After now doing (actually over) 100 cybersecurity assessments for governments, critical infrastructure, companies, and organizations of all sizes, Mr. Bigman has found some under-appreciated techniques, tricks, and configuration settings that really do work in minimizing cybersecurity risk. There are also (some surprising) things that almost all cybersecurity programs are doing that do little to stop the bad guys and absorb critical time and effort. This presentation will describe which cybersecurity activities Mr. Bigman believes you should prioritize and which ones you should deemphasize. Be prepared for some controversial ideas.