SPF, DKIM and DMARC: stop attackers from sending email in your company's name
Fake invoices and "urgent" messages from the director are among the most common attacks. Three DNS records make them much harder.
Read articleWhen we investigate incidents, the story very often begins the same way: a password was guessed, reused from a leaked website or typed into a fake login page. After that the attacker simply logs in — no hacking tools required. Strong passwords and multi-factor authentication (MFA) stop most of these attacks and cost almost nothing.
What makes a good password
- Long rather than complicated. A passphrase of four or five random words is easier to remember and harder to guess than a short string of symbols.
- Unique for every service. If one site leaks, the other accounts stay safe.
- Never shared in messengers, emails or on sticky notes.
Use a password manager
Nobody can remember dozens of unique passwords. A password manager generates and stores them, fills them in only on the correct website (which also helps against phishing), and lets a team share access safely with logging. For companies, choose a business version with central management, so access can be removed when an employee leaves.
Turn on MFA everywhere it matters
- Email and Microsoft 365 / Google Workspace.
- VPN and remote desktop access.
- Banking, accounting and 1C access from outside the office.
- Administrator accounts, firewalls, backup consoles and cloud panels.
Prefer an authenticator app or a hardware security key over SMS codes. Teach employees never to approve a login request they did not start — attackers sometimes send many requests hoping for one tired click.
Do not forget service accounts
Default passwords on routers, printers, cameras and servers are one of the easiest ways in. Change them during installation, store them in the password manager and review them regularly.
MFA turns a stolen password from an open door into a useless string of characters.
CySec helps companies roll out password managers and MFA for all users and systems, without stopping daily work.
Frequently asked questions
Is SMS good enough as a second factor?
It is much better than no MFA, but SMS can be intercepted or redirected through SIM swapping. Authenticator apps, passkeys or hardware keys are stronger.
Should we force employees to change passwords every 90 days?
Current guidance from standards bodies recommends against regular forced changes. Change passwords when there is a sign of compromise, and require long unique passwords plus MFA.
Which password manager should a company use?
Choose a business edition with central administration, shared vaults, audit logs and the ability to remove access when someone leaves. Popular options include Bitwarden, 1Password and Keeper.
What are passkeys?
Passkeys replace passwords with a cryptographic key stored on your device and unlocked with a fingerprint, face or PIN. They cannot be phished like passwords and are supported by Microsoft, Google and Apple.