Security Archives

Are Your Business Tools Ticking Time Bombs For A Cyber-Attack?

30th August 2023

In June a popular file-sharing software amongst big-name companies likes Shell, Siemens Energy, Sony, several large law firms, a number of US federal agencies such as the Department of Health and more was hacked by Russia-linked cybercrime group Cl0p. Security Magazine reported that, to date, there are 138 known companies impacted by the breach, resulting in the personal information of more than 15 million people being compromised. More are expected to emerge as the investigation continues.

If you’re reading that list of company names thinking, “I’m just a small business compared to these big guys – that won’t happen to me,” we’ve got news for you. Many of these companies have cyber security budgets in the millions, and it still happened to them, not because they were ignoring the importance of cyber security, but because of a piece of software they use to run their business.

Progress Software’s MOVEit, ironically advertised as a tool you can use to “securely share files across the enterprise and globally,” “reduce the risk of data loss” and “assure regulatory compliance,” was exploited by a tactic called a zero-day attack. This occurs when there is a flaw in the application that creates a gap in security and has no available patch or defense because the software maker doesn’t know it exists. Cybercriminals quickly release malware to exploit the vulnerability before the software maker can patch it, essentially giving them “zero days” to respond.

These attacks are dangerous because they are difficult to prevent and can quickly and easily ruin smaller businesses.

Depending on the organization’s motives, the stolen data can be deleted, held for ransom or sold on the dark web. Or, if you are lucky enough to recover your data, you might still end up paying out thousands or more in fines and lawsuits, losing money from downtime and coming out on the other end with a damaged reputation that causes clients to leave anyway. In MOVEit’s case, the cybercrime agency Cl0p has claimed on their website that their motivation is purely financial and has allegedly deleted data obtained from government agencies as they were not the intended targets.

What does this mean for small businesses?

For starters, it underlines the harsh reality that cyber security isn’t just the concern of big businesses and government agencies. In fact, small businesses can be more vulnerable to cyber-attacks, as they often dedicate fewer resources to protection.

It also means that even if your organization is secure, the third-party vendors you work with and the tools you choose to use in your business still pose potential risks. Most of MOVEit’s customers that were affected likely had strong cyber security measures in place. Even though it was no direct fault of their own, at the end of the day, those companies still must go back to their clients, disclose what happened and take the verbal, legal and financial beating that comes with a data breach.

The MOVEit hack serves as a grim reminder of the critical importance of cyber security for businesses of all sizes.In the face of an increasingly sophisticated and fast-moving cyberthreat landscape, businesses cannot afford to ignore these risks. Cyber security must be an ongoing effort, involving regular assessments, updates, monitoring, training and more. As this terrible incident shows, a single vulnerability can lead to a catastrophic breach with severe implications for the business and its customers.

In the digital age, cyber security isn’t just a technical issue – it’s a business imperative.

If you have ANY concerns about your own business or simply want to have a second set of eyes examine your network for vulnerabilities, we offer a FREE Cyber Security Risk Assessment. Click here to schedule a quick consultation to discuss your current situation and get an assessment on the schedule.

7 Reasons to Adopt a Defense-in-Depth Cybersecurity Strategy

23rd August 2023

Cybersecurity threats are becoming increasingly sophisticated and prevalent. In 2022, ransomware attacks jumped by 93%. The introduction of ChatGPT will only increase the potential damage of cyber-attacks.

Protecting sensitive data and systems requires a comprehensive approach. One that goes beyond a single security solution. This is where a defense-in-depth cybersecurity strategy comes into play.

In this article, we will explore the advantages of adopting a defense-in-depth approach. As well as its benefits for safeguarding your network and mitigating cyber risks.

What Does a Defense-in-Depth Approach Mean?

First, let’s define what it means to use a defense-in-depth approach to cybersecurity. In simple terms, it means having many layers of protection for your technology.

Just like how you might have locks on your doors, security cameras, and an alarm system to protect your home. A defense-in-depth strategy uses different security measures to safeguard your digital assets.

Many layers are better than one when it comes to security. A defense-in-depth strategy combines various defenses. This is to make it harder for cyber attackers to succeed.

