Category: Security

The holiday season brings a surge of shoppers and increased sales, making it one of the most lucrative times of the year for retailers. At the same time, this spike in activity also draws the attention of hackers looking to exploit busy stores and distracted staff. From digital heists to scams targeting both staff and customers, cyber risks surge when retailers are at their busiest and most distracted.

Here’s how store owners and retail managers can prepare for and fend off the most common holiday cyberthreats.

Preventing ransomware disruptions

Ransomware attacks can freeze a retailer’s operations in their tracks. Cybercriminals may hijack systems by encrypting essential files and then demand a ransom to unlock them. At peak transaction times, this can be devastating.

What to do:

• Keep your software updated to patch potential security gaps.
• Back up important data regularly and keep a copy disconnected from your systems so hackers can’t reach them.
• Teach employees how to recognize phishing attempts and to avoid clicking unfamiliar links or opening unexpected email attachments.

Spotting and stopping phishing attempts

Phishing is when someone pretends to represent a trusted company or individual to trick people into giving away passwords, credit card numbers, or other sensitive info. These scams commonly arrive via email or text message and can trick both customers and employees.

What to do:

• Set up spam filters to stop suspicious emails from reaching inboxes.
• Activate multifactor authentication for employee accounts to prevent access with just a stolen password.
• Show staff how to spot phishing attempts, especially those with urgent language or spelling mistakes, which are common signs of a scam.

Securing checkout systems

In physical stores, criminals may attach devices to payment terminals to steal card details. In some cases, they install hidden software through USB ports or unsecured wireless connections to intercept payment information during processing.

What to do:

• Use checkout systems with encryption to protect payment data during transfer.
• Keep payment systems up to date and apply patches as soon as the developer releases them.
• If possible, install surveillance cameras to monitor checkout areas and deter criminal activity.
• Train staff to spot signs of tampering, such as loose card readers or unfamiliar attachments on payment terminals.

Managing bots that disrupt online sales

Bots are automated programs that hackers use to flood your website, snatch products before real customers can, or slow down your site during peak hours.

What to do:

• Limit purchases of high-demand items to prevent bots from clearing out your inventory.
• Add Google reCAPTCHA to login, checkout, and account pages to block simple bots without disrupting the customer experience.
• Monitor website traffic for unusual patterns, such as repeated visits from the same IP address or rapid clicks.
• For more sophisticated bot attacks, use advanced protection tools like Cloudflare. These services analyze visitor behavior to detect and block non-human traffic that simpler defenses might miss.

Reducing risks from inside your business

Some cyberthreats come from within, whether it’s a temporary employee misusing access or someone making an honest mistake. These risks often rise during the holidays due to an increase in seasonal hires, meaning more people with access to your systems and data.

What to do:

• Conduct basic background screenings before bringing on seasonal workers.
• Restrict employee access to the specific tools and data required for their responsibilities.
• Recommend creating strong, memorable passphrases — at least 15 characters — by combining unrelated words or phrases.
• Offer essential cybersecurity training to all staff, with special attention to onboarding new and temporary team members. Remind staff to follow essential practices such as locking their devices when unattended and never sharing their passwords.

Effective cybersecurity doesn’t need to strain your budget or feel complicated. Small retailers can protect themselves, their employees, and their customers by combining smart habits, simple tools, and a little preparation.

Not sure which solution fits your business best? Contact us, and we’ll help you build a security plan that aligns with your store’s setup, budget, and seasonal demands.

The cloud should be a secure place for business data, but cloud misconfigurations and lax security practices often leave the door wide open for cybercriminals. This article explores how to close those gaps.

Why cloud security continues to fail

A recent report by the cloud security firm Tenable highlights an alarming trend: 74% of companies surveyed had storage settings configured incorrectly. In effect, these businesses accidentally left their digital doors unlocked.

While the cloud security solutions available today are more effective than ever, the teams managing the cloud infrastructure often lack the specific training to configure them correctly. As a result, businesses aren’t as secure as they think and often fail to fully maximize the cloud’s security features.

The toxic cloud triad of risk

The study points to three specific factors that, when combined, create a high risk of a cyberattack. Experts call this the “toxic cloud triad”:

• Overprivileged accounts: Giving software or users more access rights than they actually need
• Public exposure: Leaving sensitive parts of the network openly accessible to the internet
• Critical vulnerabilities: Failing to patch known weaknesses within software systems

The overlooked danger of ghost keys

A significant yet often overlooked contributor to this heightened risk stems from the mismanagement of access keys, which are digital credentials designed for specific tasks. Alarmingly, the report found that 84% of organizations retain unused, high-level access keys, often referred to as “ghost keys.” 

