Short, practical notes on running IT in a design or construction practice. Security habits, Microsoft 365, and the news that actually affects you.
RingCentral was breached through social engineering in July. The leaked data is exactly what a scammer needs to impersonate your phone provider's support desk.
Meeting titles can leak client names, tenders, interviews and site visits. Open your calendar as an outsider would and check what they can see.
A short power cut can take down your router, firewall, switches and server. A UPS keeps them running through a blip, or gives a server time to shut down cleanly.
Sheets canvas uses Gemini to turn a spreadsheet into an interactive dashboard or project board, kept in sync with the underlying data.
Putting everyone in To or CC exposes your client list and invites reply-all. BCC fixes both, and for regular mailings a proper platform is better still.
If the admin login for your accounting software, domain or Autodesk account is tied to one person's email or phone, the business doesn't control it. Here's the checklist.
Read it before you switch it on. Where you are, when you're back and who's covering the confidential project is everything a scammer needs.
The FBI has confirmed a case that has been hitting private companies for years. If you hire remote technicians, identity checks come before equipment and access.
When someone clicks a bad link, DNS filtering checks the address against known phishing and malware sites and blocks it. It's cheap, quiet and works off-site too.
A current network diagram is the difference between a ten-minute fix and a day of guesswork. Here's what it should show and where to keep it.
Ever spotted the wrong name a second after clicking Send? A delay of a minute or two gives you time to pull it back.
The UK's criminal records office had security software raising alerts. Nobody investigated them. The ICO's findings read like a checklist for any business that outsources IT.
An old remote access tool or a forgotten test server stays reachable long after anyone needs it. An external scan lists what's exposed.
Someone else needs to know your providers, where the documentation is, which systems are critical and how to get back in during an emergency.
Anyone can download software onto a work laptop. Allowlisting flips that: only approved programs run, and everything else waits for a yes.
Researchers re-tested 10,616 leaked AWS access keys. 88% still authenticated, and hundreds gave full admin control. Deleting the file that leaked them isn't enough.
Do your staff know what they can share? Public, internal and confidential covers most of it, as long as confidential comes with rules.
A rectangle hides words from view. The text is still in the file, searchable and copyable. Use a real redaction tool and test the result.
Photos carry GPS locations. Office files carry authors, comments and tracked changes. Check the metadata before anything leaves the practice.
A US provider's routers can now sense motion through Wi-Fi and may share that data with third parties. It's a useful reminder for any smart feature in an office or home office.
If every administrator in your Microsoft 365 tenant is locked out at once, who gets you back in? Microsoft's answer is emergency access accounts, and it recommends at least two.
A second broadband line or a 4G/5G connection on the router keeps phones, payments and cloud systems running. Test it before you need it.
Sign into Chrome or Edge with a personal Google or Microsoft account and your work bookmarks, history and saved passwords sync to it. Use a work profile.
Fake meeting links, invoices and shared documents arrive as invites too, often under a name you recognise. Check the organiser's full address before opening anything.
An attacker inside an employee's mailbox can send the request from their real address. Call back on a number you already hold, and have a second person approve.
Confirmation of Payee, dual authorisation and payment limits are usually free. Ask what your business account supports and switch them on.
Allow a website or app to use your camera once and the permission stays until you remove it. Windows and your browser both keep a list; check them.
An equipment inventory is a Cyber Essentials requirement and the starting point for every upgrade, insurance claim and leaver process.
Bigger clients and frameworks increasingly send a security questionnaire before signing. Keep the evidence in one place and never claim a control you don't have.
Note-takers record audio, transcribe it and store the summary in someone's cloud account. Decide which tools, which meetings and who can see the output.
New-job posts, job adverts and project updates reveal names, roles, software and clients. Search your company name and look at it as an attacker would.