These defenses can include things like:

Firewalls
Antivirus software
Strong passwords
Encryption
Employee training
Access management
Endpoint security

A defense-in-depth strategy also emphasizes early detection and rapid response. It involves using tools and systems that can quickly detect suspicious activities. This enables you to catch an attacker early. And take action to reduce any damage.

A defense-in-depth cybersecurity strategy provides a strong and resilient defense system. Its several layers of security increase the chances of staying secure. This is especially important in today’s dangerous online world.

Advantages of Adopting a Defense-in-Depth Approach

Enhanced Protection

A defense-in-depth strategy protects your infrastructure in many ways. This makes it harder for attackers to breach your systems. Implementing a combination of security controls creates a robust security posture. Each layer acts as a barrier. If one layer fails, the others remain intact. This minimizes the chances of a successful attack.

Early Detection and Rapid Response

With a defense-in-depth approach, you have many security measures that can detect threats. As well as alert you to these potential dangers.

Some systems used to detect suspicious activities and anomalies in real time are:

Intrusion detection systems
Network monitoring tools
Security incident and event management (SIEM) solutions

This early detection allows you to respond quickly. This minimizes the impact of a potential breach. It also reduces the time an attacker has to access critical assets.

Reduces Single Point of Failure

A defense-in-depth strategy ensures that there is no single point of failure. Such as a single vulnerability that could compromise your entire security infrastructure. Relying solely on one security measure, such as a firewall, could prove catastrophic. Especially if it fails or if attackers find a way to bypass it.

It’s better to diversify your security controls. You create a resilient defense system. One where the failure of one control does not lead to a complete breach.

Protects Against Advanced Threats

Cybercriminals continually evolve their techniques to overcome traditional security measures. A defense-in-depth approach accounts for this reality. It incorporates advanced security technologies. Such as behavior analytics, machine learning, and artificial intelligence. These technologies can identify and block sophisticated threats. This includes zero-day exploits and targeted attacks. They do this by analyzing patterns and detecting anomalies in real time.

Compliance and Regulatory Requirements

Many industries are subject to specific compliance and regulatory requirements. Such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA). Adopting a defense-in-depth strategy can help you meet these requirements.

By implementing the necessary security controls, you show a proactive approach. It’s proof of your efforts to protect sensitive data. This can help you avoid legal and financial penalties associated with non-compliance.

Flexibility and Scalability

A defense-in-depth strategy offers flexibility and scalability. This allows you to adapt to evolving threats and business needs. New technologies and security measures emerge all the time. You can integrate them seamlessly into your existing security framework.

Furthermore, you can scale your security controls as your organization grows. This ensures that your cybersecurity strategy remains effective. As well as aligned with your expanding infrastructure.

Employee Education and Awareness

At Limbtec we firmly believe that defense-in-depth approach extends beyond technology. It encompasses employee education and awareness. Educating your employees about cybersecurity best practices can significantly reduce risk. Especially those coming from human error and social engineering attacks.

Training and awareness programs create a human firewall. This complements your technical controls. It’s also a key component of any defense-in-depth cybersecurity approach.

Protect Your Business from Today’s Sophisticated Cyber Threats

We are in an era where cyber threats are constantly evolving. They are becoming even more sophisticated with AI. A defense-in-depth cybersecurity strategy is a must. Having many layers of security can significantly enhance your protection against cyber threats.

Looking to learn more about a defense-in-depth approach? Give us a call today to schedule a cybersecurity chat.

What is Zero-Click Malware?

16th August 2023

How Do You Fight It?

In today’s digital landscape, cybersecurity threats continue to evolve. They pose significant risks to individuals and organizations alike. One such threat gaining prominence is zero-click malware. This insidious form of malware requires no user interaction. It can silently compromise devices and networks.

One example of this type of attack happened due to a missed call. That’s right, the victim didn’t even have to answer. This infamous WhatsApp breach occurred in 2019, and a zero-day exploit enabled it. The missed call triggered a spyware injection into a resource in the device’s software.

A more recent threat is a new zero-click hack targeting iOS users. This attack initiates when the user receives a message via iMessage. They don’t even need to interact with the message of the malicious code to execute. That code allows a total device takeover.

Below, we will delve into what zero-click malware is. We’ll also explore effective strategies to combat this growing menace.

