• 16 November 2025, 11:38 AM

Category Archives: blog

The Case for a Cloud Email Security Supplement

Top 10 Email Security Tips

Email security involves using different tools and tactics to help identify and filter out potential harms and attacks. Without protection, emails are essentially open and free for hackers and other malicious users to snoop and poke around in. While the best way to ensure email security is to enlist the help of a full stack security service, users can help improve their protection by following these email security tips.

Understand Cyber Crime

Cyber crime comes in many shapes and forms, ranging from harmless pranks to company bankrupting crime. BEC (business email compromise) attacks should be considered one of the biggest threats to businesses today. They have cause billions in company losses and continue to evolve and multiply at an alarming rate.
The first step in defense against cyber criminals, is a clear understanding of the various types of malware, ransomware, viruses, and phishing attacks. Each of these target a specific type of user and require different precautions to be taken to avoid infection.

Use a Strong Password

As far as email security tips go, password creation and security have always dominated the conversation, for good reason. The importance of a strong account password can not be understated when talking about email security. Passwords should always be over eight characters, include of mix of lowercase and capital letters and number, and never be easy to guess (i.e. town of birth, pet’s name, favorite band).
For further protection, users can implement a password management system, such as KeePass, or enable 2-factor verification.
Control Who Has Your Email
Email addresses are used for almost everything on the web now, but that doesn’t mean user’s should just hand theirs over. The more public an email address is, the more likely it is to be targeted for an attack by hackers. User email addresses are also exposed to attacks through the email lists that are collected and compiled by companies and businesses. This leaves the security of the user’s email address to the company, which may or may not be completely secure.

Protect Your Sent Emails

The path email takes when sent, is not direct, the email will go through 3rd party servers on it’s way to it’s destination. Anyone along this route is able to look at or edit the original email without the sender’s knowledge and can lead to serious data and information breaches.
To protect against unwanted snoopers, users can use a range of tactics and email security tips. One of the most applied method is the enabling of TLS encryption. TLS adds an additional layer of protection to email and stops hackers from being able to read the content of the email. If TLS can not be enabled, or the destination server doesn’t have TLS enabled, emails will continue to be unsecured and the user should be cautious.
In general, user’s should protect their email attachments with passwords or by placing them in a zip file. This ensures the user’s files can not be tampered with or infected on the path to it’s destination regardless of if TLS is enabled.

Enlist an Email Security Service

Email security is nothing to take lightly, especially when the number and sophistication of these cyber attacks are increasing. Email security companies use filters and other tools to help sift through email looking for spam and potential attacks.
The biggest advantage of enlisting an email security solution is the ability to combat both known and unknown attacks. Security software, such as antivirus, use data from previous versions attack to identify and defend against it; they can not identify or stop new attacks.

Know What Your Opening

The majority of cyber attacks happen through email as it is the easiest way onto a user’s computer. Proper education and training should be completed by anyone who interacts with email on a regular basis. Hacker tactics are getting more advanced and authentic looking by the moment, so user’s should always be aware of how to detect a malicious email and what to do if they receive one/open one by accident.

Be Wary of Public Connections

One of the lesser known email security tips is to avoid the use of public devices and connections. Public computers and hot spots can be tempting for those users on-the-go, but their unsecured nature makes them a hotbed for cyber attacks.
When a user logs onto a public computer they are completely unaware of who and what has been on that device in the past. While the machine may appear normal to a user, there could be unsavory programs installed such as keyboard logger, waiting to collect credentials.
Hackers use public hot spots as a way to lure in unaware victims, once connected, these victim’s computers become completely accessible. Once they have access, the hacker can view the computer’s information, lead the user to phishing sites, or trick them into downloading malware or ransomware.
The best way to stay safe in public is to avoid open connections and shared computers.

Restrict What You Put Online

Social media is one of a cyber criminals favorite hacking tools. Hackers research social media accounts get vital personal information directly from profiles and self written bios. This information helps hackers to bypass the account security questions like “what is your mother’s maiden name,” used by official institutions, banks, and government agencies.
It may be impossible to protect all personal information while online, but users should still be careful about what information they share.

Back Up Your Information Regularly

One of the greatest email security tips a user can receive is to frequently back up their data.
Ransomware attacks are becoming more and more popular, mostly due to the high ROI the attack awards the hacker. Once installed, these attacks start by scanning through the user’s computer, selecting files and encoding them. When encryption is complete, the user is notified that their files are being held for ransom and the user must pay a fee to get the key.
This type of attack can be severely detrimental to a user, leaving them with nothing more than shell of a computer. After the files are encoded, user’s are left with an option to pay the ransom or to lose all their data, which may not be possibility for a user/company.
Backing up information on a consistent basis is the best and easiest way to protect oneself from a ransomware attack. Since the user will already have a backed up version of their information, there will be no need to stress over the encryption or pay the ransom.

