Byte-Sized Security
Look for Urgent or Threatening Language.
Phishers often create a false sense of urgency (e.g., “Your account will be locked!”) to push you into acting quickly. Take a moment to verify the request through official channels.
Keep Software and Devices Updated.
Regularly update your operating system, antivirus, and applications to patch known vulnerabilities. Enable automatic updates whenever possible.
Cybersecurity Is Like Personal Hygiene.
Just as you wash your hands to avoid germs, regularly clearing your browser history and cookies helps keep your digital footprint clean. Stay fresh and protected online!
Test the Incident Response Plan.
Run tabletop exercises or simulations to ensure the incident response team can respond effectively to various scenarios (e.g., data breach, ransomware, insider threat). Update the plan based on lessons learned.
Be Cautious About What You Post Professionally.
Avoid sharing internal company details, project updates, or photos that may expose sensitive information. Even seemingly harmless posts can give attackers useful context.
Don’t Share Personal or Work Information.
Avoid giving out passwords, verification codes, or internal procedures over the phone. Attackers often use urgency or authority to pressure victims into sharing sensitive information.
Perform a Risk Assessment.
Conduct a formal risk assessment to identify vulnerabilities, emerging threats, and gaps in controls. Use the results to update your security roadmap and risk mitigation plans.
Challenge or Report Unknown Individuals.
If you see someone in a restricted area without proper ID, politely ask who they are or report them to security. Don’t assume someone else has already done it.
Review Privacy Settings Regularly.
Ensure your posts and profile details are only visible to trusted connections. Platforms often update privacy policies, so check your settings periodically.
Use Passphrases You Can Remember (But Hackers Can’t).
Create a silly sentence or a song lyric that only you know, then toss in some numbers and symbols. It’s like a secret handshake that’s easy for you but impossible for intruders.
Don’t Click on Suspicious Links or Attachments.
If an email seems unexpected or urges immediate action, avoid clicking links or opening attachments. Hover over links to preview the URL before clicking.
Review and Update Security Policies.
Annually review IT and security policies to ensure they reflect current threats, technologies, and regulatory requirements. Distribute and communicate any changes to staff.
Secure Entry Points and Don’t Prop Open Doors.
Never leave exterior or interior security doors open or unattended. Propping them open creates easy access for unauthorized individuals.
Verify the Caller’s Identity Independently.
If you’re unsure about a caller’s legitimacy, hang up and call back using a known, official number. Never use a callback number provided during a suspicious call.
Use Strong, Unique Passwords and Enable MFA.
Secure your accounts with complex passwords that are different from those you use elsewhere. Always enable multi-factor authentication (MFA) for an extra layer of protection.
Review and Revoke Dormant Accounts.
Identify and remove inactive user accounts that haven’t been used in the last 90+ days. Dormant accounts are a common attack vector for unauthorized access.
Treat Your Security Like a Puzzle Game.
Every strong password, update, and security measure is a piece that fits together to keep your data safe. The more pieces you lock down, the harder it is for cybercriminals to crack the code.
Check the Sender’s Email Address Carefully.
Phishing emails often use addresses that look similar to legitimate ones (e.g., support@micr0soft.com). Always double-check for misspellings or unusual domain names.
Conduct Security Awareness Training.
All employees should complete updated security training at least once a year. This helps reinforce policies, recognize social engineering threats, and promote secure behavior.
Limit Personal Information Shared Online.
Avoid posting sensitive details like your birthday, address, workplace, or travel plans. This information can be used for identity theft or social engineering attacks.
Be Skeptical of Unsolicited Calls.
If someone calls claiming to be from IT, tech support, or a bank and asks for sensitive information, treat it with suspicion. Legitimate organizations rarely ask for credentials or account details over the phone.
Use a Secure Wi-Fi Network.
Always use a strong, password-protected Wi-Fi connection to prevent unauthorized access. Avoid using public or unsecured networks when handling sensitive work data.
Think of Your Password Like a Toothbrush.
