Practical advice on security, recovery, AI and cloud.
Drag the ring, use the arrow buttons or the left and right keys. Click the highlighted front card to open it.
Cyber security
Passwords alone are the easiest thing for an attacker to steal or guess. MFA blocks most account takeovers.
Start with email, admin accounts and remote access.
Prefer an authenticator app or passkey over SMS where possible.
Review sign-in logs for accounts without MFA.
Leaving old protocols or service accounts outside the MFA policy.
Cyber security
Most attacks use known flaws that already have fixes.
Set a regular patch window for endpoints and servers.
Fix critical and high CVSS findings first.
Track exceptions with an owner and a date.
Patching workstations but forgetting servers, firewalls and third-party apps.
Cyber security
Phishing remains a common way into a network.
Do not click or open until you verify the sender another way.
Report the message using your reporting button or to IT.
Use email security filtering for links and attachments.
Deleting the message silently so nobody else is warned.
Cyber security
Admin rights are what attackers want. Fewer admins means a smaller blast radius.
Give people only the access their role needs.
Use separate admin accounts and rotate privileged credentials.
Review admin accounts on a schedule.
Keeping admin rights after a project or role change.
Backup and recovery
One copy of your data is not a backup plan.
Keep three copies of important data.
Store them on two types of media.
Keep one copy offsite.
Storing the backup on the same server or network share as the original.
Backup and recovery
Ransomware tries to encrypt or delete backups it can reach.
Use immutable storage or an offline copy.
Separate backup admin credentials from daily admin accounts.
Alert on backup deletion attempts.
Assuming a network-connected backup is safe from ransomware.
Backup and recovery
A green backup job does not prove you can recover.
Restore a sample file and a full system on a schedule.
Record how long the restore took.
Fix and retest anything that failed.
Finding out during an incident that the backup was incomplete.
Backup and recovery
Recovery time objective (RTO) is how long a system can be down. Recovery point objective (RPO) is how much data you can lose.
List your key systems.
Agree an RTO and RPO with the business for each.
Check that backup and failover design actually meets them.
Setting targets that the current backup frequency cannot meet.
AI at work
Text pasted into public AI tools may leave your control.
Decide which data classes are never allowed.
Provide an approved AI tool for staff.
Tell staff the rule in plain words and repeat it.
Banning AI with no approved alternative, which pushes use out of sight.
AI at work
Data loss prevention finds sensitive data in motion and at rest.
Classify data (public, internal, confidential, restricted).
Set policies for uploads, paste, email and removable media.
Review incidents and tune rules.
Turning DLP on in block mode with no testing, then disabling it after complaints.
AI at work
AI can sound confident and be wrong.
Treat output as a draft.
Check figures, sources and legal or contract text.
Review and test AI-written code before use.
Sending AI-written content to customers without a human read-through.
AI at work
An assistant can only leak what it can reach.
Apply least privilege to connected data and tools.
Use sensitivity labels so restricted content is excluded.
Log and review agent actions.
Giving an assistant access to everything for convenience.
Cloud and devices
Unmanaged devices are blind spots.
Enrol laptops and phones in a device management tool such as Intune.
Require encryption, screen lock and updates.
Remove or restrict anything that will not enrol.
Allowing personal unmanaged devices to reach company data.
Cloud and devices
Access can depend on who, what device, where and how risky the sign-in is.
Require MFA for risky or unfamiliar sign-ins.
Allow only compliant devices to reach sensitive apps.
Block legacy authentication.
Excluding too many accounts from policy and forgetting the exclusions.
Cloud and devices
Cloud spend drifts upward quietly.
Review the bill and usage monthly.
Remove unused or idle resources.
Right-size what remains and use tags to assign owners.
Leaving test environments running after a project ends.
Cloud and devices
You cannot protect what you do not know you have.
List devices, software, licences and owners.
Update it when people join, leave or change roles.
Use it to plan renewals and replacements.
Keeping the inventory in a file nobody updates.
Tell us what you need and we will suggest a sensible next step.
Request a consultation