If you use Google Chrome in your business, you’re probably familiar with extensions. These useful tools can enhance your browsing experience in countless ways, from blocking annoying ads to reducing distractions.

Extensions are incredibly popular because they can add so much functionality to your browser. But just as you need to be careful when installing new apps on your phone, you must also be cautious when adding new extensions to your browser. That’s because they come with a risk of malware.

It’s short for malicious software – that’s any software intentionally designed to cause damage to a computer, server, or network. Cyber criminals use malware to steal data, hijack systems, and even empty your bank accounts.

Google Chrome holds about 65% of the browser market share worldwide, making it the most popular browser by far. This popularity makes Chrome a prime target for cyber criminals. While cyber attacks sometimes exploit vulnerabilities in the browser itself, there’s an easier way to target Chrome users: Through malicious extensions containing malware.

Although Google keeps a tight watch on its Chrome Web Store, the risk is still there. A recent report claims 280 million people installed a malware-infected Chrome extension between July 2020 and February 2023. That’s a huge number and highlights the importance of being vigilant.

Surprisingly, many malicious extensions remained available for download on the Chrome Web Store for a long time. On average, malware-filled extensions stayed up for 380 days, while those with vulnerable code were available for about 1,248 days. One particularly notorious extension was downloadable for 8 and a half years before being removed.

So, how can you protect yourself and your business from these malicious extensions? Here are five steps we recommend.

1. External reviews: Since checking ratings and reviews on the Chrome Web Store isn’t always reliable (many malicious extensions don’t have reviews), look for external reviews from trusted tech sites to judge whether an extension is safe.

2. Permissions: Be cautious if an extension asks for more permissions than it should. If a new extension requests extensive access to your data or system, this could be a red flag.

3. Security software: Use robust software to catch malware before it can do any harm. This is your last line of defence if you accidentally install a malicious extension.

4. Necessity: Before installing any new software or browser extensions, consider whether you really need it. Often, you can achieve the same functionality visiting a website.

5. Trusted sources: Only install extensions from trusted sources or well-known software providers. This significantly reduces the risk of downloading a harmful extension.

Chrome is the most popular browser, which means it will always be a target for cyber criminals. Google’s security team works hard to review every Chrome extension to ensure they are safe, but it’s still crucial to be vigilant.

If you’re unsure whether your extensions are safe or not, or you’d like more advice around keeping your business secure, our team can help. Get in touch.

Protect your business from a data leak with Microsoft Edge

Microsoft Edge for Business has just rolled out new data leak control capabilities. And that could be a good thing for keeping your sensitive info safe.

What are data leak control capabilities?

In plain English, they help prevent your sensitive information from getting out to the wrong people. Think of it as having an extra lock on your digital doors, making sure only the right people can access your important data.

Every business handles sensitive information, whether it’s financial records, client details, or proprietary data. If this information leaks, it could mean big trouble: Financial loss, legal headaches, and a hit to your reputation.

This new feature in Microsoft Edge helps keep your data secure by making sure only authorised people can access it. It also stops accidental sharing.

Depending on your industry, you may have strict rules about data protection. These new controls can help you stay on the right side of regulations.

And let’s not forget your customers. They’re more aware than ever about data privacy. Using a browser with strong data leak controls shows you’re serious about protecting their information, which can boost their trust in your business.

Microsoft Edge for Business has added this new feature into an easy-to-use package. You can set policies on how data can be shared – like stopping certain types of data from being copied or emailed to unauthorised recipients. This way, you’re less likely to have accidental leaks.

It uses artificial intelligence to spot potential threats and unusual data movements. Edge can alert you to a potential leak before it happens, giving you a chance to act proactively.

If you’re already using other Microsoft products like 365 or Microsoft Teams, good news: Edge for Business integrates smoothly with them, letting you apply consistent data protection across all your tools.

Ready to give it a spin? Here’s what to do:

1. Update your browser: Make sure all your business’s devices are using the latest version of Microsoft Edge for Business. This makes sure you have all the newest features and security updates.

2. Set your policies: Work with your IT support partner to set up data sharing policies that make sense for your business. Microsoft provides guidelines and templates to help you get started.

