Book A Discovery Call →

Tag: Video

Blog posts with a TUCU video.

  • How To Protect Business Email And Cloud Accounts

    How To Protect Business Email And Cloud Accounts

    Video Transcript

    Scene 1:
    Speaker: Zoe Tsoraklidis
    You have your preferred digital ecosystem – whether that’s Google Workspace or Microsoft 365. Your team knows these tools, and is productive with them.

    Scene 2:
    Speaker: Zoe Tsoraklidis
    But here’s the challenge: how do you secure everything inside that ecosystem?

    The answer is Identity Management with Conditional Access Policies.
    Speaker: Zoe Tsoraklidis
    At TUCU, we use Microsoft’s Identity Management and Conditional Access tools as a security gateway, that sits in front of your existing Microsoft or Google accounts.

    Scene 3:
    Speaker: Zoe Tsoraklidis
    Let’s break it down using Airport Security as an analogy – and then I’ll show you how this works for your computers and mobiles.
    Speaker: Zoe Tsoraklidis
    We have 3 key components at work:
    Speaker: Zoe Tsoraklidis
    1. Entra Identity Management. This is like your passport, and proves WHO you are. It’s your credentials, which are used to manage user accounts, groups and roles, and basic authentication.

    2. Intune Device Management. This is like luggage inspection. It checks WHAT you’re bringing with you.
    Speaker: Zoe Tsoraklidis
    3. Conditional Access. This is like the TSA officer at the luggage checkpoint. They make the final entry decision using info from BOTH of the above tools.

    Scene 4:
    Speaker: Zoe Tsoraklidis
    Here’s how it works.
    Speaker: Zoe Tsoraklidis
    When any device attempts to access your data, your Border Agent, or Identity Manager first checks for a Passport, so they know who you are.
    Speaker: Zoe Tsoraklidis
    If your passport clears, you pass through, and they check your luggage. In this case, we’re checking if the device meets your security rules.

    Scene 5:
    Speaker: Zoe Tsoraklidis
    For example, your rules may be that every computer must be bound to your domain, have antivirus, EDR, and an encrypted hard drive, and be located in Canada to connect.

    Scene 6:
    Speaker: Zoe Tsoraklidis
    If all conditions are met, The Conditional Access Policy, or TSA guard, allows entry to your trust boundary, where your email, data, and applications live.
    Speaker: Zoe Tsoraklidis
    If the device fails to meet your security rules, access is denied.
    Speaker: Zoe Tsoraklidis
    This is known as a Trusted Device in a Zero Trust Framework. It’s how you differentiate your trusted staff and computers from hackers online.

    Scene 7:
    Speaker: Zoe Tsoraklidis
    Your preferred tools stay the same. Whether you use Google Workspace or Microsoft 365, your email, drives, and apps remain unchanged, but now you have real cloud security in place.

    Scene 8:
    Speaker: Zoe Tsoraklidis
    Before we touch on new computer setups, it’s important to note that Conditional Access Policies offer MUCH more than just initial entry approvals.
    Speaker: Zoe Tsoraklidis
    There are options to block file downloads, restrict copy/paste to protect company data, enforce re-sign in if there are signs of risky or suspicious behaviour, and more.

    Scene 9:
    Speaker: Zoe Tsoraklidis
    Now, what about new devices? We make this easy too.

    Whether you need Macs or PCs, every device arrives pre-provisioned into your Conditional Access tools.

    Scene 10:
    Speaker: Zoe Tsoraklidis
    Pre-provisioning, or, White Glove deployment, means we work with the computer manufacturer to do most of the device configuration before it’s shipped to you.
    Speaker: Zoe Tsoraklidis
    Mac devices are pre-provisioned through Apple Business Manager.
    Speaker: Zoe Tsoraklidis
    PCs, through Windows AutoPilot.

    Scene 11:
    Speaker: Zoe Tsoraklidis
    Here’s how it works.
    Speaker: Zoe Tsoraklidis
    We get a serial number from the manufacturer.
    We add that serial number to your security tools.
    Speaker: Zoe Tsoraklidis
    Then, the device is shipped to you.