Don’t share it and replace it regularly—just like you wouldn’t use a toothbrush forever or lend it to a friend! A fresh password keeps hackers from getting too comfortable.
Delete old files when no longer needed.
Regularly flesh out file repositories to reduce the chance of sensitive information being exposed or accidentally accessed.
Utilize full disk encryption on your computer’s hard drive.
It can help prevent attackers from recovering data from stolen devices. If your device is stolen, this prevents anyone from recovering your sensitive files.
Regularly back up your important data.
This is useful in the event of a computer hard drive failure or an unfortunate ransomware event. It also protects you from losing critical information due to hard drive failure or a cyberattack.
Don’t plug in USB drives unless you trust their origin.
USBs can carry malware that installs automatically, which can significantly compromise your computer and system security.
Configure your web browser to block pop-ups and automatically detect phishing attempts.
Adjust the settings with simple tweaks to add an extra layer of protection while browsing.
Clear your browser history and cookies regularly.
This critical step helps protect against tracking or exposure of sensitive data from saved sessions.
Be cautious when opening Office files that prompt you to “enable content.”
Do not open it unless you are confident you need to run the macro code embedded in the document.
Only provide sensitive information to websites utilizing HTTPS in the URL.
The “S” stands for secure. Check for HTTPS to keep usernames, passwords, and financial information encrypted during transmission.
Review and customize the privacy settings on social media accounts.
Tailoring these settings can help protect personal or company information from unwanted exposure or misuse.
Limit the amount of personal or company information you share online.
Oversharing personal or company information can put you and your organization at risk, making you a target for cybercriminals.
Locate, read, understand, and abide by all company policies and procedures.
These exist to keep the company’s IT resources secure.
Remember your IT/Security staff are here to help and answer questions.
They are your first line of defense in maintaining security. Don’t hesitate to reach out or report concerns.
Run a full scan with antivirus software and contact IT staff immediately if you suspect a security breach.
The sooner you act, the better chance you have of stopping threats.
Regularly review your online accounts for unauthorized activity.
Keep an eye on things with regular checks to catch unauthorized access early and prevent further damage.
Avoid using public Wi-Fi networks.
Public networks are often insecure, making it easy for attackers to intercept your data. Connect to a VPN whenever possible to protect data in transit.
Secure Wi-Fi networks with a strong password and a minimum of WPA-2 encryption.
This step prevents unauthorized users from accessing your network and stealing your data.
Shred sensitive papers.
Rather than throwing them in the trash or recycling, use a cross-cut shredder to protect confidential documents by ensuring they can’t be pieced back together by prying eyes.
Physically destroy devices before disposal to prevent extractions of stored sensitive information.
Don’t just toss them out. Make sure nothing can be retrieved to protect your personal and company data.
Check that nobody follows you through a secure doorway.
Watch for tailgating, which is when someone enters a secured area without authenticating themselves. Always check that everyone has proper access.
Lock your computer when you walk away from it, even if only for a minute.
Promptly locking your device stops unauthorized access and guarantees your data remains secure while you’re away.
Ensure no sensitive information is left exposed on your desk.
Keep sensitive information out of sight. Leaving documents or devices unattended can invite unwanted access, even in secure environments.
Only install approved software on your work computer.
Always follow your company’s policy regarding appropriate software programs to avoid introducing security risks or breaking compliance.
Enable automatic software updates whenever possible.
This setting ensures you are always protected with the latest security fixes without having to remember to manually install them.
Only download and install software from trusted sources.
Third-party or unknown websites can harbor hidden malware that might compromise your computer and data.
Use a trusted antivirus program to safeguard your computer.
It is the first line of defense against malware, viruses, and other cyber threats. Regular scans can help keep your system clean and secure.
Install updates when prompted by your computer.
Updates often include security patches to protect your system from new cybersecurity threats, so don’t delay.
Never use your work email for personal use.
Instead, keep your accounts separate because a mix-up could expose you or your company to unnecessary security risks.
Check recipient email addresses for spelling before sending emails.
A simple typo could send sensitive information to the wrong person, so this simple step helps.