Understanding Zero-Click Malware

Zero-click malware refers to malicious software that can do a specific thing. It can exploit vulnerabilities in an app or system with no interaction from the user. It is unlike traditional malware that requires users to click on a link or download a file.

Zero-click malware operates in the background, often unbeknownst to the victim. It can infiltrate devices through various attack vectors. These include malicious websites, compromised networks, or even legitimate applications with security loopholes.

The Dangers of Zero-Click Malware

Zero-click malware presents a significant threat. This is due to its stealthy nature and ability to bypass security measures. Once it infects a device, it can execute a range of malicious activities.

These include:

Data theft
Remote control
Cryptocurrency mining
Spyware
Ransomware
Turning devices into botnets for launching attacks

This type of malware can affect individuals, businesses, and even critical infrastructure. Attacks can lead to financial losses, data breaches, and reputational damage.

Fighting Zero-Click Malware

To protect against zero-click malware, it is crucial to adopt two things. A proactive and multi-layered approach to cybersecurity. Here are some essential strategies to consider:

Keep Software Up to Date

Regularly update software, including operating systems, applications, and security patches. This is vital in preventing zero-click malware attacks. Software updates often contain bug fixes and security enhancements. These things address vulnerabilities targeted by malware developers. Enabling automatic updates can streamline this process and ensure devices remain protected.

Put in Place Robust Endpoint Protection

Deploying comprehensive endpoint protection solutions can help detect and block zero-click malware. Use advanced antivirus software, firewalls, and intrusion detection systems. They establish many layers of defense. These solutions should be regularly updated. This ensures the latest threat intelligence to stay ahead of emerging malware variants.

Use Network Segmentation

Segment networks into distinct zones. Base these on user roles, device types, or sensitivity levels. This adds an extra layer of protection against zero-click malware. Isolate critical systems and install strict access controls to limit the damage. These help to mitigate lateral movement of malware and its potential harm.

Educate Users

Human error remains a significant factor in successful malware attacks. A full 88% of data breaches are the result of human error.

Educate users about the risks of zero-click malware and promote good cybersecurity practices. This is crucial. Encourage strong password management. As well as caution when opening email attachments or clicking on unfamiliar links. Support regular training on identifying phishing attempts.

Use Behavioral Analytics and AI

Leverage advanced technologies like behavioral analytics and artificial intelligence. These can help identify anomalous activities that may indicate zero-click malware. These solutions detect patterns, anomalies, and suspicious behavior. This allows for early detection and proactive mitigation.

Conduct Regular Vulnerability Assessments

Perform routine vulnerability assessments and penetration testing. This can help identify weaknesses in systems and applications. Weaknesses that enable an exploit by zero-click malware. Address these vulnerabilities promptly through patching or other remediation measures. These actions can significantly reduce the attack surface.

Uninstall Unneeded Applications

The more applications on a device, the more vulnerabilities it has. Many users download apps then rarely use them. Yet they remain on their device, vulnerable to an attack. They are also more likely to lack updates.

Have employees or your IT team remove unneeded apps on all company devices. This will reduce the potential vulnerabilities to your network.

Only Download Apps from Official App Stores

Be careful where you download apps. You should only download from official app stores. Even when you do, check the reviews and comments. Malicious apps can sometimes slip through the security controls before they’re discovered.

Get the Technology Facts from a Trusted Pro

Zero-click malware continues to evolve and pose severe threats to individuals and organizations. It is crucial to remain vigilant and take proactive steps to combat this menace. Need help with a layered security solution?

Give us a call today to schedule a cybersecurity risk assessment.

Article used with permission from The Technology Press.

Top 7 Cybersecurity Risks of Remote Working, and what to do about them.

9th August 2023

Remote work has become increasingly popular in recent times. It provides flexibility and convenience for employees. Additionally, telecommuting reduces office costs for employers. Many also cite productivity benefits due to fewer distractions.

Research shows a 56% reduction in unproductive time when working at home vs. the office.

But there are some drawbacks to working outside the office. It’s crucial to be aware of the cybersecurity risks that come with remote and hybrid work. Keeping an eye on device and network security isn’t as easy. About 63% of businesses have experienced a data breach due to remote employees.

This news doesn’t mean that you must risk security to enjoy remote working. You can strike a balance. Be aware of the cybersecurity concerns and address them to do this. Below, we’ll discuss some of the top cybersecurity risks associated with remote work. As well as provide practical tips on how employees and employers can address them.