    Scene 12:
    Speaker: Zoe Tsoraklidis
    When your staff receive the new computer, they turn it on and connect to wifi. The computer will ‘check in’ and begin to pre-provision itself.
    Speaker: Zoe Tsoraklidis
    Because the serial number was entered in to YOUR security tools, the computer knows it belongs to YOUR organization, adopts your security controls, and can enter your Trust Boundary.
    Speaker: Zoe Tsoraklidis
    This is what is known as a pre-provisioned device.
    Speaker: Zoe Tsoraklidis

    Scene 13:
    Speaker: Zoe Tsoraklidis
    With a few more clicks, our technicians have your staff logged in to email, and all their work apps installed. This is streamlined new computer setups made easy.

    Scene 14:
    Speaker: Zoe Tsoraklidis
    That’s Identity Management with Conditional Access in a nutshell.
    Speaker: Zoe Tsoraklidis
    You will have enterprise-grade security without changing how your team works. They keep using the tools they know, but now everything is properly protected.
    Speaker: Zoe Tsoraklidis

    Speaker: Zoe Tsoraklidis
    Please let us know if you have any questions – we’re always happy to help.
    Speaker: Zoe Tsoraklidis
    You can check the description for more links, or visit us online at tucu.ca to learn more about cloud security solutions for small business teams.
    Speaker: Zoe Tsoraklidis
    Thank you for watching!

    How To Protect Business Cloud Accounts

    Computer security is a smoke detector. IT security is a smoke detector, sprinklers, fire extinguishers, an evacuation plan, and fire-rated doors.

    Computer security is a padlock on a storage unit. IT security is a security system for the whole building, including cameras, key cards, and a guard who notices when something’s wrong.

    Computer security stops yesterday’s threats. IT security is active, working in the moment, and anticipating tomorrow’s threats.

    Computer Security Protects A Device. IT Security Protects Your Business

    Your most important data is in the cloud. It lives in your email inbox and your cloud drives. Computer security such as antivirus, don’t cut it. 

    This 4 minute video introduces the concept of Identity Management and Conditional Access Policies, which build the foundation of your cloud security.

    What Is Identity Management?

    Think of IAM as your digital security guard and gatekeeper combined. Identity Access Management is simply a set of tools and processes that help you:

    1. Control who can log in to your business systems
    2. Decide what each person can and cannot access
    3. Monitor how company resources are being used
    4. Easily add or remove access when people join or leave your team

    It’s like having a sophisticated key system for your digital business – some people get master keys, others can only enter specific rooms, and you have a record of who went where. 

    That kind of visibility is crucial to protecting your accounts and data.

    How Does Identity Management Improve Cybersecurity?

    You might think, “My team is small, we all trust each other, so why bother?” Here’s why IAM matters for businesses of all sizes:

    Protection From External Threats

    Hackers don’t just target large corporations. In fact, small businesses are often targeted precisely because they typically have weaker security measures. When employee credentials are compromised (through phishing emails or data breaches), an attacker can gain access to your entire business. IAM helps prevent this by adding layers of protection beyond just passwords.

    Streamlined Operations

    Have you ever wasted time tracking down access to a document or system? IAM creates a structured approach to who can access what, making onboarding new team members faster and reducing delays caused by access issues. 

    Compliance Made Easier

    Depending on your industry, you may have legal obligations regarding data protection and privacy. IAM helps ensure you’re meeting these requirements by controlling and documenting who has access to sensitive information. 

    Protection During Staff Changes

    When team members leave or change roles, IAM makes it simple to immediately adjust their access rights, protecting your business data from unauthorized use.

