Security Practices
The Quiet Way Hackers Are Getting Into Business Inboxes
Article summary: Business email security threats have shifted toward polished, AI-written messages that mimic a real vendor or executive closely enough to fool a careful employee. Layered email protection, not just spam filtering, is what actually catches these messages before they reach an inbox. An invoice arrives from a vendor your business has worked with…
Read MoreWarning: Don’t fall for fake CAPTCHAs
Most people don’t think twice about CAPTCHAs.
And that’s being exploited.
There’s a new twist on something you see every day. It’s catching people out in a way that only shows up later…
Revoking Hidden OAuth & Mobile App Access After an Employee Leaves
Article summary: Disabling an employee’s account is not the same as revoking their access. OAuth tokens and mobile app sessions can persist long after a user account is closed, giving former employees a silent path back into company data. OAuth access revocation during offboarding requires a separate, deliberate step that most businesses skip entirely. Employee…
Read MoreProtecting Your Firm from “Session Hijacking”: Why MFA Alone Won’t Stop Cookie Theft
Article summary: Multi-factor authentication confirms who you are at login. Session hijacking attacks after that point, stealing the cookie that proves login already happened. By the time a session cookie is stolen, MFA is irrelevant. Session hijacking protection requires a different set of controls: shorter session lifetimes, conditional access policies, and monitoring for anomalous session…
Read MoreHow to Secure Connected Office Appliances
Article summary: Connected office appliance security means applying the same basic controls you would to any device: changed default passwords, network isolation, firmware updates, and inclusion in your device inventory. Walk through almost any office today and you’ll find more than computers connected to the network. Smart TVs in conference rooms, security cameras, printers, VoIP…
Read MoreWhen Your Vendor Gets Hacked: Drafting a “Downstream” Incident Response Plan for Small Firms
Article summary: Third-party breaches now account for more than a third of all security incidents, and most small businesses have no vendor breach response plan ready when the notification arrives. Drafting one now, before the call comes, determines how quickly your team can contain the damage, notify the right people, and keep operating. The email…
Read More