3. Train your team: Make sure your employees know about the importance of data security and how to use the new features. A quick training session can do the trick.

4. Monitor and adjust: Keep an eye on how things are working and tweak your policies as needed. You want to find a balance that keeps your data secure without disrupting your workflow.

Better still, why not get our team to just do this for you. Get in touch.

Imagine waking up one morning, turning on your computer, and finding that all your important files – everything from customer data to financial records – are locked. Tight.

And then a scary message pops up demanding a ransom fee to unlock them.

That’s ransomware in a nutshell. It’s a type of malicious software that hijacks your data and holds it for ransom.

It usually starts with an innocent-looking email or link. You might get an email that seems legitimate, asking you to click on a link or open an attachment.

This is known as a phishing email, where the sender appears to be genuine but isn’t. Once you click, malicious software is silently installed on your system. From there, the cyber criminals quickly go to work.

They’ll be encrypting your files so you can’t access them. Then, you get that dreaded ransom note, demanding payment in exchange for a decryption key to unlock your files. Paying the ransom is a risky move because there’s no guarantee you’ll get your data back, and it just encourages the attackers to target more victims.

2023 was a particularly bad year for ransomware, with attacks surging after a two-year decline. According to a report, there was a huge increase in ransomware incidents, breaking a six-year record.

One reason for this spike is the rise of something called Ransomware-as-a-Service (RaaS). This model lets cyber criminals “rent” ransomware tools, making it easier than ever for them to launch attacks.

As a result, more businesses are finding themselves posted on data leak sites, with a 75% increase in the number of victims between 2022 and 2023.

Ouch.

And it gets worse. Attackers are getting smarter. They’re developing new variants of old ransomware, sharing resources, and using legitimate tools for malicious purposes.

They’re also working faster, often deploying ransomware within 48 hours of gaining access to a network. And they tend to strike outside of work hours, such as when you’re tucked up in your bed, so they’re less likely to be noticed.

If your business falls victim to a ransomware attack, the consequences can be devastating. You might face significant financial losses, not just from the ransom itself but also from the cost of downtime and recovery.

There’s also the risk of losing critical data if you can’t decrypt your files.

Your reputation could take a hit if customers find out their information was compromised. Oh, and your business operations could be severely disrupted, affecting your ability to serve your clients.

The most important question then: How can you protect your business from this growing threat?

• Start by educating your team. Make sure everyone knows how to spot phishing emails and avoid suspicious links and attachments
• Regularly back up your critical data and securely store those backups offline
• Keep your software and systems up to date with the latest security patches, and invest in strong security tools
• It’s also important to limit access to your data. Only give employees access to the information they need for their jobs
• Monitor your network for unusual activity and have a plan in place to respond to incidents quickly

If you do get hit by a ransomware attack, don’t panic. Work with cyber security experts (like us) to resolve the issue.

Remember, it’s best not to pay the ransom, as it only fuels the cyber criminals’ activities.

My team and I help businesses take proactive action to protect their data. If we can help you, get in touch.

Getting your team to report security issues quickly is something that’s important for your business… but maybe something that might not have crossed your mind before.

You might think that with so many security tech tools, you’re covered. But guess what? Your employees are your first line of defence, and they’re irreplaceable when it comes to spotting and reporting security threats.

Imagine this: One of your employees receives a fishy-looking email that appears to be from a trusted supplier. It’s a classic phishing attempt (that’s where a cyber criminal sends an email and pretends to be someone else to steal your data).

If the employee brushes it off or thinks someone else will handle it, that innocent-looking email could lead to a massive data breach, potentially costing your company big bucks.

The truth is, less than 10% of employees report phishing emails to their security teams. That’s shockingly low. Why? Well:

• They might not realise how important it is
• They’re scared of getting into trouble if they’re wrong
• Or they think it’s someone else’s job

Plus, if they’ve been shamed for security mistakes before, they’re even less likely to speak up.

One of the biggest reasons employees don’t report security issues is that they just don’t get it. They might not know what a security threat looks like or why reporting it is crucial. This is where education comes in, but not the boring, jargon-filled kind.