    Real World Example: Meet Sarah, The Accounting Firm Owner

    Sarah runs a small accounting firm with six employees. Before implementing IAM, she faced several challenges:

    • Her team needed access to different client files, but she worried about over-sharing confidential information
    • When a bookkeeper left suddenly, Sarah wasn’t sure if they still had access to client financial data
    • Team members were storing passwords insecurely or sharing them via email
    • Remote work meant team members were logging in from various locations, raising security concerns and increasing her risk and liability

    After implementing a simple IAM system through Microsoft 365 and Intune, Sarah’s firm experienced immediate benefits:

    • Client data was strictly compartmentalized – team members only saw the files they needed
    • When staff changed, removing their access took minutes instead of hours
    • Two-factor authentication added an extra security layer, even if passwords were compromised
    • Sarah could see who accessed what and when, providing peace of mind, real risk reduction and accountability

    How Identity Management Works

    Modern IAM doesn’t have to be complicated. Here’s what a typical system includes:

    1. Identity Management

    This creates and manages digital identities for each employee. When someone joins your team, you create their profile and assign appropriate access levels. 

    2. Access Controls

    This determines what each person can access. For example:

    • Your marketing team might need access to social media accounts but not financial records
    • Your bookkeeper needs access to QuickBooks but not your customer database
    • Contractors get limited access only to projects they’re working on 

    3. Authentication

    This verifies that users are who they claim to be. Modern authentication includes:

    • Strong password policies
    • Multi-factor authentication (confirming identity via a second method like a text message code)
    • Single Sign-On (SSO) capabilities that let users securely access multiple systems with one login 

    4. Monitoring And Reporting

    This gives you visibility into how your systems are being accessed and by whom, helping you identify unusual activity that might indicate a security problem.

    Implementation: Getting Started With IAM

    Implementing IAM doesn’t have to be overwhelming. Here’s how to begin: 

    1. Start With What You Already Have

    If you’re using Microsoft 365, Google Workspace, or other cloud platforms, you already have basic IAM tools at your disposal. Begin by learning how to use these built-in features effectively. 

    At TUCU, we typically recommend these IAM solutions for small business:

    Microsoft 365 with Intune: Provides comprehensive identity management that works seamlessly with Office applications, email, and file sharing

    Google Workspace: Offers strong IAM features for businesses primarily using Google’s ecosystem

    BitWarden for passwords: Password management tools that improve security while making it easier for teams to use strong, unique passwords

    For businesses with more complex needs, we deploy Azure Active Directory advanced capabilities.

    2. Implement Multi-Factor Authentication

    This single step dramatically improves your security posture. Require a second verification method (typically a code sent to a mobile device) in addition to passwords. 

    3. Create Access Groups

    Instead of managing permissions individually, create groups based on roles (e.g., “Accounting,” “Marketing,” “Management”) and assign appropriate access to each group.

    4. Document Your Processes

    Create clear procedures for:

    • How new employees get system access
    • How access changes when roles change
    • How access is removed when someone leaves

    5. Regularly Review Access Rights

    Schedule quarterly reviews to ensure everyone still has appropriate access levels – no more and no less than they need.

    Identity Management With Conditional Access: Complete Security

    Scroll back up to watch the video again, and note how Conditional Access Policies work with Identity Management solutions to provide you with complete security. 

    Need Help Protecting Your Cloud Accounts?

    If you’re using Microsoft 365, we implement comprehensive Identity Management and Conditional Access policies that protect your cloud accounts while satisfying vendor security requirements.

    Explore Microsoft 365 Security Services →

    Additional Resources:

  • Single Sign On Vs Identity Management

    Single Sign On Vs Identity Management

    SSO Versus IAM

    When you’re exploring cloud security solutions for your team, you’re going to encounter numerous tool sets and acronyms. Often it can be a challenge to discern the real differences in function and value of various tools, or even confuse two separate tools as overlapping, or performing the same function. This is often the case with Single Sign On versus Identity Management. In this video, we explain what Single Sign on is – and isn’t, and SSO relationship to IAM. 

    Watch Time: 4:03 minutes

    Additional resources linked below. 

    Video Transcript

    Scene 1:
    Speaker: Zoe Tsoraklidis
    Let’s talk about Single Sign-On – or SSO – and what it actually is (and isn’t).

    Scene 2:
    Speaker: Zoe Tsoraklidis
    Single Sign-On lets you log in once and access multiple applications without entering passwords again.
    Speaker: Zoe Tsoraklidis

    Scene 3:
    Speaker: Zoe Tsoraklidis
    Think of it like this: Instead of having fifteen different keys for fifteen different doors in your office building, you have one keycard that opens all the doors you’re authorized to access.

