Welcome to The Senroc Download! The month of October is Cybersecurity Awareness Month. This month we’re bringing you a special series dedicated to the many forms a cyber attack can take, how to detect them, and ways you can practice with your team. The end goal will be the start of your organizations incident response plan!

Almost every attack on a small business begins the same unglamorous way: someone types a real password into a page that isn’t real. Someone receives an email saying a document is waiting, a voicemail needs playing, an invoice needs approving, etc. The link opens something that looks exactly like the Microsoft or Google sign-in screen, but it’s not! Modern kits copy the real page live rather than imitating it.

Most people think the lookalike form stores their password to be used at a later time. What’s really happening is the page is passing what you type straight through to the real Microsoft login in the background. So when Microsoft asks for your authentication code, you get the prompt, you approve it, and everything works. You land on the real site. Nothing feels wrong. Meanwhile the attacker has captured the session your approval created, and never needs your password or your code again.

This is why having multi-factor authentication turned on is good but isn’t full-proof. MFA stops somebody using a compromised password, but it doesn’t stop somebody standing invisibly in the middle of a sign-in you performed yourself (known as a man in the middle attack).

Takeaway: Start the month by telling your team about this type of risk. Reading a suspicious email isn’t what’s dangerous, but typing a password into a login screen from a link can be. So the rule is short, take extra caution whenever a link leads you to a login screen. If a message says something is waiting in Microsoft 365, Dropbox or your bank, hover over the link to make sure it’s a legitimate source or go directly to the vendor site to see what’s waiting.

The habit article below makes this practical, and the drill is a ten minute practice.

The best way to defeat the fake sign-in page is to go to the vendor’s site directly rather than use the link. A bookmark, a browser search, or type the address in directly. The email you’re clicking on may well be perfectly genuine, but it could be a trap.

Habits fail when the correct way is slower than the convenient way, so the real work here is removing friction. If your team has to search for “Microsoft 365 login” every single time, they will keep clicking the link, and no amount of training will change that. Ten minutes spent setting up a bookmarks bar for the six or eight services people use daily is what turns this from advice into behavior.

One exception worth noting is password managers. A password manager won’t offer to fill your Microsoft password into a page that isn’t Microsoft because it matches on the actual address rather than on how convincing the page looks. If you use a password manager, not seeing a prompt autofill can be the warning you need to give pause.

Takeaway: Do two things this week. Set up a bookmarks bar on every work computer with the services your team uses most, so going direct is genuinely the quickest route. If you don’t already provide a password manager for your company, price one out. It’s usually less than ten dollars per person per month, and it greatly increases your security in addition to its phishing benefits. If you already have one, check that people are actually using it!

Here’s an exercise you can run in a team meeting this week with no preparation beyond a laptop and a screen. Pull up three sign-in pages: the real Microsoft 365 login, and two screenshots of convincing fakes (search for phishing page examples from any security vendor will supply plenty). Show them one at a time and ask the room a single question: which of these would you type your password into?

The point isn’t to call anyone out. It’s to let people discover, with nothing at stake, that the question can’t actually be answered by looking at the page. Most groups will guess wrong at least once, and that realization should land considerably harder than being told in a newsletter.

Takeaway: Run it this week while the month is new, and keep it to ten minutes. Afterwards, ask one follow-up out loud: if you did type your password into one of those, what would you do next, and who would you tell? Write the answer down — a name and a way to reach them — and put it somewhere people can find it. You have just written the first line of an incident response plan, which is where this series ends in week five.