Think of cyber security training as an engaging and interactive experience. Use real-life examples and scenarios to show how a small issue can snowball into a major problem if not reported.

Simulate phishing attacks and demonstrate the potential fallout. Make it clear that everyone has a vital role in keeping the company safe. When employees understand their actions can prevent a disaster, they’ll be more motivated to report anything suspicious.

Even if your employees want to report an issue, a complicated reporting process can stop them in their tracks. Make sure your reporting process is as simple and straightforward as possible. Think easy-access buttons or quick links on your company’s intranet.

Make sure everyone knows how to report an issue. Regular reminders and clear instructions can go a long way. And when someone does report something, give them immediate feedback. A simple thank you or acknowledgment can reinforce their behaviour and show them that their efforts matter.

It’s all about creating a culture where reporting security issues is seen as a positive action. If employees feel they’ll be judged or punished, they’ll keep quiet. Leaders in your company need to set the tone by being open about their own experiences with reporting issues. When the big boss talks openly about security, it encourages everyone else to do the same.

You could even consider appointing security champions within different departments. These are your go-to people for their peers, offering support and making the reporting process less intimidating. Keep security a regular topic of conversation so it stays fresh in everyone’s minds.

Also, celebrate the learning opportunities that come from reported incidents. Share success stories where reporting helped avoid a disaster. This not only educates but also motivates your team to keep their eyes open and speak up.

By making it easy and rewarding for your employees to report security issues, you’re not just protecting your business; you’re also building a more engaged and proactive workforce.

Encourage open communication, continuous learning, and avoid shaming anyone for their mistakes. The faster issues are reported, the easier and cheaper they are to fix, keeping your business secure and thriving.

This is something we regularly help businesses with. If we can help you too, get in touch.

More and more businesses are making the smart decision to be proactive and invest in their cyber security defences. This is fantastic news, especially since stats show that about half of small and medium-sized businesses still have no cyber security measures at all.

If your business falls into that category, it’s time to change.

Cyber security might sound complex, but it starts with a few simple steps. Let’s talk about some basics you can put in place right away.

First, think about encryption and multi-factor authentication (MFA). Encryption is like putting your data in a secure vault. It ensures that even if someone intercepts your information, they can’t read it without the encryption key.

MFA adds an extra layer of security by requiring you to verify your identity using a second device, like your phone, whenever you log in. It’s a bit like needing two keys to open a lock instead of just one.

Another easy step is using a password manager. These generate long, random passwords for every account and remember them for you. Password managers make life easier and your business more secure in one package. Amazing.

Advanced monitoring tools are another great way to protect your business. They’re a little like security cameras for your digital space, always on the lookout for anything suspicious. These tools help detect unusual activity in your systems, giving you a heads-up if something’s not right.

And let’s not forget about protecting your business from phishing scams. These are attempts by criminals to trick you into giving away personal information by pretending to be someone you trust, like a supplier or a bank. Educating your team on how to spot these scams is crucial. If something feels off, it probably is.

Why is investing in cyber security so important?

• It protects your data
• Avoids financial loss
• And builds trust with your customers and partners

Your business data is valuable, and protecting it means safeguarding your business’s operations and reputation.

Cyber attacks can be costly, not just in terms of money but also time and resources. Prevention is ALWAYS cheaper than dealing with the aftermath of a breach. Plus, showing that you take security seriously helps build trust with your customers and partners. They need to know that their information is safe with you.

Investing in cyber security doesn’t have to be daunting. We’re the experts in this field and would love to help you secure your business. Whether you need advice on getting started or want a comprehensive security plan, get in touch.

Are you tired of juggling a multitude of passwords like a circus act? You’re not alone. According to a recent report, around 1 in 4 of us feel the same. But it’s not just the sheer number of passwords that’s causing headaches – it’s the security risks they pose.

Let’s face it, when it comes to setting passwords, most people aren’t cyber security experts. From weak and easily guessable passwords to the cardinal sin of reusing passwords across multiple accounts, human error is everywhere.

