The clocks have changed and the countdown to Christmas is most definitely on (53 days to go!). Whilst it might be tempting to think about coasting into the impending holiday period, unfortunately the cyber threats continue apace so this month we focus on dealing with the aftermath of an email hack and future-proofing your business’s domain.
Disconnecting the hackers from your email account
No matter how careful you are with your cyber security, there is always the risk that the hackers will pounce, so what can you do? Changing your password is an obvious first step but you can’t stop there. Whilst you might have removed one access point, the hackers could still be signed in through a browser or email app, have created a forwarding rule, connected an outside application, added a recovery method or given another account permission to use the mailbox. Until all those settings are checked, the attacker may still be able to read messages, receive copies of new email or regain access later.:
- Sign out of active sessions – sessions are used so you don’t have to enter your password every time you open the inbox. Ask your IT provider to revoke the account’s active sessions and sign-in tokens through the email administration tools. If you suspect malware has been installed, start the recovery from another device and thoroughly check the affected computer.
- Check mailbox rules and forwarding – the hacker may have implemented rules to forward emails to another address such as those that include target words such as “invoice”, “payment” or “password reset” or others that hide security alerts or customer replies. Review forwarding addresses, inbox rules, filters and automatic replies and make sure your Microsoft 365 admin checks for hidden inbox rules.
- Review connected apps and mailbox access – scheduling tools, mobile apps and customer systems can be given permission to use an email account so remove any connected application the business does not recognise or use. Check mailbox delegates and sending permissions too as changing the mailbox owner’s password doesn’t remove that access.
- Check recovery and sign-in methods – make sure the affected employee confirms every phone number, recovery email address, authenticator app, passkey, security key and registered device and remove anything not recognised. Also review sent, deleted, draft, junk and archived messages, along with sign-in logs and security alerts checking for password resets, unusual payment requests and messages the employee did not send. If anything has been falsely sent to clients, suppliers or employees, contact them through a trusted channel to confirm what is genuine and what isn’t so appropriate action can be taken.
Whilst we all hope that the above actions won’t be needed, setting them out in a policy document means that should the worst happen, you know exactly what needs to be done and won’t waste any time before executing those actions.
Protect your business domain name
Your domain name is an essential part of your business set up, helping clients reach your website and contact your team. However, its registration can be somewhat taken for granted and you could be storing up problems for the future if you don’t have full control. For example, if your domain is held in an account controlled by an employee or supplier and that relationship ends, you could be dependent on them to renew, change or transfer the domain. Take action now to check whilst everything is working normally.
- Find the registrar and record which company it is – the registrar maintains the domain registration and for most typical ones, such as, .com, .net and .org the ICANN Lookup tool can help identify them though country-code domains might use their local registry’s lookup service. Note that your registrar may be different from your website host, DNS provider and email provider.
- Make sure your business controls the account – confirm someone in your business can sign in and see the domain whilst also checking you can update contact details, payment method, renewal settings and nameservers. The recovery details should belong to the business and be sure to store the password and recovery codes in the company password manager and require multifactor authentication. Note that the ability to access the website hosting account doesn’t necessarily include control of the domain registration.
- Check renewal details – a domain registration gives the registrant the right to use the name for a set period so make sure the registered organisation and contact information are correct along with the expiry date, auto-renewal setting and payment method (to avoid failed payments). Be sure that renewal reminders reach a monitored address.
- Review DNS access – DNS settings direct visitors to your website and tell email services where to deliver messages and any changes can interrupt both services, so make sure DNS access is under company control. Check you know who has authority to change it but don’t change any settings without consulting your IT provider!
- Create a domain policy – the account should be reviewed at least every year and whenever access changes to make sure that the expiry date, payment method and recovery options are correctly set up.