    Scene 4:
    Speaker: Zoe Tsoraklidis
    You log in once in the morning – to your identity system – and from that point, you’re automatically logged in to everything from your email, to your CRM, accounting apps and so on.

    Scene 5:
    Speaker: Zoe Tsoraklidis
    SSO improves password security and workflows. Your team isn’t juggling multiple passwords, reusing passwords, writing passwords on sticky notes or in spreadsheets, or constantly resetting passwords.

    Scene 6:
    Speaker: Zoe Tsoraklidis
    But here’s the critical misunderstanding of Single Sign-On: It’s not a security solution. In fact, without the right security, it can give away access to everything should your email account be hacked.

    Scene 7:
    Speaker: Zoe Tsoraklidis
    SSO is a function of just one component of Identity Management – efficient administration. Think of Identity Management as the complete security system for your building – and Single Sign-On as an easy access card for the rooms you use most often.

    Scene 8:
    Speaker: Zoe Tsoraklidis
    Here’s what SSO doesn’t do: It doesn’t verify that the person logging in is actually authorized. It doesn’t check if the device they’re using is secure. It doesn’t monitor for suspicious behavior after they’re logged in. It can’t control access or protect data.

    Scene 9:
    Speaker: Zoe Tsoraklidis
    If someone steals your keycard – or in this case, gets your login credentials – SSO happily lets them into everything. Because from SSO’s perspective, they have valid credentials.

    Scene 10:
    Speaker: Zoe Tsoraklidis
    This is why SSO needs to be part of a broader Identity Management strategy. Identity Management is the framework that controls who can access what, from where, using which devices, at what times. It’s the complete system, not just the login convenience.

    Scene 11:
    Speaker: Zoe Tsoraklidis
    Here are a few key security controls you need alongside Single Sign-On.

    Scene 12:
    Speaker: Zoe Tsoraklidis
    One: Multi Factor Authentication; when someone logs in with their SSO credentials, MFA asks “is this really you?” by sending a code to your phone or a push notification.
    Speaker: Zoe Tsoraklidis
    This means even if someone steals your password, they can’t actually get in without also having your phone.

    Scene 13:
    Speaker: Zoe Tsoraklidis
    Two: Conditional Access Policies; these are the rules that determine whether to allow a login based on context.
    Speaker: Zoe Tsoraklidis
    For example, your CFO logging in from the office on their company laptop? Full access granted. Same CFO appears to be logging in at two AM from Romania on an unknown device? Access denied.
    Speaker: Zoe Tsoraklidis
    SSO handles the “who”, in this case, it is Sarah’s account. Conditional Access handles the “should we let her in right now”, based on risk factors.

    Scene 14:
    Speaker: Zoe Tsoraklidis
    Three. Device Management. Your Identity Management system should know which devices are trusted company devices versus personal or unknown devices.
    Speaker: Zoe Tsoraklidis
    Company laptop, properly secured and managed? Can access everything. Unknown device from a new location? Blocked.

    Scene 15:
    Speaker: Zoe Tsoraklidis
    Four: Automated Provisioning and De-provisioning; when someone joins your company, your Identity Management system creates their accounts, assigns appropriate access, and connects them to SSO.
    Speaker: Zoe Tsoraklidis
    More importantly, when someone leaves, one action in your Identity Management system immediately revokes all their access across every connected application.
    Speaker: Zoe Tsoraklidis
    No manual cleanup or forgotten accounts.

    Scene 16:
    Speaker: Zoe Tsoraklidis
    That’s a brief overview of how you can have the convenience of Single Sign-On as part of the protection of a complete Identity Management system.
    Speaker: Zoe Tsoraklidis
    Here at TUCU Managed IT Services in Toronto and Durham Region, we help small businesses with strategic IT solutions.

    Scene 17:
    Speaker: Zoe Tsoraklidis
    Visit us online today at TUCU.ca to schedule a free Discovery Call. Let’s discuss what secure IT management looks like for your organization.
    Speaker: Zoe Tsoraklidis
    Thanks for watching!

