gap lists, POA&Ms, SSPs, audit rehearsalOperational Maintenance – Reviews, sub-tier checklists, patching protocols Final Takeaway This rule is already in motion and if you’re not in the SPRS system or your assessment is out of date you’re at risk of losing contracts you’re qualified to win. Let Centrend help you go from unsure to award-ready, fast. [Book Your FREE CMMC Readiness Call]

CMMC Enforcement Nov 10: Are You Award-Ready? Read More »

Illustration of a masked hacker stealing credit card data through a QR code scam, with a “Scan Me” sign and smartphone in a dark office setting

QR Code Phishing Defense: Read Before You Scan

Cybersecurity, IT Support, IT Tech Tips, Managed Services /

QR Code Phishing Defense.One sticker. One poster. One scan.That’s all it takes for a credential theft or payment fraud. QR phishing is on the rise and it’s not by accident.Attackers are shifting away from email to target your phone, where security filters fall short and domain previews are harder to verify. In 2025, we’ve seen a sharp uptick in QR-based scams like fake parking meter stickers and “track your package” codes that lead to spoofed login pages. They’re fast, convincing, and built to sidestep everything your email gateway protects. One scan is all it takes. QR Code Phishing: Build Habits, Not Just Warnings Turn everyday scans into second-nature security. What to do in the moment: Pause → PreviewBefore scanning, check if your phone can preview the destination. If the code’s already scanned, long-press the link and inspect it. Look closely at the domain: misspelled brands, extra characters, or odd endings like .co instead of .com are major red flags. Verify → Use Official Apps When it comes to payments parking, utilities, deliveries don’t trust a sticker or flyer. Use the official app or a saved bookmark instead of following an unfamiliar QR code. Report → Share FastIf it feels off, report it. Right away.Your early warning can help stop a scam before it spreads. Make it easy to say, “This looks weird” no judgment, just shared vigilance. QR Phishing Defense, What to set up this week “Scan-or-Skip?” DrillGrab three QR examples one real, two risky. Ask your team: which one would you trust? Why? Build pattern recognition through discussion, not fear. Parking & Package PSAPin a quick reminder: “Don’t scan QR codes on meters or surprise deliveries. Use the app.” Simple, visual, easy to remember. Passwordless PushWhere you can, shift critical logins to phishing-resistant authentication (FIDO/WebAuthn). That one move can blunt the impact of a bad scan. What’s Happening Out There Malicious QR Codes Are EverywhereIn Q2 2025 alone, over 635,000 unique malicious QR codes were detected and 1.7 million+ in the six months prior. Scams in the WildQR stickers placed on parking meters and signage have scammed drivers and harvested payments. Consumer alerts are ongoing. FBI Warnings ContinueLaw enforcement has flagged suspicious QR codes on unsolicited packages—designed to steal login credentials or push malware. Final Takeaway You can’t filter a scan.But you can build habits that pause, preview, verify and report. That one extra second?It could be your strongest layer of defense. Want a ready-to-use “QR Spot Check” drill for your team?Let’s connect we’ll walk you through a short rollout plan tailored to your workflows. No pressure, just prevention. [Book Your FREE QR Spot Check Drill Today]

QR Code Phishing Defense: Read Before You Scan Read More »

Spot the Fake Domain That Outsmarts Even the Trained Eye

Cybersecurity, IT Tech Tips /

Spot the Fake Domain Before it’s too late.One quick skim.One login screen.One domain that almost looked right. That’s all it takes for credentials to be handed over without anyone realizing until it’s too late. Even experienced users fall for fake domains.Why? Because they’re designed to win at speed to blend in, feel familiar, and never trigger a second glance. Cybercriminals aren’t just sending spam anymore.They’re crafting nearly flawless copies of your trusted tools, brands, and URLs. And the smartest person in the room?They’re often the first to click. Spot the Fake Domain that Tricks Smart Users These aren’t obvious scams.They’re visual replicas built to trick muscle memory, not just judgment. Here’s how they get past your filters and your instincts: No malware. No red flags. Just one wrong domain in a sea of legit ones. Spot the Fake Domain that Even Smart Users Miss It It’s not carelessness. It’s design. People are wired to move quickly especially in digital spaces they trust.And when attackers lean on that trust, they don’t need to exploit a system…They just need a moment. That’s why even trained professionals fall for lookalike domains.Because training builds knowledge.But real protection requires instinct. Spot the Fake Domain to Build URL Awareness as a Habit Spotting fake domains isn’t about memorizing a checklist.It’s about creating a culture where people slow down just enough to catch what software can’t. Here’s how to start building that awareness: 1. Run Internal “URL Spot Checks” Drop two similar links into a team chat or training slide.One legit. One fake.Ask: Which one is safe? It’s fast. It’s visual. And it builds pattern recognition without pressure. 2. Highlight Real Phishing Domain Tricks Don’t train with overly fake examples.Use real red flags from recent campaigns: Let your team see what real attackers actually do. 3. Make Reporting Safe and Simple Sometimes someone spots a sketchy link but hesitates to report it.Fix that. Make “I think this looks weird” a welcome phrase not a moment of embarrassment.A shared Slack channel. A pinned email. A visual checklist.Whatever makes reporting fast and judgement-free. Cybersecurity That Starts Before the Click The best phishing emails don’t scream “I’m a scam.”They whisper, “You’ve seen me before.” And unless your people are trained to stop and lookThe message gets through. So does the damage. But if they pause long enough to catch the subtle switch?That one second becomes your strongest defense. Final Takeaway Technology stops a lot.But fake domains are built to outsmart habits not just firewalls. If you want your team to really spot what matters,you need more than policies.You need training that teaches people to see what tools don’t. Want to help your team build that instinct?Let’s talk. We’ll walk you through simple ways to reduce risk without adding more noise.[Book a time that works for you]