Another study revealed that, on average, people use the same password for five different accounts. And don’t get us started on classics like ‘123456’… used on a mind-boggling 23 million breached accounts.

But here’s the thing: Cyber criminals don’t need any extra help. They’re already pros at cracking passwords, and our lax habits are like an open invitation to wreak havoc. And let’s not forget the staggering stats – a projected $434 billion (£347 billion) loss to online payment fraud globally between 2024 and 2027, with 90% of data leaks attributed to stolen login details.

So, what’s the solution?

Password managers.

These are essential software tools that take the hassle out of password management by generating and storing complex, unique passwords for each account. No more ‘123456’ disasters. Just robust security.

And the best part? Password managers not only beef up your security defences but they also streamline your digital life. With one-click logins and autofill features, you’ll wonder how you ever lived without one. And with the right password manager, you can rest easy knowing your sensitive data is under lock and key.

A password manager makes your life easier and business safer at the same time. Want to know which one we recommend? Get in touch.

Cyber security training once a year isn’t working

We all know how important it is to keep our people up-to-date on the latest cyber threats. After all, with cyber attacks on the rise, staying one step ahead is crucial to protect your business from potential breaches.

But here’s the thing – annual cyber security training just isn’t cutting it anymore.

Sure, it’s become a routine part of the calendar for many organisations. And it’s great that it’s happening at all. But ask any security leader, and they’ll tell you… employees find it time-consuming and uninspiring. From clicking through slides to skimming through videos at double-speed, it’s usually seen as just another box to tick.

And let’s be honest, even for those who do engage with the training, there’s little evidence it leads to real behaviour change.

That’s because the traditional approach lacks interactivity and doesn’t connect with employees on a personal level. It’s more about ticking boxes than building a culture of cyber security vigilance.

Guess what? There’s a better way. It’s all about small, regular, human-centric interventions. Think of it like the speed signs you see when you’re driving. They remind people to stop and think before they engage in risky behaviour. Just as the signs work for driving, this kind of training makes your employees more aware of what they’re clicking.

By nudging employees toward safer decisions in real-time, we can help them develop better cyber hygiene habits without overwhelming them with information overload. It’s about empowering them to make smarter choices every day.

And with the amount of Generative AI and third-party tools we’re surrounded with right now, it’s more important than ever to give employees the guidance they need to navigate potential risks. Whether it’s through real-time coaching or policy reminders, we can help employees understand the importance of safeguarding sensitive data.

So, while there may be a place for annual training, it’s time to think about using a more proactive approach to cyber security education.

This is something we can help you with. If you want to learn more, get in touch.

Uh oh! You’re at greater risk of malware than ever before

Here’s something not-so-fun but incredibly important to talk about: Malware attacks.

And it’s bad news. These scary cyber threats are hitting small and medium-sized businesses (SMBs) harder than ever before. That means you need to know how you can defend your business.

First things first, what exactly is malware?

Think of it as the digital equivalent of the germs that make you sick. Malware, short for malicious software, is like the flu virus of the cyber world. It’s designed to sneak into your computer systems or network and wreak havoc in all sorts of ways.

So, what kinds of malware are we talking about here?

Well, according to a recent report, there are a few major troublemakers: Information-stealing malware, ransomware, and business email compromise (BEC).

You might be wondering why you should care about malware. Let me set the scene. You’re running your business smoothly, minding your own business, when BAM! A malware attack hits.

Suddenly, your files are encrypted, your systems are locked down, and you’re being held hostage for ransom.

Sounds like a nightmare, right?

That’s the reality for many SMBs facing malware attacks. It’s not just about losing money – it’s about the potential damage to your reputation, your operations, and your customers’ trust.

But there are plenty of ways to fight back against malware and keep your business safe and sound:

Educate your team

Teach your employees to spot phishing emails (an email pretending to be from someone you trust), suspicious links, and other sneaky tactics used by cyber criminals. A little awareness goes a long way.

Armour up your devices

Make sure all your computers and devices are equipped with the best software to prevent attacks.

Back up, back up, back up

Regularly back up your data to secure offsite locations. That way, if you are attacked, you’ll have a backup plan (literally) to restore your files.