Remote Work Risks & Mitigation

1. Weak Passwords and Lack of Multi-Factor Authentication

Using weak passwords puts accounts at risk of a breach. Also, reusing passwords across several accounts is a big cybersecurity risk. Remote workers often access company systems, databases, and sensitive information from various devices.

To mitigate this risk, you should create strong and unique passwords for each account. Additionally, enable multi-factor authentication (MFA) whenever possible. This adds an extra layer of security by requiring a second form of verification. Here at Limbtec we use a password manager to make sure we have Very Strong passwords.

Employers can set up access management systems. These solutions help automate the authentication process. They can also deploy safeguards like contextual MFA.

2. Unsecured Wi-Fi Networks

Working remotely often means connecting to different Wi-Fi networks. Such as public hotspots or home networks that may not be adequately secured. These unsecured networks can expose your sensitive data to hackers.

To protect company data, use a Virtual Private Network (VPN). Turn on the VPN when connecting to public or unsecured Wi-Fi networks. A VPN encrypts the internet traffic. This ensures that data remains secure even on untrusted networks.

3. Phishing Attacks

Phishing attacks remain a prevalent threat, and remote workers are particularly vulnerable. Attackers may send deceptive emails or messages. These messages trick users into revealing their login credentials or downloading malicious attachments. To defend against phishing attacks, be cautious when opening emails. Especially those from unknown sources. Avoid clicking on suspicious links. Verify the sender’s email address.

Also, be wary of any requests for sensitive information. If in doubt, contact your IT support team to confirm the legitimacy of the communication.

4. Insecure Home Network Devices

Many remote workers use Internet of Things (IoT) devices. These include smart speakers, home security systems, and thermostats. These devices can introduce vulnerabilities to your home network if not properly secured.

To address this risk, make sure to change the default passwords on your IoT devices. Also, keep them updated with the latest firmware. Consider creating a separate network for your IoT devices. A “guest” network can isolate them from your work devices and data.

Employers can improve security for remote teams using an endpoint device manager. Such as Microsoft Intune, or similar. These devices make it easier to manage security across many employee devices.

5. Lack of Security Updates

Regularly updating your devices and software is crucial for maintaining strong cybersecurity. Remote workers may neglect these updates due to busy schedules or limited awareness. Cybercriminals often exploit vulnerabilities in outdated software to gain unauthorized access to systems.

To mitigate this risk, enable automatic updates on devices and software whenever possible. Regularly check for updates. Install them promptly to ensure you have the latest security patches.

6. Data Backup and Recovery

Remote workers generate and handle a significant amount of data. The loss or corruption of this data can be devastating. Implementing a robust data backup and recovery plan is essential.

Back up your important files to a secure cloud storage service or an external hard drive. This ensures that if a hacker compromises a device, your data remains safe and can be easily restored.

This has t oinclude all data that is held in the cloud, at Limbtec we do this by using a cloud to cloud backup.

7. Insufficient Employee Training

Remote workers should receive proper cybersecurity training. It helps them to understand security risks and best practices. Unfortunately, many companies neglect this aspect of cybersecurity. This leaves employees unaware of the potential threats they may encounter.

Organisations must provide comprehensive cybersecurity training to remote workers. This training should cover topics such as:

Identifying phishing emails
Creating strong passwords
Recognizing suspicious online behavior
New forms of phishing (such as SMS-based “smishing”)

Get Help Improving Remote Team Cybersecurity

Remote work offers many benefits. But it’s important to remain vigilant about the associated cybersecurity risks. Address these risks head-on and put in place the suggested measures. If you’d like some help, just let us know.

Give us a call today to schedule a chat.Article used with permission from The Technology Press.

The hidden dangers of free VPNs: Are you at risk?

7th August 2023

Are you aware that the rise in global VPN usage has skyrocketed? The reasons are clear as day: Virtual Private Networks offer increased security, anonymity, and allow access to geo-restricted content online.

But here’s the million-dollar question: Are all VPNs created equal?

The answer is a resounding no. And that has potential implications for your business.

Free VPNs, although tempting with their zero-cost allure, aren’t always what they promise to be. Why, you ask? Let’s take a closer look at free VPN services.

