CIT

Think about everyone outside your company who still has a login to your systems: the web developer from two years ago, an old freelancer, the bookkeeper who left. A lot of those accounts are still active. List them, turn off what's not needed, and give each one its own login.

A vendor called Klue got breached, and dozens of companies lost their Salesforce data because of it, including LastPass. Every app you connect to your CRM or email holds a key to your data. Review your connected apps today and remove anything you don't recognize or no longer use.

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data Salesforce disabled Klue Battlecards integration after attackers used compromised OAuth tokens to access customer CRM data via connected apps.

Anyone can send an email that looks like it's from your company. Three DNS records stop it: SPF, DKIM, and DMARC. The catch is DMARC is often set to 'monitor only,' which watches spoofing happen without blocking it. Ask your IT provider: is ours set to reject, or just none?

Someone calls your IT, says they're locked out, sounds friendly and rushed. It's an attacker, and that's how big breaches start. Make one rule: no password or MFA reset on a phone call alone. Call the person back on a number you already have. Verifying takes 30 seconds.

Some of your files might be open to anyone on the internet with the link. 'Anyone with the link' sharing is easy, but that link can be forwarded or copied anywhere, no login needed. Share with named people instead, and check what's already open, starting with customer data.

Microsoft's new Copilot Cowork runs whole multi-step tasks on its own, like sorting files and sending emails, then hands back the finished work. But it's billed by usage, so a busy team can run up the bill fast. Set spending limits before you let people loose on it.

Copilot Cowork is now generally available | Microsoft 365 Blog Copilot Cowork is now generally available worldwide, bringing secure, AI-powered automation for complex enterprise tasks in Microsoft 365.

If you open an email attachment that looks like an image and it asks you to log in, close it.

There's a phishing trick going around this year that hides inside picture files, and it gets past the filters most businesses rely on.

It uses a file type called SVG. It's an image format, but unlike a normal photo, it can carry code inside it.

Someone double-clicks the attachment expecting a picture. Instead it opens in their browser, runs, and sends them to a fake Microsoft login page built for their exact email.

The email system lets it through because, as far as it can tell, it's just an image. Researchers flagged a wave of these in early June.

A picture should never send you to a login screen. So if you open an attachment and it asks for your password, don't type it in.

And be careful with any image you weren't expecting, especially one ending in .svg.

People almost never send those on purpose.

Ask your IT provider to block SVG attachments. Hardly any business needs to receive them, so blocking them costs you nothing.

When a hacker gets into your email, they often set up a hidden rule that forwards your invoices and payment emails to them. Even after you change the password, it keeps feeding them your mail. Check your inbox rules and forwarding settings. You won't spot it unless you look.

Most of your team probably runs their computer as an admin, and they shouldn't. Any malware that lands on an admin account can install itself and switch off security tools. As a standard user, a lot of attacks just fail. Ask your IT who has admin rights and pull them back.

Attackers are hijacking Ubiquiti UniFi gear, the wifi and network kit many small offices run on. Update UniFi OS now, and get the management console off the public internet. If you can log in from anywhere in the world, so can an attacker. Not sure if you have it? Ask your IT.

CISA Warns of Ubiquiti UniFi OS Vulnerability Actively Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that at least one of the flaws is now being actively exploited in the wild.