Cyber threats never stand still. AI is now helping attackers move faster, target more businesses and make their attempts more convincing. But the gaps they rely on are often the same: weak passwords, missed updates, unnecessary access and unsecured devices.
For Cyber Security Awareness Month, we're turning the focus back to the security basics that are easy to overlook.
Here are six areas worth checking across your organisation, now and throughout the year.
A password may be long and difficult to guess, but it can still be stolen through phishing or exposed in a data breach. If you use the same password across several accounts, one stolen password could put all of them at risk.
That's why multi-factor authentication (MFA) is so important. Even if someone has your password, they still need another form of verification to sign in.
Never approve an MFA request you weren't expecting. It could mean someone already has your password and is trying to access the account.
Quick check: Does every account that supports MFA have it enabled, and does every account have a unique password?
Software updates do more than add new features. They also fix security weaknesses that attackers could use.
Keep the laptops, phones, browsers and applications your team uses up to date. If technology is no longer supported, it stops receiving security fixes and should be upgraded or replaced.
Quick check: Are updates being installed and is any unsupported technology still in use?
Otherwise, they may keep access to information or systems they no longer need. If their account is compromised, that gives an attacker more opportunities to reach your organisation's information.
Quick check: Does everyone's access still match their current role?
A junior member of your team receives an email that looks as though it has come from a senior colleague. It asks for a payment to be made that day, mentions a supplier your organisation works with, and fits with work already underway.
AI can make the deception more convincing by drawing on familiar names, natural language and information available online.
Security Awareness Training helps your team recognise these tactics, pause before acting and know how to respond.
Quick check: Would your team recognise the warning signs and feel confident questioning an urgent request?
Make sure every device used for work has the right security settings and can be locked or wiped remotely if it is lost or stolen.
Quick check: Do you know which devices are being used to access your company information?
Cyber attackers will continue to change their tactics, but the security basics still make a real difference. Reviewing these areas regularly can help you find gaps early and reduce the opportunities attackers have to get in.
How well are the basics covered across your organisation? Start with this checklist:
Use unique passwords and MFA across important accounts
Keep devices and applications updated
Identify and replace unsupported technology
Make sure access still reflects each person's current role
Encourage your team to question unusual or urgent requests
Cyber Essentials is the UK Government's recommended minimum standard for cyber security.
It brings together five protective measures covering your internet connection, devices, software, user access and malware protection.
Working through the certification helps you find and address security gaps across your organisation.
It also shows customers and suppliers that important protections are in place and that you take cyber security seriously.
With a certified Cyber Advisor and a team of Cyber Essentials Assessors, we can help you understand the requirements and prepare for certification or renewal.
Call us: 0131 603 7910
Message us: https://www.grantmcgregor.co.uk/contact-us