Showing 13–24 of 32 articles
Page 2 of 3
An open-source licence is not a security review
Being able to inspect source code is valuable, but it does not prove that a component has been reviewed or is safe for your use. Assess the actual dependency and its operating context.
Read the visual guide
How a support desk should handle a caller who sounds legitimate
Knowing an employee’s name, manager, or urgent problem does not prove identity. Use an approved verification process before resetting access or changing recovery details.
Read the visual guide
Why two people should approve a payment
A second approval helps only when it independently checks the important details. Tie the review to the actual beneficiary, amount, and transaction that will be released.
Read the visual guide
What encryption at rest and in transit each protect
Storage encryption and connection encryption protect different parts of a data journey. Neither replaces the decision about who can ask the service to reveal the information.
Read the visual guide
How to label data when you do not have a committee
A useful label changes how information is stored, shared, or retained. Keep the scheme small enough for people to apply and connect it to the tools they actually use.
Read the visual guide
How to run a short security exercise with eight people
A short exercise can reveal whether people know who decides, who contacts whom, and how recovery would begin. Use a realistic scenario and finish with a small, owned action list.
Read the visual guide
What a VPN does, and what it does not hide
A VPN protects a connection between its configured endpoints. Your traffic still reaches destinations, and the device, provider, and account choices remain part of the privacy picture.
Read the visual guide
How long a shared file link should stay open
A sharing link should serve a specific task and audience. Named recipients, suitable permissions, and an expiry date can reduce access that continues after the work is done.
Read the visual guide
How staff should report a suspicious email
People report more effectively when the route is easy to find and the response is clear. Ask for the message and what happened after it, without encouraging further interaction.
Read the visual guide
How to roll out a password manager to a small company
A team vault needs an ownership model as well as an app. Decide what is personal, what the organization owns, and how access will be removed when someone leaves.
Read the visual guide
How to remove access when someone leaves
A person’s access may extend beyond their main account. Use a planned sequence to protect information, close sessions and tokens, and transfer legitimate ownership without losing critical work.
Read the visual guide
Who can send mail as the company
Your domain may appear in messages from staff, marketing tools, websites, and finance services. Record each sender and connect it to an owner and an intended authentication setup.
Read the visual guide