  • Staff Using Personal Devices For Work? Watch This >>

    Staff Using Personal Devices For Work? Watch This >>

    Are Staff Using Personal Computers For Work?

    If your team uses personal laptops, computers and mobiles to access company email, files or apps, and your only security tools are antivirus and “strong” passwords, you are an easy target for hacking.

    Don’t be the low hanging fruit for cyber criminals. Watch this video and reach out to us today to get real remote work security in place.

    Need more info? Below, we’ll walk through the specific risks and all available solutions so you can make an informed decision for your organization.

    Book A Discovery Call
    Video Transcript

    ## Scene 1:
    **Speaker:** Zoe Tsoraklidis
    Your team works from personal laptops and phones.
    **Speaker:** Zoe Tsoraklidis
    They access company email and files from inside the office,
    **Speaker:** Zoe Tsoraklidis
    from home,
    **Speaker:** Zoe Tsoraklidis
    from the coffee shop,
    **Speaker:** Zoe Tsoraklidis
    And anywhere in between.
    **Speaker:** Zoe Tsoraklidis
    This is modern work. And it’s creating a security problem you probably haven’t thought about.

    ## Scene 2:
    **Speaker:** Zoe Tsoraklidis
    Here’s the issue: when your employee’s personal device has access to your business data, you have zero control over what happens to that data.

    ## Scene 3:
    **Speaker:** Zoe Tsoraklidis
    That laptop might be shared with family members. It might be infected with malware from downloads. It might not have security updates installed. And you have no way to know.

    ## Scene 4:
    **Speaker:** Zoe Tsoraklidis
    On top of no visibility or control over your data, unsecured laptops are prime targets for automated cyber attacks and email account hacking.

    ## Scene 5:
    **Speaker:** Zoe Tsoraklidis
    If that device gets lost or stolen, or that staff member leaves, here’s the problem:
    **Speaker:** Zoe Tsoraklidis
    You can’t remotely wipe it.
    **Speaker:** Zoe Tsoraklidis
    You can’t log them out.
    **Speaker:** Zoe Tsoraklidis
    You can’t even see what business data was on it.
    **Speaker:** Zoe Tsoraklidis
    It’s not your device, so you’re stuck.

    ## Scene 6:
    **Speaker:** Zoe Tsoraklidis
    And sure, when an employee leaves your company, you can change their email password, but they’ve already downloaded client files, and they may have years of email and work files saved locally.
    **Speaker:** Zoe Tsoraklidis
    And you have no way to remove any of it from their personal laptop.

    ## Scene 7:
    **Speaker:** Zoe Tsoraklidis
    Here’s the business reality: Potential clients are asking tougher security questions these days; like “How do you protect our data?”
    **Speaker:** Zoe Tsoraklidis
    If your answer is “my staff are careful,” you’re losing business to competitors with better answers.

    ## Scene 8:
    **Speaker:** Zoe Tsoraklidis
    So what’s the solution? Here’s our position at TUCU: Personal computers and laptops should NOT be used for business work. Period. Here’s why.

    ## Scene 9:
    **Speaker:** Zoe Tsoraklidis
    To properly secure a device, you need to remove admin rights,
    **Speaker:** Zoe Tsoraklidis
    install endpoint security,
    **Speaker:** Zoe Tsoraklidis
    deploy monitoring tools,
    **Speaker:** Zoe Tsoraklidis
    and restrict certain applications.
    **Speaker:** Zoe Tsoraklidis
    When you do that to someone’s personal laptop, you’ve taken away their ability to control their own device. That’s not fair to your employee, and it creates ongoing conflicts.

    ## Scene 10:
    **Speaker:** Zoe Tsoraklidis
    Computer ownership aside, the reality is this; cyberthreats keep evolving. Even multi factor authentication can now be breached. Small businesses need to tighten up security.
    **Speaker:** Zoe Tsoraklidis
    The right approach?
    **Speaker:** Zoe Tsoraklidis
    Company-owned computers for all staff, and Identity Management tools for cloud security.