Fortify your network

Improve your network security with firewalls, encryption, and other powerful weapons. We can help with all of that.

Stay sceptical

Be cautious of suspicious emails or requests for sensitive information. When in doubt, double-check the sender’s identity and never click on risky links or attachments.

Have a plan

Prepare an incident response plan for dealing with malware attacks. Think of it as your emergency playbook, complete with steps for containing the threat, recovering your data, and reporting the incident. That’s a lot to take in, but remember, knowledge is power. These are all things we help our clients with, so they don’t have to worry about it. If we can help you too, ge

Picture this: You’re going about your day, checking your emails, when suddenly you see a message from a company you trust.

You think, “Great! That’s safe to read”. But hold on just one minute… this email is not what it seems.

It’s part of yet another scam created by cyber criminals to trick you into clicking malicious links or giving up sensitive info. It’s called “SubdoMailing,” and it’s as dangerous as it sounds.

What’s the deal?

Just like regular phishing attacks, cyber criminals pretend to be trusted brands.

But here’s how it works: These cyber criminals scour the internet for subdomains of reputable companies. You know those extra bits in a web address that come before the main domain? Such as experience.trustedbrand.com. That ‘experience’ bit is the subdomain.

They find a subdomain that the brand is no longer using and is still pointing to an external domain that’s no longer registered.

Then they buy the domain and set up the scam website.

So, you believe you’re clicking on experience.trustedbrand.com… but you have no idea it automatically redirects to scamwebsite.com.

The criminals are sending out five million emails a day targeting people in businesses just like yours.

And because these emails are coming from what seems like a legit source, they often sail right past usual security checks and land in your inbox.

Here’s our advice to keep you and your data safe and sound:

• Be wary of any emails that seem even remotely suspicious. If something looks fishy, it probably is.

• Before clicking on any links or downloading any attachments, take a moment to verify the sender. Look for red flags like spelling mistakes or unusual email addresses.

• Make sure your employees understand the latest phishing tactics and know how to spot a scam. A little knowledge goes a long way in keeping your company safe.

• Consider investing in top-notch security software to keep the cyber criminals at bay. It might seem like an extra expense, but trust us, it’s worth it.

As always, if you need help with this or any other aspect of your email security, get in touch.

A new security report has revealed some alarming trends.

First off, cyber attacks are becoming faster than ever. Breakout times (that’s the time it takes for a criminal to move within your network after first getting in) have dropped significantly. We’re talking an average of just 62 minutes compared to 84 minutes last year.

This is not good news.

Not only are these attacks faster, but they’re also becoming more common. The report has identified a whopping 34 new cyber criminal groups, bringing the total to over 230 groups tracked by the company.

And guess what? These cyber criminals aren’t sitting around twiddling their thumbs. They’re getting smarter and more sophisticated. The report highlights a new record breakout time of just two minutes and seven seconds. That’s barely enough time to grab a coffee, let alone mount a defence.

But here’s the real kicker: The human factor is increasingly becoming the main entry point for these cyber attacks.

They will try to get your people to click a link in a phishing email, which will take them to a fake login page. Once your employee enters their real login details, they have inadvertently handed them over.

Or they pretend to be someone your team trusts. This is called social engineering.

So, what can you do to protect your business from these cyber threats?

• Educate your employees

Make sure your team is aware of the latest cyber threats and how to spot them. Regular training sessions can go a long way in preventing costly mistakes.

• Implement strong password policies

Encourage the use of complex random passwords generated and remembered by password managers. Use multi-factor authentication for an added layer of security (this is where you use a second device to confirm it’s really you logging in).

• Keep your systems updated

Make sure all software and systems are up to date with the latest security patches. Cyber criminals often exploit known vulnerabilities, so staying current is key.

• Invest in cyber security software

Consider investing in reputable cyber security software that can help detect and mitigate threats in real-time (we can help with this).

• Back-up your data

Regularly back-up your data and store it in a secure location. In the event of a cyber attack, having backups can help minimise downtime and data loss.

When it comes to cyber security, it’s better to be safe than sorry. If we can help you to stay better prepared, get in touch.