These dormant credentials present a critical vulnerability; if discovered by cybercriminals, they offer effortless entry into a system. Such an oversight can lead to security incidents — for example, the MGM Resorts data breach in September 2023.

The hidden risks in cloud infrastructure

Many modern businesses use a technology called “containers” to run their applications — think of these like digital packages that bundle software and its dependencies. They often use a system called Kubernetes to manage these containers.

The study reveals that 78% of organizations have left the control panel (i.e., API servers) for these systems accessible to the public internet. Even worse, many allow unrestricted user control. This is the digital equivalent of leaving your server room unlocked and unmonitored.

How to strengthen cloud security

You don’t need a technical background to improve your company’s security. By implementing stricter governance and fostering better security habits, you can transition your business from a reactive security stance to a proactive one. Follow this structured approach to get started:

Implement strict access controls

Controlling who can access your data is crucial. Regularly audit your digital keys, deleting any that are no longer necessary without delay.

Moreover, you can rotate these keys frequently to prevent old credentials from being exploited by cybercriminals. Think of it this way: if a key is stolen but you’ve already changed the lock, the cybercriminal can’t get in.

Enforce the principle of least privilege

This fundamental security rule dictates that employees and software should be granted only the exact level of access they need to perform their tasks, and nothing more. Use role-based access controls to enforce this; for example, a marketing employee shouldn’t be able to modify financial records.

Require independent audits

Testing your defenses before a cybercriminal does is paramount. However, relying solely on your internal IT team to evaluate their own work can be problematic. Internal teams often assess themselves too leniently or overlook issues, especially if performance incentives are linked to audit results. Instead, engage a third-party security firm to independent audits and penetration testing.

Automate your defense

Manual monitoring alone can’t keep pace with modern threats. Deploy automated tools that monitor your system 24/7 and can detect and neutralize threats in real time, eliminating opportunities for cybercriminals to launch attacks.

Prioritize software updates

Cybercriminals often exploit outdated software to gain access to systems. That’s why when a software provider releases a security update or patch, install it immediately to close known loopholes.

Invest in cybersecurity awareness training

Most cloud security breaches stem from human error. After all, technology cannot compensate for a lack of awareness. Provide ongoing cybersecurity awareness training for all employees to keep them updated on the current cyberthreats and apply security best practices to strengthen your company’s cyber defenses.

Get in touch with our IT experts today for more cloud security tips and robust protection for your business.

Passwords have been a staple of online security for decades, but relying on them alone is no longer enough. Cybersecurity experts now emphasize the importance of adding layers of protection to defend against today’s more advanced threats.

Why your security strategy must go beyond passwords

Cybersecurity experts at the National Institute of Standards and Technology (NIST) now warn that passwords are fundamentally vulnerable and should be avoided whenever possible. Even the strongest password can be compromised in two common ways:

• Phishing: Cybercriminals deploy deceptive tactics, luring users into revealing their credentials through fake login links designed to mimic legitimate sites. Once a user enters their information, the attacker captures it, rendering the password’s strength irrelevant.
• Offline attacks: These attacks involve cybercriminals stealing encrypted password databases during a data breach. They then leverage powerful computers to run automated password-cracking programs offline. A modern PC can attempt up to 100 billion guesses per second, meaning an eight-character password with a capital letter, a number, and a symbol can be deciphered almost instantly.

Given these threats, your focus must shift from creating better passwords to implementing additional security measures. 

Your new security hierarchy for 2025 and beyond

To truly secure your accounts, follow this modern hierarchy of defense recommended by cybersecurity experts.

Priority #1: Activate passkeys (the password replacement)

The biggest change in digital security is the move to passkeys, a safer alternative to passwords. Passkeys store a private digital key on your phone or laptop. You can log in to your accounts by verifying your device with a PIN or fingerprint.

Passkeys are phishing-resistant; you can’t be tricked into typing a passkey on a fake website. They’re also unique to every site, so a data breach at one company won’t expose your other accounts.

Action step: Check your account settings for “Security” or “Login Options” and select Create a Passkey wherever available.

