Matt Miller

Avoid giving out passwords, verification codes, or internal procedures over the phone. Attackers often use urgency or authority to pressure victims into sharing sensitive information.

Conduct a formal risk assessment to identify vulnerabilities, emerging threats, and gaps in controls. Use the results to update your security roadmap and risk mitigation plans.

If you see someone in a restricted area without proper ID, politely ask who they are or report them to security. Don’t assume someone else has already done it.

Ensure your posts and profile details are only visible to trusted connections. Platforms often update privacy policies, so check your settings periodically.

Create a silly sentence or a song lyric that only you know, then toss in some numbers and symbols. It’s like a secret handshake that’s easy for you but impossible for intruders.

If an email seems unexpected or urges immediate action, avoid clicking links or opening attachments. Hover over links to preview the URL before clicking.

Annually review IT and security policies to ensure they reflect current threats, technologies, and regulatory requirements. Distribute and communicate any changes to staff.

Never leave exterior or interior security doors open or unattended. Propping them open creates easy access for unauthorized individuals.

If you’re unsure about a caller’s legitimacy, hang up and call back using a known, official number. Never use a callback number provided during a suspicious call.

Secure your accounts with complex passwords that are different from those you use elsewhere. Always enable multi-factor authentication (MFA) for an extra layer of protection.

Identify and remove inactive user accounts that haven’t been used in the last 90+ days. Dormant accounts are a common attack vector for unauthorized access.