For starters, it’s important to understand that running a VPN service comes with substantial costs. Servers, infrastructure, maintenance, staff – these aren’t free.

So how do free VPN providers keep the lights on? Some employ tactics that could compromise your privacy and security.

Imagine this: You’re sipping your morning coffee, browsing the net through a free VPN, believing your online activities are private. In reality, your sensitive information might be collected and sold to the highest bidder.

Cyber criminals, advertisers, even government agencies could potentially get their hands on your data.

Shocking, isn’t it?

Moreover, free VPNs are notorious for injecting unwanted ads and tracking cookies into your browsing sessions. Ever wondered why you’re suddenly bombarded with eerily accurate ads? It’s probably your free VPN service cashing in on your browsing habits.

Now, consider the potential danger if an employee downloads a free VPN on a company device, or on their personal device that they use for work. Company data could be exposed, representing a significant business risk. Picture a scenario where your company’s sensitive data falls into the wrong hands – a chilling thought, isn’t it?

So, what’s the solution?

It’s crucial to educate your employees about the risks associated with free VPNs. Encourage the use of reliable, paid VPN services that guarantee no logging of data, robust encryption, and superior user privacy.

In fact, you may choose to provide one to them. If we can help you find the safest, most suitable VPN for your business, get in touch.

Remember, when it comes to online security, free often comes at a higher cost. Isn’t it worth investing a few ££ a month to protect your company’s valuable information?

Warning: The Hole In Your Cyber-Insurance Policy

2nd August 2023

That Could Result In Your Claim Being Denied Coverage

Do you have policies related to cybersecurity

You’ve all heard the stats – small businesses are the number 1 target for cybercriminals because they’re easy targets, with a recent article in Security Magazine reporting that nearly two-thirds (63%) of small businesses have experienced a cyber-attack and 58% an actual breach. But what many still don’t understand (or simply don’t appreciate) is how much a cyber-attack can cost you.

That’s why one of the fastest-growing categories in insurance is cyber liability. Cyber liability covers the massive costs associated with a breach, which may include the following, depending on your policy:

Legal fees to handle any number of lawsuits, as well as fines and penalties incurred by a regulatory investigation by government.
Negotiation and payment of a ransomware demand.
Data restoration and emergency IT fees to recover your network and get it operational again.
Customer notifications and credit and identity theft monitoring for clients and employees.
Public relations expertise and call center costs for taking inbound calls and questions.
Loss of revenue related to being unable to transact; if your operations and data are frozen, you might not be able to process sales and deliver goods and services for days or weeks.
Errors and omissions to cover liability related to a failure to perform and deliver services to customers, as well as allegations of negligence in protecting your customers’ data.

If you want to make sure you don’t lose everything you worked so hard for to a cyber scumbag, cyber liability is a very important part of protecting your assets.

But here’s what you need to know: In order to get coverage, businesses are required by insurance companies to implement much more robust and comprehensive cyberprotections. Obviously, the insurers want the companies they are underwriting to reduce the chances and the overall financial impact of a devastating cyber-attack so they don’t have to pay out – and this is where you need to pay attention.

MANY business owners are signing (verifying) that they DO have such policies and protections in place, such as 2FA, a strength of password requirement, employee awareness training and data recovery and backups, but aren’t actually implementing them, because they assume their IT company or person knows this and is doing what is outlined in the policy. Not so in many cases.

Unless cyber security is your area of expertise, it’s very easy for you to misrepresent and make false statements in the application for insurance, which can lead to your being denied coverage in the event of an attack and having your policy rescinded.

If you have cyber liability or similar insurance policies in place, I urge you to revisit the application you completed with your IT person or company to make absolutely certain they are doing everything you represented and affirmed you are doing. Your insurance agent or broker should be willing to assist you with this process since your IT company or person cannot be expected to be insurance professionals who know how to interpret the legal requirements outlined.

What’s critical here is that you work with your IT company or person to ensure 100% compliance with the security standards, protocols and protections you agreed to and verified having in place when you applied for coverage. IF A BREACH HAPPENS, your insurance provider will NOT just payout. They will conduct an investigation to determine what happened and what caused the breach. They will want to see tangible evidence and documentation that proves the preventative measures you had in place to ward off cyberthreats. If it’s discovered that you failed to put in place the adequate preventative measures that you affirmed you had in place and would continue to maintain on your insurance application, your insurance company has every reason to deny your claim and coverage.