Spot the Fake Domain That Outsmarts Even the Trained Eye Read More »

An office employee hesitating before interacting with a suspicious email, symbolizing how phishing exploits human behavior and the psychology behind the click.

Psychology Behind The Click: Why Smart People Fall for Phishing

Cybersecurity, IT Tech Tips /

Psychology Behind The ClickOne email.One moment of distraction.One perfectly timed message. That’s all it takes for a phishing attack to land. And often, it’s not the careless who fall for it, it’s the high performers, the fast decision makers, the trusted leaders. Phishing isn’t a technical problem alone.It’s a psychological strategy, designed to target how humans think, respond, and move through a busy day. Psychology Behind the Click Reveals Why Even Smart People Fall for It These messages aren’t obvious. They’re engineered to blend in.Attackers use social cues, visual familiarity, and emotional timing to get through even the best defenses. Here’s why they work: The issue isn’t intelligence. It’s the psychology behind the click.It’s that the brain is wired to react first, then process. Psychology Behind the Click Shows How Phishing Outsmarts Instincts You can roll out every best practice: But that one message disguised just well enough can still get through. When someone clicks, it’s not failure.It’s proof the message was designed to work. So What Does Work? To counter phishing tactics, your cybersecurity strategy must build mental habits, not just technical protocols. Here’s how to shift from reaction to resilience: 1. Teach a Habit of “Pause and Review” Encourage every employee to take a beat especially when something feels just slightly off. 2. Use Realistic Training Examples Show real screenshots, red flag patterns, and messages based on your actual internal style.Not sanitized mock-ups actual lookalikes. 3. Make Reporting Easy and Encouraged No fear. No shame.Every “this looks weird” report helps improve team awareness.Celebrate submissions even false alarms. This Is a Culture Shift Not a Checklist Cybersecurity isn’t just about firewalls and passwords.It’s about how your people think, respond, and communicate especially under pressure. The phishing landscape evolves fast.But the right habits evolve with it. Final Takeaway  Smart people don’t fall for phishing because they’re careless they fall because attackers understand psychology. The best defense? A team that doesn’t just know better, but acts on it. If you’re looking to strengthen your human firewall, let’s connect.We’re happy to walk you through practical ways to reduce everyday risk. Schedule a quick, no pressure call to get started:Book a time that works for you

Psychology Behind The Click: Why Smart People Fall for Phishing Read More »

Illustration of employees standing in front of a digital firewall, symbolizing a strong human firewall during Cybersecurity Awareness Month, with a focus on team awareness, phishing prevention, and workplace cybersecurity culture.

Cybersecurity Awareness Month Human Firewall

Cybersecurity, IT Support, IT Tech Tips /

Cybersecurity Awareness Month Human Firewall. Even the best security tools can’t stop a well-crafted phishing email if someone clicks. And that’s exactly what attackers count on human error.One typo.One fake invoice.One fast click. That’s all it takes for ransomware to spread, data to leak, or your operations to grind to a halt. Even the best security tools can’t stop a well-crafted phishing email if someone clicks. And that’s exactly what attackers count on human error. Cybersecurity Awareness Month Human Firewall: Your People Are the Front Line You’ve enforced multi-factor authentication. Your devices auto-update. The firewall is solid. But what about the human side of your defense? Cybersecurity is no longer just a tech issue it’s a people issue. Cybersecurity Awareness Month Human Firewall: Build Cyber Habits, Not Just Awareness This Cybersecurity Awareness Month, go beyond check-the-box training. Build a culture where every team member becomes a line of defense. Here’s how to reinforce your human firewall one habit at a time: 1. Teach Real-World Threat Spotting Show actual phishing emails (with red flags highlighted).Use your chat app or intranet to run “Spot the phish” challenges.Turn passive learning into active recognition. 2. Normalize “Pause and Verify” Fast clicks lead to big breaches. Slow things down.Make thoughtful, double-check behavior the team standard.Celebrate moments when people don’t click and verify first. 3. Eliminate Shame in Reporting Encourage all reports even if they turn out to be nothing.Track and share your team’s “phishing stopped” stats.Make cyber wins part of team wins not just IT’s problem. This Week’s 20-Minute Fixes You don’t need a long training module to make progress today. Start small: Cyber Starts with Culture You can’t patch people. But you can build better instincts. When your team knows how to spot a scam, report a suspicious email, and stay alert, they become your strongest defense. Because in 2025, the biggest risk isn’t outdated software it’s a distracted click. And your best cybersecurity investment? A team that knows better.You’ve got the tools now it’s time to align your team. Let’s build the culture behind your firewall.Book a Quick Call and we’ll show you how.

