One story. Gone deep.

The devices are Fortinet FortiGate firewalls and the VPN gateways that go with them. The firewall is the box between your company and the internet. The VPN is how your people log in to the office from somewhere else. If you don't know whether you have one, that's already a question for your IT company.

The FBI calls it a credential-compromise campaign. It runs on passwords. Leaked ones, reused ones, and stored ones the attackers could crack in bulk.

Getting in didn't involve choosing anybody. A leaked password works on a box or it doesn't.

What happened next was a choice. The FBI says the attackers were "prioritizing high-value targets based on revenue and network structure." Once they were in, somebody looked at what they'd caught and asked what it was worth. Then they packaged the access and sold it, with working VPN settings and target lists. The FBI has seen the campaign used as "an initial entry point for ransomware affiliates."

Follow the chain. A password that got reused somewhere. A firewall that accepted it. The network behind it, sized up by revenue and layout. Access to that network, sold. Sometimes to a ransomware crew. You wouldn't have seen any of it happen.

Nobody picked you to get in. Somebody priced you after.

The advisory's title mentions lockouts. When attackers disable accounts or change passwords, the FBI says, companies may find themselves locked out of their own systems. That's the call where your IT company tells you it can't get into your own firewall. The people you pay to fix it are locked out of the thing they'd fix it with.

Then comes the line I'd underline. Getting back in, the FBI says, takes steps "beyond standard patching and password resets."

Read that again. An update closes a door. It doesn't empty the room. If someone got in before the door closed, whatever access they set up can still be there. The ticket can say fixed, and someone can still be inside. That's why the FBI's steps include ending every admin and VPN session and resetting the credentials, not just changing a password or two.

The advisory is addressed to "defensive cybersecurity analysts, vulnerability analysts, and Chief Information Security Officers." Your company probably doesn't have any of those people. It probably runs on an IT company, and maybe someone who handles the computer stuff on top of everything else. That's fine. Someone you pay should have read the warning for you. Did they?

None of this needs you to understand firewalls. It needs answers from the people who run yours.

Ask your IT company this week. Do we have a FortiGate, or any other VPN login that faces the internet? Can the firewall's admin page be reached from the internet, and if so, why? The FBI grades the answers: letting in only trusted addresses is good, a stricter rule on the firewall itself is better, and best is to "remove internet administration altogether."

Then ask whether they ended every session, reset the passwords, and put phishing-resistant sign-in on the VPN and the admin page. That's a second login step a fake login page can't steal.

If the answer is we patched it, ask what else they did.

The details are from the FBI and Secret Service joint advisory of October 6, and reporting by CyberScoop and BleepingComputer.

What else matters this week.

The FBI got breached, and its cyber chief, Brett Leatherman, said on the record what caused it. The breach happened after "a contractor failed to implement a security patch explicitly issued to secure the platform."

The platform was managed by an outside organization, the FBI said. Nextgov reports the contractor has been removed, and that the fix had been out since June. Nextgov also reports that thousands of bureau employees were affected, and that the data includes addresses, phone numbers, spouse information and some medical information.

What the FBI hasn't said, Nextgov notes, is why the patch was missed, or how the bureau was checking the contractor's work.

The FBI isn't the punchline here. It had a contractor, a contract and a fix. What it apparently didn't have was a way to see that the fix never went in. Swap the FBI for your company and the contractor for your IT company, and nothing else in the story has to change.

The patching line in your IT contract is a promise. A report is how you see whether it was kept.

Ask your IT company: "Show me last month's patch report. What got patched, what didn't, and why not?"

Ninja Forms adds contact forms to WordPress websites. It's on more than 500,000 sites. On October 5, the security firm Patchstack spotted attackers exploiting a flaw in it.

The trick is simple. An attacker sends a booby-trapped form submission. When someone with admin access opens it, a hidden script runs and quietly plants an administrator account and a secret login address. In Patchstack's words: "It is a fully privileged administrator the site owner cannot see." Patchstack says the attacks are limited so far.

There's a fixed version. BleepingComputer is blunt about what it doesn't do: "Updating the vulnerable plugin prevents further exploitation but does not clean an existing infection."

Which raises the question that comes before the update: whose job is it? Your website might be your IT company's. It might be a web agency's. It might belong to whoever built it and moved on. Or it might be in nobody's contract at all.

Ask your IT company, and whoever you pay for the website: "Who actually runs our website, and is it in anyone's contract?"

Not every signal needs action.

This past week, a piece on BleepingComputer asked whether your backups are ready for ransomware. It's laid out like the news around it. Then you read the label on the page: "Sponsored and written by Kaseya."

Credit to BleepingComputer for putting the label there. That's how it should work. The advice in the piece may be perfectly sound. It's still written by a vendor, and a vendor's article will tend to make the problem look like the one its products solve.

A byline is the first fact in any article. On this one, it's the most important. It tells you who paid for the page before you've read a word of it.

It's Cybersecurity Awareness Month, so October will bring plenty of advice. Check who wrote it before you check what it says.

Your backups do matter, though. Skip the article and ask your IT company: "When did we last restore something from our backup, and how long did it take?"

No answer. Just the question.

When your IT company tells you something's been fixed, what did "fixed" include? Is that written down anywhere, or does "done" mean whatever the person closing the ticket thinks it means?

The Echo's questions cover one box. The useful follow-ups depend on what you were told.

Hit reply with the last thing your IT company told you was fixed. I'll send back the question I'd ask next.

Prefer audio? Jane reads every Pulse edition on the Signal vs. Noise podcast. Five minutes, same signal, no scrolling. Find it wherever you listen.

Michael Faas is a fractional CTO/CISO who translates technical complexity into business decisions. echocyber.io