Security is a big deal. I have been in the IT world for close to 30 years now, and things have dramatically changed, even in the past 5 years. The criminals are getting smarter, they are making phishing1 emails look more and more legit, and they are becoming more ruthless with our data.

Even MFA2 isn't foolproof anymore. In this article (New Mamba 2FA bypass service targets Microsoft 365 accounts), they talk about how a new "phishing-as-a-service" (Phaas) platform has become available to hackers that want to pony up the $250USD/month to use the service (and it is so lucrative, that there will be lots of hackers subscribing to it).

Now, I don't want to be the alarmist and say that everything you are doing is for naught, but I do want to point out, that while all of the security features we use  are necessary, and for the most part, when used in conjunction with each other, effective (and MFA is still a very good deterrent), we as humans need to be the last line of defense. We need to carefully consider each email to ensure that it is legit. Ask questions, like, "do I need to click on that link?", or, "is this email from someone I trust, AND, am I expecting an attachment from them?".

Vigilance on ours and our staffs' part is a key component to the defense against cyber crime.

As always, if you have any questions about anything in this newsletter, please do not hesitate to send me an email at [email protected]

Footnotes:

1. Phishing - either a text or an email that tries to look like a legitimate communication, often with a link or an attachment that has malicious purposes.
2. MFA - Multi Factor Authentication, sometimes referred to as 2 factor authentication (2FA), is a method of authentication that requires at least 2 components. An example is something you know (like a password), and something you have (like a fingerprint, or a one time code that gets texted to you, etc.)