Cybersecurity Awareness Month Human Firewall Read More »

Digital illustration of a cybersecurity team inside a modern IT office, securing devices and data with locks and shields, promoting Cybersecurity Awareness Month: Startup Your Core 4.

Cybersecurity Awareness Month: Power Up Your Core 4

Cybersecurity, IT Tech Tips /

Cybersecurity Awareness Month is comingOne weak login can stop your day.A fast phish can drain time and trust.Power up your Core 4 today so your team keeps moving. 1) Turn on MFA where it matters most Start with email, Microsoft 365 or Google Workspace, payroll, banking, and VPN or remote access.Use an authenticator app when you can. Passkeys are even better when available.How to do it fast: open Security settings and enable two-step or MFA. Power Moves 2) Make passwords stronger and easier Use long passphrases. Make each one unique.Store them in a password manager so your team does not reuse logins.This is a Core 4 habit you can set up in minutes. Power Moves 3) Spot a phish in 60 seconds Slow down when something feels off.Check the sender. Hover links. Be careful with attachments.Report it to IT or your manager and use a known contact to verify.  Power Moves 4) Update your software Updates close known holes. Turn on automatic updates for your OS and browser.Run updates for key apps and security tools today. Power Moves Do this today in 20 minutes Why now Cybersecurity Awareness Month starts in October. It highlights these Core 4 steps for everyone, from families to small teams. Doing them early sets a strong tone for the month. Need a hand? Centrend can map your top five accounts, set MFA, clean up passwords, and share a one page phish check. đź“žBook your Cybersecurity Awareness Month Power Up. We’ll start up your Core 4! in one simple session.

Cybersecurity Awareness Month: Power Up Your Core 4 Read More »

Accounts payable clerk confirms invoice by callback to stop AI voice email scams.

AI Voice Email Scams: Verify Before You Pay

Cybersecurity /

Verify Before You Pay: Stop AI Voice and Email Scams.“It sounds like your boss.““It looks like your vendor.”“But it’s not.“ With AI, scammers can now clone voices, mimic writing styles, and craft emails that feel urgent, real, and impossible to ignore. One wrong click or a rushed “yes” can drain thousands from your account. The fix? Pause. Confirm. Then Pay. The Scam Setup: It’s More Convincing Than Ever The FTC warns: voice-cloning makes fake requests feel real.FBI reports: AI-generated voice and email scams are growing.IC3 data: Business Email Compromise (BEC) losses exceed $2.9 billion annually. The One-Page Playbook: Verify AI Voice Email Scams Use this for every invoice, every bank update, and every urgent request. ➤ First, call back using a known number Do not trust numbers in the message. Use the contact saved in your system or CRM.Even if it sounds like your CFO, confirm on their known number. ➤ Next, require two-person approval For risky payments or any banking changes, get two written approvals.Keep the record in one shared folder or an approval tool. ➤ Then, place first-time or changed accounts on a 24-hour hold If the account is new or modified, pause for one day. Use that time to verify by callback.Most scams rely on urgency, your delay blocks them. ➤ Meanwhile, use a code phrase for urgent asks Create a short, private phrase your team knows.If a caller cannot repeat it, stop. ➤ Also, log everything where all can see Use Teams Approvals in Microsoft 365 to record actions, names, and timestamps.Clear trails keep your team aligned and ready for audits. ➤ Finally, report every attempt If something felt off, document it.If money moved, call your bank at once and report at IC3.gov. Callback Script (read this word-for-word) Hi [Name], I’m calling on our known number because urgent payment requests can be faked, to avoid a costly mistake, please confirm the invoice number and amount, then the last four digits of the bank account on file, and finally who requested the change and when we’ll proceed only after this confirmation. Extra Guardrails that actually work 1) Start with stronger sign-ins.Move to phishing-resistant MFA and passkeys in Microsoft Entra ID. These methods block many login-theft tactics and cut off scams at the source. 2) Then watch for session-stealing kits.Some tools can grab cookies and bypass basic MFA. Upgrading to phishing-resistant methods and tightening endpoint controls reduces this risk. Train your team in 10 minutes First, run a quick role-play.Assign a “fake CFO” and a finance clerk who follows the callback script without bending the rules. Next, post a simple reminder.Place signs near desks and in Teams: No Callback, No Payment. Finally, repeat monthly.Short refreshers keep the habit strong. If you think you slipped Immediately call your bank to freeze or recall the transfer. Next, notify the vendor in case their account was spoofed. Then report the incident at IC3.gov and save every record for investigators. Want to Put This in Place? Centrend can help you: Secure your Defenses Now đź“žBook your AI CyberDefense Today

AI Voice Email Scams: Verify Before You Pay Read More »

Scroll to Top