Priority #2: Enable multifactor authentication (MFA)

For any account that doesn’t support passkeys, enabling MFA is a critical step you can take to secure it.

MFA adds another layer of protection beyond just your password. It asks for another verification factor, which can be something you have (e.g., your phone) or something you are (e.g., your fingerprint). That way, even if a cybercriminal gets your password, they still can’t access your account without completing the extra authentication step.

While many services use SMS codes for MFA, security experts at NIST warn that these can be intercepted. For better security, prioritize more robust methods, such as:

• Authenticator apps (e.g., Google Authenticator, Microsoft Authenticator)
• Physical security keys (e.g., USB dongles)
• Push notifications sent from a trusted app on your device

Action step: Review the security settings of your key accounts (e.g., email, banking, and social media), and turn on MFA wherever possible.

Priority #3: Use a password manager

Many accounts still require traditional passwords. Since it’s impossible to remember a long, unique password for each one, use a password manager. This application generates and securely stores all your unique credentials, simplifying digital security by requiring you to remember only one master password to access them.

Action step: Install a reputable password manager, and let it create strong, unique passwords for your nonpasskey accounts.

What to do if you must create a password

If you need to create a password, NIST’s 2025 guidance is clear: length matters most. Aim for at least 15 characters.

NIST no longer recommends mandating special characters, numbers, or uppercase letters for password requirements. Although complexity contributes to password strength, length is far more effective. A 10-character complex password (e.g., Tr@ub4d0r!) is far weaker than a simple 20-character password. 

The easiest way to create a long, memorable password is to string together several unrelated words. A passphrase such as “cassettelavababyriver” is 21 characters long, which is easy for you to remember but would take a long time for a computer to crack.

To keep up with the latest cybersecurity practices and IT trends, connect with our IT professionals today.

Cybersecurity isn’t what it used to be. With artificial intelligence (AI) entering the battlefield, cybercriminals are automating threats and customizing scams like never before. Discover how AI is transforming cybercrime, and how defenders can prepare for this escalating digital arms race.

We now face smarter threats that require less effort to deploy

In the past, hacking required technical know-how, patience, and time. Today, with generative AI tools such as ChatGPT, even inexperienced attackers can craft convincing phishing emails or write malware code tailored to specific victims with minimal effort.

Cybercriminals are also using AI to scan for system vulnerabilities, automate their attacks, and refine their methods based on real-time responses. These aren’t just mass, scattershot threats anymore; they’re targeted, efficient, and eerily personalized.

Attackers are going above and beyond email scams

Phishing is still a go-to tactic, but now, it’s far more convincing. AI-generated messages can be tailored to mimic the writing tone of a CEO, coworker, or vendor with uncanny accuracy. That makes it easier to trick employees into clicking links or handing over sensitive data.

Alarmingly, AI can be trained to mimic human voices, opening the door for high-stakes phone scams (also called vishing), or even create deepfake videos that appear genuine. Cybercriminals are starting to use these techniques to bypass security measures, manipulate behavior, or impersonate individuals with stunning realism.

An AI arms race between cybersecurity defenders and cybercriminals

As AI-driven threats evolve at an alarming rate, cybersecurity professionals are racing to keep up. Just as attackers are using AI to scale and sharpen their tactics, defenders are deploying AI to spot patterns, flag unusual behavior, and respond to incidents more quickly. But it’s not a fair fight; cybercriminals only need to find one weak point, while defenders have to protect the entire system.

Some cybersecurity experts believe we’re already seeing the early signs of an AI-driven cyberwar. For instance, state-sponsored actors and organized crime groups are likely leveraging AI to target critical infrastructure and global supply chains, with consequences that could ripple far beyond a single business or region.

How to balance innovation with responsibility

The dual-use nature of AI presents a fundamental challenge. The same technology that helps companies streamline operations or write marketing copy can just as easily be twisted for harm. That’s forcing businesses and governments alike to rethink their approach to AI governance, cybersecurity investment, and digital ethics.

The best modern defense is layered, combining technology, training, and vigilance. That includes educating employees about new threats, investing in AI-powered threat detection, and keeping software and systems updated.

What’s next?

As AI continues to evolve, so will the threats. Cybercrime will likely become even more autonomous, scalable, and convincing. Raising awareness remains our primary defense against this shifting landscape. By understanding how AI is reshaping the cybersecurity landscape, we can begin to prepare for — and push back against — the new generation of digital threats.

