XpressteX

Saving passwords in Chrome is one of the riskiest habits you could have today.
Chrome stores them in a way that's easy to steal.
Anyone who gets onto your computer can pull every saved login in seconds.
Malware called infostealers (names like Redline, Lumma, and Vidar) does exactly that.
Once it's on a machine, it copies every saved password and sells them online within hours.
The fix takes about 10 minutes. Sign up for a real password manager. 1Password,
Bitwarden, and Dashlane all work, and Bitwarden has a free tier that's actually good.
Use the built-in import tool to bring in your saved Chrome passwords.
Then go into Chrome's settings (Settings > Autofill > Password Manager), delete every saved
password, and turn off "Offer to save passwords."
A real password manager costs around $3 a month per user. Chrome's free one could
cost you your business.

Your website is online all day, every day, and most owners never think about its
security.
You don't need to be a security expert. Here's what to check:
1. Make sure your site uses HTTPS, the padlock in the browser bar. It's standard now,
and visitors (and Google) treat sites without it as untrustworthy.
2. Keep the software behind your site updated. If you're on WordPress or similar,
outdated plugins are the number one way these sites get hacked. Set them to update
automatically or have someone check monthly.
3. Lock down the admin login. A strong password, MFA, and don't use "admin" as
the username. It's the door attackers try first.
4. If your site has contact or signup forms, make sure they're protected against spam
and abuse, and that anything customers enter is sent and stored securely.
If a web designer built your site and then disappeared, it's worth having someone do
a quick once-over. A hacked website can serve malware to your own customers
without you ever knowing.
26

You got ransomware and your files are locked.
Now what? Do you pay or not? Before you send a cent, keep in mind that paying the hackers doesn't guarantee you'll
get your files back.
And in some cases, paying them can even break the law.
So start with your backups.
Check that they're working and that you can restore your systems yourself.
If you can, you might not need to pay at all.
Sort this out with your IT provider before it ever happens, not in the middle of an
attack.

These devices have a limited shelf life. Once a certain point passes, they stop getting
security updates.
And no security updates means a higher chance of getting hacked.
So do this:
1. Ask your IT provider for a list of your network gear, with the model and whether
it's still getting security updates. Anything past end of life should be on a replacement
plan.
2. Don't only think about the firewall. Old switches, access points, even that ancient
backup router count too.
3. When you buy new gear, check the support timeline, not just the price. Cheaper
hardware sometimes hits end of life years sooner.

Deepfakes have gotten good enough that the face on a video call might not be the
real person.
There have already been cases where an employee joined a video call with what
looked like their CFO and a few colleagues, all of them fake, and got talked into
wiring out a fortune.
Faking a familiar face and voice on a live call keeps getting cheaper and easier.
24
If someone on a call is pushing you to move money or hand over access fast, verify it
another way before you do anything.
Call them back on a number you already have, or ask them something only the real person would know.
It feels awkward to second-guess your own boss on a call.
But a good boss would much rather you check than get fooled. Make "always verify money requests" a
normal rule, so nobody feels weird doing it.

You're probably holding far more customer data than you need, and all of it is
something a hacker can take if they get in.
You've got old spreadsheets of card numbers, customer files from people who left
years ago, exports you pulled once and forgot about.
It's all just sitting there, and if you don't need it, it's just something for a hacker to steal.
So keep less.
Go through where you store customer info and delete what you've got
no reason to keep, old payment details first.
Set a sensible limit on how long you hold
different records and stick to it.
Your accountant or lawyer can tell you the minimums you're legally required to keep.
And watch the copies, because the spreadsheet someone saved to their desktop is just as easy to steal as the main system.
You can't lose what you don't have.
Every file you clear out is one less thing to worry about if you're ever breached.

Attackers don't always need your password. A lot of the time they just go to the login
page, click "forgot password," and reset it themselves.
That reset usually runs through your recovery email, your phone number, or those
security questions like your mother's maiden name or the street you grew up on.
A lot of that is easy to dig up on social media or in old data breaches.
If someone can answer your security questions or get into your recovery email, your strong password
and MFA don't matter.
Do this:
1. Make sure the recovery email and phone number on your important accounts are
current, and protected with their own strong login and MFA. Your email matters most
here, because whoever controls it can reset your other accounts.
2. When a site lets you, skip the security questions, or treat them like extra
passwords. Make up an answer that isn't real and save it in your password manager.
3. Check the recovery details on your main business accounts now and then,
especially after someone leaves, so an old personal phone number isn't still sitting
there.
The reset process is one of the most overlooked ways in. Ten minutes on your key
accounts closes it off.

Found a USB stick in the parking lot? Don't plug it in to see what's on it.

The second you plug in a dodgy USB drive, it can load malware, or even act like a
keyboard and type out commands on its own, faster than you could.
Do this:

1. If you didn't buy it, don't trust it. A USB drive you found goes in the bin, not into
your laptop.
2. Ask your IT provider to block USB drives on the computers that don't need them,
or to only allow ones you've approved.
3. Share files through the cloud instead of passing memory sticks around, so
nobody's in the habit of plugging in whatever's lying about.

And if you do keep sensitive files on USB drives, use encrypted ones, so a drive going
missing doesn't turn into a data breach.

Everyone's careful with their laptop, but the phone in your pocket has the same
company email and files on it, plus all your saved logins. It just doesn't get the same
attention.
Here's what to check:
1. A screen lock on every phone that has work stuff on it, with a real PIN, fingerprint,
or face unlock. A lost phone with no lock is wide open.
2. Automatic updates left on. Phone makers are constantly fixing security holes, and
an old un-updated phone is full of ones attackers already know about.
3. Apps only from the official App Store or Google Play. The ones you install from a
random link or website are a common way to pick up malware.
4. A way to wipe a phone if it goes missing. Microsoft 365 and Google Workspace
can both erase the company data off a lost phone, as long as it's set up beforehand.
If your team uses personal phones for work, you can keep the company side separate
from their personal stuff.
Your IT provider can set up a space that holds just the work email and files, which you can lock or wipe on its own without touching anything personal.

If your team is juggling a different password for every app they use, there's a simpler
setup, and you might already be paying for it.
It's called single sign-on.
Everyone logs in once, through one secure account, and that
gets them into all their work apps without a separate password for each.
It's also safer.
Everything runs through one account, so when someone leaves, you
switch off that one login and they're locked out of everything at once.
No more trying to remember every app they ever touched.
You also turn on MFA once, in that one place, instead of hoping it's switched on in every app separately.
Microsoft 365 and Google Workspace both come with single sign-on built in, so
there's a good chance you already own it. Most of the apps your team uses can hook
into it.
Ask your IT provider what it'd take to get your main apps running through it.
Fewer passwords floating around means fewer chances for one to leak.