Stay Safe on Mobile

Although not publicised as much as desktops, mobile phones can and do, still get attacked. A user’s phone is not only vulnerable through email and phishing sites, user’s must also be wary of the apps they are downloading. While Android devices are more likely to be attacked, iPhone users should also be cautious to ensure safety. Be sure not to visit any potentially dangerous sites or download any unknown attachments with out putting in place other security strategies.
o365 backup

6 Reasons Why Office 365 Backup is Critical

While you are reading this, you may be thinking “Doesn’t Microsoft take care of Office 365 backup?”
It’s important to remember that SaaS platform providers, like Microsoft Office 365, take on the responsibility of application uptime and the underlying infrastructure. But it is the customer’s responsibility to manage and protect their vital business data.

We’ve identified 6 reasons why backing up Office 365 is critical:

  1. Accidental deletion: If you delete a user, whether you meant to or not, that deletion is replicated across the network. A backup can restore that user, either to on-premises Exchange or Office 365.
  2. Retention policy gaps and confusion: Office 365 retention policies are hard to keep up with, let alone manage. A backup provides longer, more accessible retention all protected and stored in one place for easy recovery.
  3. Internal security threats: Many businesses are experiencing threats from the inside, and they are happening more often than you think. Having a high-grade recovery solution mitigates the risk of critical data being lost or destroyed.
  4. External security threats: Malware and viruses have done serious damage to organisations globally in just the past year alone. A backup can easily restore mailboxes to an instance before the attack.
  5. Legal and compliance requirements: Ensure you can retrieve mailbox data during legal action and to meet any regulatory compliance needs.
  6. Managing hybrid email deployments and migrations to Office 365: Whether you are migrating to Office 365 or have a blend of on-premises Exchange and Office 365 users, the exchange data should be managed and protected the same way, making the source location irrelevant.

It is always nice to hear how our customers and partners are validating our solutions. IT Manager at Egelim Lojistik A.S.
Before this product I thought my emails were safe. Now, I am sure they are safe.”
Every customer can be confident that as they move to the cloud and expand their infrastructure, Veeam is there to protect and ensure Always on Availability.

Read the May 2017 Gartner Report: Adopt Microsoft Office 365 for Damage Control and Fast Recovery After Malicious Attacks. We believe this Gartner report can provide more information on Office 365 Backup.

 

 

disaster recovery plan

Do SME’s Really Need A Disaster Recovery Plan?

When it comes to keeping your business running, it’s important to have plans in place to deal with both good and bad times ahead.

Business continuity plans and disaster recovery plans are an excellent way to ensure the protection of your organisation, however, it’s easy to get the two mixed up. Many people assume that because they have implemented a business continuity plan (BCP) they do not require a disaster recovery plan (DRP), and vice versa.

It is true to say they are very closely linked, but to briefly explain; BCP’s take a more proactive approach to minimise and avoid the risk of downtime, whilst DRP’s focus on recovering from the disaster.

In this article we will look specifically at the business continuity plan, why it’s a good idea and why you should have one.

Generally people do not enjoy paperwork, and business owners understandably will see a business continuity plan as just another tedious task to complete that will probably go unused; so here are a few interesting facts which could highlight the importance of a BCP.

On average, a medium-sized data centre will experience over three downtime events each year, with the average power cut lasting over 3.5 hours. Source: Eaton UK

Some 77 per cent of UK organisations (approximately 4.2 million) experienced connectivity failures in 2016. On average, UK organisations were also found to have suffered 4-5 outages each during 2016 and a wait of six hours every time for service to be restored. Source: ISP Review

Just over half (54 per cent) of UK companies have been hit by ransomware attacks resulting in variable amounts of downtime (58 per cent of UK companies pay up to get access to data and systems again.) Source: Malwarebytes

Almost all (97 per cent) of network professionals in a survey by Veriflow agree that ‘human error’ is the most common reason for network outages. Source: Network World

Depending on your company’s area, losing vital business systems could ultimately cost you customers, because your existing customers could choose to go elsewhere. In addition to this the damage to your reputation and the lack of credibility if there is no BCP in place could be extremely costly!

Hopefully the above has persuaded you to think about the importance of having a business continuity plan so in the event of a power cut, connectivity issues, network outage or cyber-attack your business can ride the storm and get back to business as soon as possible.

If you’re under the impression that a disaster is unlikely to happen to your business, you might be mistaken. It could be something as simple as a staff member keeping watch of an absent colleagues emails whilst they’re on holiday and accidentally opening a cleverly presented, yet malicious, email. If that email contained ransomware, and the attack was successful, it would only take a few seconds for all the files on the computer and everything else connected to it – namely the server – to be encrypted.