Reach out to us for a robust cybersecurity system. Don’t take any chances; boost your protection today.

Malware, phishing, and DDoS attacks are just the tip of the iceberg when it comes to digital threats facing modern businesses. This guide breaks down these risks and explains how to protect your business from them. Whether it’s using strong passwords, monitoring your network for suspicious activity, or educating your employees, taking these steps will help fortify your business against cybercriminals.

Malware

Malware refers to any malicious software designed to steal data, disrupt operations, or damage computer systems. This umbrella term covers various cyberthreats such as:

• Viruses – self-replicating programs that spread from computer to computer
• Spyware – software that secretly monitors and collects personal information
• Adware – programs that display unwanted advertisements
• Trojan horses – malicious software disguised as legitimate programs
• Ransomware – software that blocks access to your data until you pay a ransom

To safeguard your business from malware, you should have top-notch anti-malware protection in place. You also need to educate your team about common malware types and emphasize the importance of avoiding suspicious links, websites, and files to prevent infection. You can implement these and other security measures yourself, or you can team up with a managed IT services provider (MSP) who can handle all this for you, easing the burden of managing your cybersecurity and giving you peace of mind.

Phishing

Phishing is a deceptive practice where cybercriminals send fraudulent messages that appear to come from trustworthy entities to trick victims into revealing personal or financial information. Such scams often lead to identity theft, financial loss, and data breaches.

You can protect your business against phishing scams by conducting employee security awareness training where you can teach your team to spot common phishing signs, including:

• Urgent requests for personal information – Keep in mind that legitimate businesses rarely ask for sensitive data through email.
• Suspicious links or attachments – Hover over links to check the actual URL before clicking. Avoid opening attachments from unknown senders.
• Poor grammar and spelling – Phishing emails often contain grammatical or spelling errors.
• Generic greetings – Emails that address you as “Dear Customer” or “Dear User” are likely phishing attempts.
• Imitation of trusted brands – Cybercriminals often mimic well-known companies to gain trust.

By teaching your employees to recognize these red flags, you can significantly reduce your business’s risk of falling victim to a phishing attack.

Distributed denial-of-service (DDoS)

A DDoS attack happens when cybercriminals bombard your servers with overwhelming amounts of traffic, causing these to crash or become inaccessible. This disruption can significantly impact your business operations, making it difficult for customers to access your services and employees to do their jobs.

DDoS attacks can be difficult to defend against because they can come from multiple sources at the same time. The effects can be long-lasting, with recovery sometimes taking days or even weeks.

An MSP can help protect your business from DDoS attacks. They can continuously monitor your servers, swiftly identify and counteract malicious traffic, and create a detailed response plan to minimize downtime if an attack occurs.

Password attacks

In a password attack, cybercriminals try to break into your systems by stealing or cracking passwords. They may use brute-force methods (i.e., trying countless password combinations) or use social engineering tactics to get people to reveal their passwords. Using weak or repetitive passwords makes your business an easy target for these attacks. Once in your systems, cybercriminals can steal data, install harmful software, or cause other damage.

To protect against password attacks, require your employees to use strong, unique passwords. Enable multifactor authentication (MFA) whenever possible. MFA requires users to provide more than just their password to access systems. This means even if a cybercriminal gets hold of an employee’s password, they’ll still need another form of identification to get in.

Understanding these common cyberthreats is the first step to safeguarding your business. To better boost your company’s security posture, partner with a trusted MSP like us. We can provide expert guidance, implement security measures, and respond to incidents effectively.

Discover essential best practices for effectively securing your mobile devices, from using strong passwords to using virtual private networks (VPNs) and keeping apps up to date. These simple steps can prevent costly data breaches and keep your company’s sensitive information safe from cybercriminals.

Strengthen device security with strong authentication

A strong password, a PIN, or biometric authentication (e.g., fingerprint or facial recognition) serves as the first line of defense for your mobile devices. Without these, unauthorized users can easily access personal and business-related information if a device is lost or stolen.

Creating a unique password for each app or account can minimize your risk, as reusing passwords increases the chance of a security breach if one account is compromised. Use a password manager to securely store passwords and autofill login details, letting you focus on your business while it handles security.