    ## Scene 11:
    **Speaker:** Zoe Tsoraklidis
    With Identity Management, you regain control over access to company email and files.
    **Speaker:** Zoe Tsoraklidis
    You significantly reduce risk.
    **Speaker:** Zoe Tsoraklidis
    Your business is exponentially harder to breach.
    **Speaker:** Zoe Tsoraklidis
    You become more attractive to security conscious consumers.

    ## Scene 12:
    **Speaker:** Zoe Tsoraklidis
    You can be secure, and flexible.
    **Speaker:** Zoe Tsoraklidis
    Securing a computer is different from a cellphone. For personal mobile phones for work, Identity and Mobile Device Management can create secure containers for business data, without interfering with personal use.
    **Speaker:** Zoe Tsoraklidis
    If the phone is lost, or the employee leaves your company, you can remotely wipe only the business container. Their work access is removed. Their personal photos, apps, and data stay completely untouched.

    ## Scene 13:
    **Speaker:** Zoe Tsoraklidis
    This is how you align with best practices in security while balancing the need to stay mobile and productive.
    **Speaker:** Zoe Tsoraklidis
    Are you ready to do this right?
    **Speaker:** Zoe Tsoraklidis
    At TUCU, we help small business and non profit teams with real cybersecurity solutions for modern work.

    ## Scene 14:
    **Speaker:** Zoe Tsoraklidis
    Visit TUCU dot C A to schedule your free Discovery Call.
    **Speaker:** Zoe Tsoraklidis
    We’ll go through your current setup and help you regain control over sprawling data.
    Check the description for more resources and contact links.
    Thanks for watching!

    Should Personal Computers Be Allowed At Work?

    Should employees check work email on their personal phones? Can your team use personal laptops for company work? What about executives accessing files from their iPad? Many businesses allow personal devices for work (often called BYOD, Bring Your Own Device) without fully understanding the security implications. It’s convenient and saves money on hardware, but that convenience requires careful management.

    The Reality: It’s Already Happening

    Whether you’ve formally allowed it or not, staff are likely already:

    • Checking work email on personal phones
    • Accessing company files from home computers
    • Taking calls on personal devices
    • Working from personal laptops during travel

    The question isn’t whether to allow personal devices. It’s how to manage them safely.
    Here are five specific security considerations that apply whether it’s your newest hire, your executive team, or your contractors using personal devices:

    1. Account Compromise & Business Impersonation

    When a personal device becomes infected with malware, the consequences extend to your business. An attacker who compromises the device gains:

    • A legitimate company email account to impersonate your organization
    • Ability to send phishing emails to clients, vendors, or staff
    • Access to shared drives, documents, and internal communications
    • Your company’s reputation and business relationships

    This risk extends beyond external threats. Insider threats can also exploit unmanaged personal devices, whether maliciously or accidentally.

    2. Zero Security Controls

    Personal devices operate outside your IT security framework. Without endpoint management, you can’t:

    • Verify antivirus status, security patches, or encryption
    • Enforce strong passwords or multi-factor authentication
    • Remotely wipe company data if a device is lost or stolen
    • Maintain audit trails of what was accessed, downloaded, or shared

    Users can install any app, connect to any network, or disable security features, often without understanding the business implications.

    3. Data Persists After Departure

    Changing passwords or revoking access doesn’t remove data already stored on personal devices. When employees leave:

    • Historical emails remain cached indefinitely
    • Downloaded files stay on personal computers through job changes
    • Offline access means data remains available even after cloud access is revoked
    • Screenshots and copies can’t be detected or prevented
    • Device sales or disposal can expose company data years later

    This is why secure offboarding procedures are essential, but they’re much harder to enforce with personal devices. Learn more about protecting data when employees leave.

    4. Unintentional Data Loss & Exposure

    Even well-intentioned people create risk with unmanaged devices:

    • Accidental deletion of shared files or folders
    • Forwarding sensitive information to personal accounts “for convenience”
    • Screenshots of proprietary information persisting in personal photo libraries
    • Personal cloud backups (iCloud, Google Photos) automatically capturing work documents
    • Family members using the same device may access work applications
    • Lost or stolen devices expose all locally stored company data

    These scenarios happen regularly in small businesses where convenience often overrides security protocols.