Before you know it, your network is unavailable, staff are unable to work, and a disaster recovery plan is vital. In addition to downtime, failing to have a business continuity plan in place could cost a business severe reputational damage, and it could even raise certain compliance issues.

When you’re busy running a business, it could be easy to forget that you are a prime target for cyber hackers, and many have made the mistake of assuming that these hackers are only interested in going after bigger organisations. But, the fact is that when you’re an SME, your cyber defences are easier to hack, reason being you will not have the same budget available to you to spend on cybersecurity as a larger business, and attacking a small company carries a much lower risk than attempting to infiltrate a larger organisation, as the cyber criminals are less likely to be caught.

Not to mention, hackers know that a small business is more likely to pay a ransom to have files decrypted quickly, so that business can get back to normal and downtime can be minimised. That’s why it’s essential that you have a robust Business Continuity Plan in place, so you can avoid these situations, and deal with them swiftly should the need arise. Below, I outline the key aspects you should take into consideration when creating a BCP.
Key considerations for a Business Continuity Plan

  • Key business functions – what is going to cost your business the most if they are affected by an IT outage or system downtime?
  • Minimise the risk – what could be done to avoid critical business functions being affected by downtime, implement preventative solutions such as cyber awareness on risks/threats, staff education and network monitoring,
  • Recovery times – what could you do to reduce the time taken to get critical business functions operational again? As a suggestion, increase the frequency of backups for critical data.
  • Failover plans – what could you do to get important business functions operating during an incident? For example, if your head office suffered a power cut could staff work from another location?

Do you require more information?
Read more about the options we offer here
Alternatively, please feel free to contact us

managed services provider

5 signs you need to change your IT Service Provider

No matter what kind of business you run, IT issues come up from time to time. This is why you partnered with an IT Service Provider. Right?.. So, you don’t have to worry. But, are you worried?

Are you facing recurrent IT issues despite this? Are you facing outages that are taking longer and longer to fix? or in the case of an issue, have you found it hard to get hold of someone to deal with it?

If you can’t answer these questions satisfactorily, it may be time to change.

An able IT Service Provider will use best-in-class people, tools and technologies to deliver the best solutions. They will take a proactive approach to be able to detect and solve problems before they arise. They will also prevent the likelihood of issues happening again.

Here are five tell-tale signs that might make you think, do you need to change your IT Service Partner.

1) Your IT Service Partner Has Slow Response Times
Any business can be faced with server crashes and internet outages. However, when it does, your provider should be on it immediately. If it takes a long time for your provider to respond, you are potentially faced with a severe loss of production and money.

2) Your IT Service Partner Does Not Have 24/7/365 Monitoring
Most company employees may typically work 9 to 5, but your network and your data never sleeps. As such, your solution provider must be round-the-clock too. Your provider must have the correct blend of remote and on-site personnel available at all times of the day and night to give you proactive 24/7/365 monitoring services.

3) Your IT Service Partner Does Not Provide Data Backup
Any business will run dead without its data. How long could you business survive if you lost your data or it was compromised?  Our guess would be, not very long. Your provider should have ironclad data protection and secure data backup plans for you.

4) Your IT Service Partner’s “Strategic Guidance” Sounds More Like A “Sales Call”
The correct provider for your business can double up as a virtual IT Director. Many organisations have rudimentary knowledge of enterprise IT systems, and as such outsource their IT. However, due to bad business practices, many providers use this as an opportunity to milk more out of their clients. Stuck with unnecessary expensive upgrades to your software you hardly use? Your provider might just have tricked you.

5) You Have Outgrown Your IT Service Partner 
Sometimes, your provider might struggle to provide you with the best support, despite their best efforts. This might not always be their fault. Maybe, your company outgrew your provider. Maybe, they just don’t have the manpower or access to the latest technologies that you need to sustain and better your own growth. It might be time to part ways with your provider.

cyber attack

What is it like to be the victim of a cyber-attack?

What should you do to protect your business from further damage?

Should you pay that ransom demand? – Here’s a scenario based on real-life experiences.

Scenario

IT staff at fictional High Street Solicitors firm Graham Solicitors head office have been caught by a phishing email. A member of staff clicked on a link to a spoof website because they thought the email looked genuine. It wasn’t. That was two months ago. Today, is when it all goes wrong…

Tuesday 09:00

Mick Rayall, Graham Solicitors’ IT administrator, began his day clearing the company’s email inbox of the usual junk, but one message stands out. His heart stops.

“We have more where this came from. We will contact you shortly with our demands,” further down the message is someone’s name, email address and credit card details.

Mick hopes it’s a hoax, but can’t take the risk. He calls the companies security officer, Steve Richardson. Steve isn’t impressed as he’s on holiday in America where it’s 4:00am.

“This had better be important,” he sneers. Mick forwards the suspect email.