Clean your email inbox to avoid collecting potentially dangerous messages.
Regular housekeeping reduces clutter and minimizes the risk of forgotten phishing attempts.
Don’t send passwords, social security numbers, and sensitive information via email.
Use secure file-sharing utilities or deliver sensitive information in person or by mail.
Being skeptical can prevent you from falling prey to a phishing attempt.
If something seems too good to be true, it probably is. To avoid phishing traps, be suspicious of offers.
A sense of urgency or an authoritative tone often indicates a phishing email.
Be cautious of correspondence with demanding undertones. Phishing attempts will try to rush you into making mistakes.
Hang up if someone calls requesting sensitive information.
Call back using a trusted number to confirm they’re legitimate and ensure you’re speaking to an authorized person.
Don’t click unexpected links or open unsolicited email attachments.
First, verify the sender’s authenticity. Phishing attacks are common and can be disguised as familiar contacts.
Always use a secure VPN to protect company data.
Connect through a secure virtual private network. VPNs encrypt your data and keep corporate details safe.
Do not allow family members to use your work computer for any purpose.
Your work computer is for your eyes only. Letting others use it can expose sensitive information to unnecessary risks.
Maintain a distraction-free environment when working remotely
Distractions increase the likelihood that you will make a security mistake, such as clicking a link in a phishing email.
Never save login credentials in your browser.
Saving passwords on your browser might be convenient, but it’s not the safest option since browsers can be vulnerable to attacks.
Secure your online accounts with recovery options.
Backup recovery options like an e-mail or phone number help you regain access if you ever get locked out of your account.
Use a password manager to generate strong passwords.
Leverage predefined parameters to stay secure without remembering every single login credential.
Ensure everyone who needs access has a dedicated account.
Giving each person a different account helps keep your system secure and your proprietary data safe.
As we enter the holiday season, remember that cyber-attackers frequently use this to their advantage.
They often create pretexts mimicking special holiday deals to entice users to click a malicious link that actually installs malware on the victim’s computer or leads to a site that steals login credentials. This holiday season, use extra diligence in watching out for phishing emails. Don’t click links or open attachments in emails you were not expecting! Also, make sure you only enter payment card information into sites that have HTTPS in the URL bar. Merry Christmas from the Vantage Point Security Team!
Structure passwords as passphrases by chaining multiple words together.
For example, “DeskLampStapler7!” is a great passphrase. It’s easy to remember but still offers strong security.
Use unique questions and answers for your security questions.
Prevent easy guessing hacks and make it harder for cybercriminals to find their way into your sensitive accounts.
Manually log out of sensitive accounts
Manual logouts help prevent attackers from stealing an authenticated session token and gaining access to your accounts.
Turn on multifactor authentication for more protection
Enabling multi-factor authentication adds an additional layer of security. If someone gets your password, they still can’t get into your account without that extra step.
Do not share passwords with anyone else
Always keep your passwords private. Even sharing them with trusted people can lead to unintended consequences and widespread security risks.
Use a strong, unique password for each login.
Every account should have a unique, 12-character password. Reusing the same password can put all your accounts at risk if one is breached.
Special Edition: Phishing: What is it? How is it dangerous
In this short video, In this short video, John Streff, IT Security Consultant, talks about what phishing is and why it’s dangerous.
Store passwords in a password manager
Use a password manager to store your login credentials securely. Sticky notes and files on your computer leave your passwords vulnerable to prying eyes.
Length is the primary determinant of a password’s strength
Longer passwords are better than complex, short ones. A simple 12-character password is stronger than an 8-character mix of letters, numbers and symbols as long as it isn’t a single, common dictionary word.
Aim to make passwords at least 12 characters long
When it comes to passwords, Longer = Stronger. The length of a password is superior to it’s complexity: 12 characters of lowercase letters is harder to crack than an 8-character password with letters, numbers, special characters. Easier to remember, too!
Only provide sensitive information to websites utilizing HTTPS in the URL.
The “S” stands for secure. Check for HTTPS to keep usernames, passwords, and financial information encrypted during transmission.
