Push-bombing: when the MFA prompt is the attack
Three clients in a fortnight have had staff approve a sign-in they did not start, because the phone would not stop buzzing. Here is what it looks like and the one setting that ends it.
A backup you have never restored is a rumor
Every organization we meet has backups. About half of them have backups that work. The only way to find out which half you are in is to restore one, on purpose, on a quiet Friday.
Seven things every first audit finds
After enough first audits you can write most of the report before you arrive. These are the findings that turn up nearly every time, in roughly the order we find them.
Office printers with their admin pages open to the internet
During assessments this quarter, one office in five had a multifunction printer reachable from outside, default password intact, address book full of staff email addresses.
The offboarding checklist nobody owns
Hiring has a process because a new person with no laptop complains. Leaving has none because a departed person with too much access says nothing at all.
What actually happens when we call you at 3am
We promise that if something moves in the night, a person you have met will phone you. People reasonably want to know what that call is like. Here is one, start to finish.
Rolling out a password manager to twelve people who hate change
The software is the easy part. What decides whether it sticks is the first fortnight, and whether the most senior person in the room is seen using it.