If you have ANY concerns over this – including whether or not you need coverage, whether your coverage is sufficient and whether you are doing what you need to do to avoid an insurance denial, click here to schedule a quick consultation to discuss your current situation and to receive a referral to a cyber insurance expert we recommend.

Further, if you would like us to conduct a FREE cyber security risk assessment to show just how secure and prepared you are for ransomware or a cyber-attack, we can discuss that too! Just click here to schedule a phone consultation.

Is this the ultimate browser for business?

31st July 2023

It’ll come as no surprise, but Microsoft has yet more exciting news for us. Sometimes we wonder if they allow their employees to sleep!

This time it’s a new browser aimed specifically at businesses: Edge for Business.

The updated browser has security and productivity features that are perfect for employers and their teams alike.

Edge for Business could become the best choice for browsing the web on work-related devices, whether they’re managed or unmanaged. That’s because it will allow companies to maintain a level of control over employees without intruding on their privacy.

And that’s perfect for the way many of us work today. If you’re a Bring Your Own Device (BYOD) company, Edge for Business is also going to be the perfect solution for you.

One of the best things about Edge for Business is that it separates work and personal browsing automatically into dedicated browser windows. It has its own favourites, separate caches and storage locations.

And some sites will automatically open in the relevant browser, like Microsoft 365 will go straight to your work browser, whereas a shopping site will open in your personal browser.

That means you don’t have to worry about accidentally sending a colleague that funny meme you saw on social media.

Edge for Business is currently available to test, but although we understand that you’ll be eager to give it a try, we advise holding off until its official launch in the autumn. Let others be the guinea pigs.

And Microsoft has yet to add custom branding capabilities for businesses, but they promise that’s coming soon. The anticipation is half the fun, right?

Edge for Business aims to bridge the gap between work and personal on the same device, ensuring that personal and professional information remains separate and secure. With this new and exciting business browser, you’ll enjoy heightened productivity and security.

If we can help you stay productive and secure in the meantime, get in touch.

Scary stat: 87% of businesses hit by this in the last year

24th July 2023

You may think that cyber attacks only happen to large corporations. But unfortunately, that’s not the case.

According to a recent report, almost two-thirds of small and medium-sized businesses (SMBs) suffered at least one cyber attack over the past year. That’s a staggering number, and it should serve as a wake-up call for businesses everywhere.

But it gets worse.

More and more businesses are also experiencing repeat attacks, with 87% reporting at least two successful attacks over the past year. And on average, a company suffers almost five successful cyber incidents.

Terrifying.

The question is, why are these attacks happening, and what can you do to prevent them?

The most common types of cyber attack that businesses face are malware and ransomware.

Malware is malicious software. It invades your system and can cause all sorts of problems, from slowing down your operations to stealing your data.

Ransomware is even more dangerous as it encrypts your data, making it impossible for you to access it unless you pay a ransom fee. This can be devastating for any business and can lead to significant losses and downtime.

What factors are contributing to more successful attacks?

One reason is the rise in BYOD (Bring Your Own Device). This means employees using their personal devices to access company information, which can be risky.

Another factor is the explosion of productivity apps, which can create security vulnerabilities if not properly secured.

Finally, the number of devices we’re using now means there are more entry points for cyber criminals to exploit.

The good news is that there are steps you can take to protect your business. Here are five solid security steps you can take.

Use strong passwords: Passwords are your first line of defence, so make sure they’re strong and unique. Better yet, use a password manager that can create and remember randomly generated passwords
Keep software up to date: Software updates often contain security fixes, so make sure you’re always running the latest version. This applies to both your operating system and all applications you use
Train your staff: Educate your employees on how to identify phishing emails and other scams. You can also run regular security awareness training sessions to keep everyone up to date
Backup your data: Doing this means if you do suffer a cyber attack, you can restore your systems quickly and with less disruption
Use antivirus software: This can help protect your systems from malware and other threats. Make sure you’re running a reputable and up-to-date solution

Remember, prevention is always better than cure. Take action today to help you stay protected.

And if that seems like a lot of extra work, let us help. Get in touch today.