Enhance security with two-factor authentication (2FA)

By requiring two verification methods, 2FA significantly boosts account security. Beyond your password, it might use a code sent to your phone, a fingerprint, or an authentication app to confirm your identity. With this extra step, it becomes much harder for hackers to access sensitive data, even with the correct login credentials.

Regularly update devices and apps

Hackers often exploit outdated operating systems and applications for known vulnerabilities, making it essential to keep software updated. For even greater convenience and security, enable automatic updates so you never have to worry about forgetting to install them manually. This ensures your device is always up to date without any extra effort.

Avoid unsecured Wi-Fi networks

Connecting to unsecured public Wi-Fi in places such as airports may lead to data interception. To mitigate this risk, establish a policy against using public Wi-Fi for important business activities. If employees need to connect to one, require them to use a VPN to encrypt their data and secure their privacy.

Be cautious of malicious links and downloads

Phishing and malicious apps are common tactics cybercriminals use to access mobile devices. These scams trick users into downloading harmful software or clicking links to fake websites that steal personal or financial information. 

Always download apps exclusively from reliable sources and check ratings and reviews carefully before installing them. Stay vigilant with emails, texts, or social media messages from unfamiliar contacts, and don’t click on links or open attachments unless you’re confident they’re safe.

Opt for privacy-focused apps

Many apps collect personal data without the user’s knowledge or consent, which can lead to privacy violations or targeted attacks. To reduce this risk, choose privacy-conscious apps that limit the amount of personal information they access. Also, regularly review the privacy policies and settings of your apps to make sure they align with your security and privacy preferences.

Empower employees to be security-conscious

Human error can undermine the security of even the most advanced mobile devices. Educate employees on mobile security essentials, such as recognizing phishing attempts, steering clear of unsecured networks, and implementing strong authentication methods. Regular security training can greatly reduce mistakes that risk your business’s data.

Implementing these strategies will help your company protect its mobile devices and sensitive data from modern, evolving threats. Interested in how to better secure your IT infrastructure? Contact us.

Cybercriminals are now using innocuous office devices such as printers and scanners to launch phishing attacks without needing to hack into your email account. Learn how to spot and stop this new trick to keep your workplace safe from phishing scams.

How do hackers use office devices to send fake phishing emails? 

Microsoft 365’s Direct Send feature was originally designed to simplify internal email communication within organizations. However, hackers have discovered a way to use it to send phishing messages that appear to have come from within the company, all without ever accessing a single email account.

Because these messages are disguised as internal communications, they can easily bypass security filters that typically block suspicious messages. Also, these emails often mimic normal document alerts or voicemail notifications, so they appear trustworthy to employees. Since employees are used to receiving such emails, they are more likely to open them without hesitation. Once a link is clicked or an attachment is opened, hackers can steal personal information, capture login credentials, or install harmful software on your network.

Why office devices are the perfect tool for cybercriminals

While printers and other office devices are often used in handling documents with sensitive information, they are often overlooked in security plans, creating a vulnerability that hackers are eager to exploit. Without robust security measures in place, printers, scanners, and smart office equipment can become gateways for phishing schemes and other malicious activities.

Tips to protect your business against phishing

Safeguarding your organization requires integrating all office devices into your cybersecurity strategy. This means ensuring they are regularly updated, securely configured, and continuously monitored for potential vulnerabilities. You can start with the following steps:

• Check your email settings: Make sure your email system is equipped with robust security measures to guard against fraudulent emails, including tools that verify authentication and detect spoofing.
• Consider all devices equally important: Keep an eye on printers, scanners, and other network-connected devices, as they are potential targets for hackers. Patch security updates as soon as they become available, and observe printers, scanners, and fax machines for any unusual beeping, flashing lights, or printing.
• Train your employees: Train your staff to identify suspicious emails, particularly those that appear to come from within the company. Additionally, make it mandatory to double-check any email that asks for sensitive information.
• Monitor email activity: Watch out for unusual email activity, such as messages being sent from strange devices or to unusual places. Setting up alerts for abnormal behaviors can help catch issues early.

The bottom line: Staying proactive and vigilant is key

Cybercriminals will try to take advantage of any potential access point to your system. A good rule to remember is that if a device is connected to your network, it is automatically a potential weakness.

For more help with securing your organization against phishing attacks and other cybersecurity threats, reach out to our IT team today.