“Have we checked the credit card number?” Steve asks, with tension and sincerity in his voice. “Is it one of our customers?”

“When did we get this?” Steve snaps.

“Er, it would appear we got it yesterday just after work, so I didn’t notice it until first thing this morning.”

“So we are 12 hours into this?”

“Er, yes,” Mick mumbles sheepishly.

Tuesday 14:30

“We’ve just got a second email come through,” Mick tells Steve. “It’s a ransom demand for £15,000 in the Bitcoin crypto-currency. We have to pay by 21:00 BST or they are going to delete all of our customer records.”

“What?” shouts Steve. “I thought you told me they only had one?”

“Er, no. They are claiming to have them all.”

In a cold sweat, Steve calls Graham Solicitors’s legal counsel Margaret Greaves for advice. She has to dial in several times as her headset isn’t working properly. Her voice keeps dropping out during the conversation.

“It looks like there is a potential breach,” she says. “Don’t respond to that message. I’ll need to review our existing legislation so we know where we stand.”

“What about the police?” asks Steve, his holiday now thoroughly ruined. “Who are we going to notify?”

Tuesday 15:30

Things are rapidly spiraling out of control for Graham Solicitors. The hackers have sent a sample of customer names and credit card numbers they hold.

Steve has now confirmed that the sample is genuine.

“How about if we shut down the website?” asks Mick. “Then we can limit the risk.”

Margaret butts in. “Before we do that, who should we tell first? What’s the data breach policy?”

“I thought that info came from legal,” says Steve.

“Aren’t you in charge of data protection?” Margaret asks Mick.

“Nope, not me…”

“Oh no, is it me?” asks Steve dispiritedly. “Anyway, if we take down the website that’ll just draw attention to ourselves won’t it? I’m not sure if that’s the right thing to do.”

“Me neither,” says Margaret.

Graham Solicitors’ head of public relations, Katie Ellis, has been called in to the situation.

“This is not good,” she exclaims rather obviously. “We didn’t protect our customers’ private data. There’s a chance we’re gonna get hammered for this.”

She points out that the company has a promotion running on the website currently.

“We’re driving people to the website right now. What about their details? Are they being stolen too?”

“Quite possibly,” says Steve. “We’ve got to shut down the site – or the eCommerce side of it anyway. And then we’ve got to decide whether or not to pay their ransom.”

Tuesday 17:30

Katie Ellis has drafted a public statement but doesn’t propose releasing it until people start asking questions.

“We can just say we are experiencing an incident and do it reactively,” she says.

“No – not an incident – a breach,” Steve advises.

“Don’t use the word ‘breach’ – not yet anyway,” Margaret pipes in, thinking of the legal ramifications. Mick bursts in on the conference call.

“We’ve found some malware! We had an email come in that went to in to quarantine, we checked it out and it has an attachment. That could be it.”

“Ok, you haven’t clicked on it have you?” asks Steve, his day rapidly going from bad to worse.

“Er… I just thought it would speed things up…”

Steve swears and drops out of the call to get his security staff to check for any more damage.

Margaret turns the conversation to informing the Information Commissioner’s Office.

“We can report it online or phone them,” she tells them. “But we need to say what we did to reduce the problem.”

“We were supposed to get new threat detection software last year, but we never got round to it so it wasn’t replaced,” says Mick. “It just didn’t happen – I never got to do it.”

“Well don’t tell I.C.O. that,” Margaret shouts. “If we can’t show we have satisfactory controls in place we could be in a bit of trouble. And the cyber-insurance firm might not pay out.”

Later, Steve confirms that most recent phishing email turned out to be a red herring, but tells the team: “We’ve found a phishing email sent two months ago that was linked to a log-in page made to look like the one for our online backup provider. That’s how they got in.

“Ok, we have to handle things better from now on,” Steve concludes. “There’s no doubt in my mind that this will happen again, and it’s only going to get worse.”

So what should Graham Solicitors have done?

Reacting late has put Graham Solicitors on the back foot. You need to move very quickly in these situations otherwise the Cyber attackers will decide the pace.

A poor understanding of data breach laws made the business vulnerable. They obviously did not have a breach policy in place nor did they know who was responsible for each role.

The firm should have:

  • prepared a cyber-security breach plan with step-by-step actions to take
  • rehearsed this plan with staff
  • decided who is responsible for what during a breach
  • notified third-parties and suppliers
  • BE PROACTIVE -partner with an IT Cyber Security specialist for proactive support in the event of a breach
  • refused to pay the ransom – there is no guarantee the data would be given back.

And if your firm is the victim of a data breach:

  • identify where the incident came from
  • contain infected devices (get them offline)
  • assess how many machines have been affected
  • restore lost data from back-ups
  • BE REACTIVE – partner with an IT Cyber Security specialist to make sure this doesn’t happen again.