This is the latest trend in phishing attacks

17th July 2023

Warning of a new trend in phishing attacks.

Have you heard the saying, “A picture is worth a thousand words”? It seems cyber criminals have too, and they’re using it to their advantage.

In a new twist on phishing campaigns, cyber criminals are luring victims to click on images rather than downloading malicious files or clicking suspicious links.

Let’s dive into the warning signs, so you can keep your business safe from these sneaky attacks.

First things first, what’s the big deal about clicking on an image? It might be promoting a killer deal or one time offer.

But when you click on the image, you don’t go to the real website. Instead it’s a fake site designed to steal your personal information.

Imagine being lured in by a cute cat photo only to find out that Mr. Whiskers was actually a wolf in sheep’s clothing! Not so cute anymore, right?

So, how can you tell if an image is part of a phishing campaign? Here are some warning signs to look out for:

Unexpected emails: Did you receive an email from someone you don’t know or weren’t expecting? Be cautious! It’s like accepting sweets from a stranger – you never know what you’re getting yourself into
Too good to be true: If an email promises you a free holiday or a million pounds just for clicking on an image, remember the golden rule: if it sounds too good to be true, it probably is.
Spelling and grammar mistakes: We all make typos, but if an email is riddled with errors, it could be a sign that something is going on.
Mismatched logos or branding: If an email claims to be from a reputable company but the logo or branding doesn’t match up, assume it’s a scam

Now that you know what to look for, let’s talk about how to protect your business from these image-based phishing attacks:

Educate your employees: Knowledge is power! Make sure your team is aware of the latest phishing tactics and knows how to spot the warning signs.
Keep software up-to-date: Just like you wouldn’t drive a car with bald tyres, don’t let your software become outdated. Regular updates help patch security vulnerabilities that cyber criminals might exploit.
Use strong passwords: It might be tempting to use “password123” for all your accounts, but resist the urge! A strong, unique password for each account can help prevent unauthorised access. Using a password manager is even better.
Enable multi-factor authentication (MFA): MFA adds an extra layer of security by requiring people to verify their identity through another method, such as a text message or fingerprint scan.
Backup your data: In case disaster strikes, make sure you have a backup of all your files. That way, you won’t be left high and dry if your data is compromised.

Whilst cyber criminals are getting smarter and smarter with their tactics, there’s no need to panic. By being aware of the warning signs and taking proactive steps to protect your business, you can stay one step ahead of these digital tricksters.

Remember, not all that glitters is gold – or in this case, not every cute cat picture is just a cute cat picture. Stay vigilant, and don’t let the scammers win!

Privacy alert: Change this setting in Edge, now

10th July 2023

Don’t be mistaken, we love Microsoft Edge (and think you will too), but lately, something has come to our attention that we wanted to share.

It’s always a good idea to be aware of what your browser is doing behind the scenes. And there’s an Edge setting that you might be interested to learn about. It’s one that sends the images you view online to Microsoft.

While this might not seem like a big deal on the surface – it’s done to enhance the images – some business owners might be concerned about the privacy implications. After all, you never know who might be looking at your browsing history.

The good news is that it’s easy to disable this setting if you’re concerned about it. Here’s how:

Open Microsoft Edge and click on the three dots (“More actions”) in the upper-right corner of the screen
Select “Settings” from the drop-down menu
Scroll down and click on “Privacy, search, and services”
Under the “Services” section, turn off the toggle switch next to “Improve your web experience by allowing Microsoft to use information about websites you browse to improve search suggestions, or to show you more relevant advertising”

That’s it! With just a few clicks, you’ve disabled the feature that sends images to Microsoft.

Of course, there are other settings in Edge that you might want to explore as well. Like the ones that control your data collection preferences, or the ones that limit pop-ups and redirects.

Why should you take a few minutes to check out your browser settings? Well, for one thing, it can help protect your privacy and security online. By being aware of what your browser is doing, you can make informed decisions about what data to share (and what to keep private).

Plus, exploring your browser settings can be a fun and educational experience in its own right. You might discover new features or hidden gems you never knew existed.

And don’t worry, you don’t have to be a tech expert to understand these settings. In fact, Microsoft has done a great job of making them simple and straightforward, with clear explanations and helpful tips along the way.

If you ever get stuck, our team is happy to help. Get in touch.