Showing 37–48 of 121 articles
Page 4 of 11
Change the default passwords on network appliances
A device may have separate credentials for administration, monitoring, support, and cloud services. Review all of them before deciding that the factory access has been removed.
Read the visual guide
Staging sites that are still open on the internet
A staging site can contain production data and powerful integration credentials. Keep its access and outbound behavior deliberately separate from the live service.
Read the visual guide
An open-source licence is not a security review
Being able to inspect source code is valuable, but it does not prove that a component has been reviewed or is safe for your use. Assess the actual dependency and its operating context.
Read the visual guide
How to handle a security report from someone you do not know
A report from an unfamiliar person may identify a real issue. Provide a controlled route to receive it, assess the evidence, and decide the next step without encouraging unnecessary testing.
Read the visual guide
How a support desk should handle a caller who sounds legitimate
Knowing an employee’s name, manager, or urgent problem does not prove identity. Use an approved verification process before resetting access or changing recovery details.
Read the visual guide
Why two people should approve a payment
A second approval helps only when it independently checks the important details. Tie the review to the actual beneficiary, amount, and transaction that will be released.
Read the visual guide
Treat domain renewal as a security control
An essential domain depends on working ownership, billing, recovery, and renewal arrangements. Check those dependencies while the service is healthy, not after it disappears.
Read the visual guide
Who should be allowed to change your DNS records
Control of DNS can affect email, websites, and other essential services. Identify the registrar, DNS host, privileged users, and applications that can change records.
Read the visual guide
Printers and cameras that still have an open admin page
An office appliance can hold credentials, send documents, and expose management features. Treat it as a managed system with an owner, support status, and limited access.
Read the visual guide
Work data on phones the company does not own
Bring-your-own-device arrangements need a clear boundary between work information and personal use. Agree what may be stored, what controls apply, and what happens on loss or departure.
Read the visual guide
What to do when a password is pasted into chat
Deleting a chat message does not invalidate a password or token that someone may have copied. Identify the credential, revoke or rotate it, and review its possible use.
Read the visual guide
What encryption at rest and in transit each protect
Storage encryption and connection encryption protect different parts of a data journey. Neither replaces the decision about who can ask the service to reveal the information.
Read the visual guide