You’re focused on leveraging the latest technology for growth and innovation, but there’s a hidden risk that comes with it. The software, automated systems, and AI tools that power your business each have their own non-human identity (NHI). Managing these digital identities was a significant challenge even before the AI boom, but now, with intelligent agents capable of independent action, NHIs represent a critical threat that demands immediate attention.

Your company’s biggest, most overlooked security risk

Think about every piece of software, cloud application, and automated script your company uses. Each one needs credentials and permissions to access data and perform its tasks. That’s a massive, often invisible, digital workforce.

The problem here is that these NHIs are often created for a specific purpose and then forgotten, leaving a digital door wide open for attackers. This oversight leads to several common security gaps:

• Ghost accounts: These are accounts and app credentials that are never disabled, even after a project ends or an employee leaves. Orphaned accounts like these are prime targets, as they are unmonitored and can provide persistent access to your network.
• Weak credentials: Attackers use automated tools to constantly scan for easy-to-crack credentials, making them a significant vulnerability.
• Lack of visibility: Most businesses have no clear picture of how many NHIs exist in their environment or what they have access to. If you don’t know an identity exists, you can’t secure it, monitor it, or recognize when it’s been compromised.

How AI supercharges the threat

If unsecured NHIs are like a key left under the doormat, then AI is like a team of burglars who can check every doormat in the city in a matter of seconds. AI-powered tools allow attackers to find and exploit these forgotten credentials with alarming speed and efficiency, turning a minor vulnerability into a major breach in minutes.

But the risk goes even deeper. The introduction of autonomous AI agents creates a new layer of complexity. AI agents are designed to act independently to achieve certain goals, which means they require broad access to your company’s systems and data. This can lead to:

• Unpredictable actions: An AI agent given a simple task could find an unexpected and potentially destructive way to accomplish it. In a recent security test, an AI given access to company emails discovered it was going to be replaced. It then tried to blackmail the engineer in charge to save its “job.” Imagine the potential for data leaks or operational disruption if such an agent had access to your critical systems.
• Shadow AI: Employees are increasingly using new AI tools without company approval or IT oversight. Each of these tools creates a new, unmanaged identity with access to your data, creating security gaps that your team can’t see.

Secure your business for the AI era

The rapid evolution of AI-driven threats can feel daunting, but you can take proactive steps to protect your business. The strategy starts with a few foundational principles:

• Gain full visibility: You can’t protect what you can’t see. The first step is to discover and inventory every NHI across your entire digital environment. Utilizing specialized tools can help automate this process and provide a complete picture of your NHI landscape.
• Enforce the principle of least privilege: Ensure every application, script, and system has only the absolute minimum level of access required to perform its function. If a tool doesn’t need access to sensitive customer data, it shouldn’t have it.
• Manage the full life cycle: Implement a clear, automated process for creating, managing, and, most importantly, securely decommissioning NHIs when they are no longer needed.

Online threats may be sophisticated and constantly evolving, but a strong security plan can still keep them at bay. Our team of cybersecurity experts can help you gain a clear understanding of your current risk posture and develop a robust strategy to secure your business against the latest threats. Contact us today!

Many people are getting better at spotting phishing attacks from outside sources. But what if the attack appears to come from within your own company? A recently discovered vulnerability in Microsoft 365 is being used to bypass traditional security, making it easier than ever for hackers to send you convincing fake emails that slip past your defenses.

The sneaky trick, explained

At the heart of this new threat is a Microsoft 365 feature called Direct Send. It was created for a simple, helpful reason: to allow internal office devices, such as printers and scanners, to send you emails — such as a scanned document — without needing to log in with a password. This feature is designed for convenience and is intended only for internal use.

However, this convenience has created a security loophole. Because Direct Send doesn’t require authentication, hackers have found a way to exploit it to send phishing emails without needing to steal a single password or compromise any accounts. All they need is a few publicly available details and some guesswork to figure out your company’s email address format.

Once an attacker has a valid internal email address, they can use the Direct Send system to send emails that look like they’re from someone inside your organization. And because these emails are routed through Microsoft’s own infrastructure and appear to be internal, they often bypass the very security filters designed to catch suspicious messages.

In a recent campaign that affected over 70 organizations, attackers used this method to send fake voicemail notifications containing malicious QR codes, which tricked users into visiting websites that stole their Microsoft 365 credentials.

What you can do: Stay alert

While the technical fix is up to your IT team, everyone can help prevent these attacks by being cautious.

• Be suspicious of the sender – Even if an email looks like it’s from a coworker, be wary if the request is unusual.
• Question internal notifications – Employees are used to seeing notifications from scanners and printers, so they rarely question their authenticity. Think twice before opening attachments or clicking links in automated messages.
• Beware of QR codes – Be very careful about scanning QR codes you receive in emails, as they may lead you to malicious websites.
• Report, don’t reply – If you see a suspicious email, report it to your IT department immediately.

For your IT department: The technical fix

This attack exploits a misconfiguration, not an impossible-to-stop, zero-day threat. Your technical team can take several steps to shut this vulnerability down.

• Implement strict policies – Enforce strict DMARC and anti-spoofing policies to make it harder for fakes to get through. You should also enable “SPF hardfail” in Exchange Online Protection.
• Disable or reject Direct Send – Microsoft is working to disable Direct Send by default. In the meantime, you can enable the “Reject Direct Send” setting in the Exchange Admin Center to block this type of attack.
• Flag unauthenticated mail – Set up rules to flag any unauthenticated internal emails for review.
• Secure your devices – Treat all network-connected devices, such as printers and scanners, as fully fledged endpoints. This means putting them on segmented networks, monitoring their activity, and restricting what they are allowed to do.

Don’t wait for an attack to test your defenses. Contact our cybersecurity experts today for help securing your email systems and for more information on how to protect your organization.

As the digital world becomes increasingly complex, finding ways to protect personal and business information is more important than ever. Traditional passwords have long been the go-to solution for securing online accounts, but they come with a variety of vulnerabilities. Passkeys offer a more secure and streamlined alternative, reducing the risks associated with passwords and providing a more seamless user experience.

What are passkeys?

Passkeys are a modern form of digital authentication that uses biometrics (e.g., fingerprints or face scans) or device-based authentication (e.g., a PIN code) to verify a user’s identity. Instead of relying on a static password, passkeys leverage a combination of encryption and public key cryptography, which makes it nearly impossible for hackers to access your accounts. This authentication method is also often more convenient as it lets you sign in with a simple and instant action instead of having to manually type in a string of characters.

Can passkeys be stolen?

It’s incredibly difficult to compromise passkeys. Passkeys are securely stored on your devices in encrypted storage spaces and protected using private key encryption. The private key is never shared with anyone, meaning that even if hackers access your device, they cannot easily retrieve your passkeys.

What happens if you lose your device?

If you lose your device, your passkeys remain protected by device lock screens and encryption, minimizing the risk of unauthorized access.

However, it’s essential to take immediate steps if your device is lost or stolen. Most services allow you to remotely wipe your device or restore your passkeys to a new device so you can regain access to your accounts and data. You should also regularly back up your device and store the backups in a secure location so that if your device is lost, you can easily restore your passkeys.

How to use passkeys across multiple devices

One of the significant advantages of passkeys is the ability to sync them across multiple devices. Services such as Google Password Manager and iCloud Keychain allow users to store and access passkeys on any device they own, making it easy to maintain secure authentication even if you switch devices.

How to create and use passkeys

Setting up passkeys is simple, whether you’re using Google, Microsoft, Apple, or other services. Each platform provides step-by-step instructions to create and use passkeys, often through their respective password management systems. With just a few clicks, you can enable passkey authentication for your online accounts, making security simpler and far more effective.

Where can you use passkeys?

Passkeys are rapidly gaining traction and are now supported by the largest tech platforms. What’s more, crowdsourced platforms such as Passkeys.directory help users find services that accept passkeys, making it easier than ever to transition to this more secure form of authentication. As adoption grows, the list of supported apps and services will continue to expand.

What key challenges should businesses watch out for?

For businesses, adopting passkeys can improve security across the organization. However, there may be challenges in integrating passkeys with existing systems, particularly for businesses that rely on single sign-on (SSO) solutions — a common security practice for managing multiple accounts. While passkeys are increasingly supported, businesses must ensure their infrastructure can accommodate this new form of authentication.

Additionally, there may be a learning curve for employees who are used to traditional password authentication methods. It’s crucial for businesses to provide proper training and support to seamlessly transition to passkeys.

If you need expert guidance on how to implement passkeys and other advanced security measures for your business, our team of cybersecurity professionals is here to help. We specialize in creating robust security solutions that protect your accounts and data from evolving threats. Contact us today to learn how we can help you strengthen your digital security.