    5. Limited Recourse

    When something goes wrong with a personal device, your options are constrained:

    • Can’t remotely access or control personal property
    • Difficult to enforce data return or deletion policies
    • Hard to trace breaches or prove data misuse
    • Can’t prevent use of downloaded materials after employment ends
    • Privacy laws complicate attempts to control personal devices
    • Cyber insurance may not cover losses from unmanaged devices

    Understanding these limitations is critical for IT compliance in regulated industries, and for anyone who values their data.

    What To Do About Personal Devices At Work

    Most people don’t need unrestricted access to all company systems from personal devices. Better alternatives exist that balance security with flexibility:

    Company-Owned Devices

    Provide work devices for roles handling sensitive data or in regulated industries. This approach gives you full control over security configurations and data management. Some businesses let staff choose from a short list of approved models, so people get a device they like and IT still manages it. Here is how to manage company laptops for a remote team.

    Access Management

    Identity and access management lets you provide limited, role-appropriate access, like email forwarding, secure file portals, or read-only access instead of full system access.

    Mobile Device Management (MDM)

    Creates a secure “work profile” on personal devices that you can manage and remotely wipe without touching personal data. Learn more about MDM solutions or read our complete BYOD & MDM guide.

    Virtual Desktops

    Cloud-hosted desktops accessible from any device. Nothing is stored locally, and the company keeps full control. This approach works well for remote work scenarios.

    Who Pays For Repairs On Personal Devices?

    If the company pays to repair or support an employee’s personal computer, that support can count as a taxable benefit for the employee. Company-owned devices avoid the question: the business owns the equipment, claims its cost, and IT manages it from day one. Ask your accountant how this applies to your team.

    The Bottom Line On Personal Computers At Work: Pick A Secure Strategy

    Personal devices at work aren’t inherently dangerous, but they require intentional strategy, not convenient assumptions.

    The question isn’t “Can we allow personal devices?” It’s “How do we provide the access our team needs while protecting what our business can’t afford to lose?”

    Your approach will depend on your industry, data sensitivity, and compliance requirements. What works for a consulting firm may not work for a healthcare practice or financial services company.

    Personal Devices FAQ

    Is it safe to let employees use personal laptops for work?

    No, not with company data on them. You cannot manage, update or wipe a laptop you do not own, so client files on it are out of your control. Give staff a company-owned computer, or a Windows 365 Cloud PC when a personal laptop has to be used, so company data never lands on it.

    How do I secure company logins on employees’ personal devices?

    Use multi-factor authentication and conditional access, so company email and files open only on devices your business manages. Personal phones can be enrolled through Intune Company Portal, which protects the work apps without touching personal photos and messages.

    What happens when a personal phone with company access is lost?

    If the phone is enrolled, your IT team removes the company data with a selective wipe and blocks the phone from signing in again. Personal data stays on the phone. An unmanaged personal laptop has nothing to wipe, which is why company computers matter.

    How can small businesses manage employee laptops more easily?

    Buy company laptops that register to your business before they ship. Staff sign in, and Intune sets up the apps and security automatically. Read how to manage company laptops for a remote team.

    Related Resources

  • Sharing Admin Rights With Your IT Company

    Sharing Admin Rights With Your IT Company

    Admin rights, or administrator rights, let a person install software, change security settings and open any file on a computer. On a business computer, that is the power to change everything. So the real question is not whether someone holds admin rights. It is who.

    Many small businesses give every employee admin rights without a second thought, then hesitate when their IT company asks for the same access. We understand why. It feels like handing over the keys. This article explains what admin rights control, who on your team needs them, and how that access stays safe.

    What Do Admin Rights Mean?

    A computer has two kinds of accounts.

    A standard user account runs the programs that are already installed and manages that person’s own files. It cannot change system settings or install new software.

    An administrator account can do everything: install and remove software, turn security tools on or off, change system settings and open files that belong to other users.

    That boundary protects the computer from mistakes and from malicious software. Your team does email, documents, browsing and business apps on a standard account with no trouble at all.

    Why Admin Rights On Every Laptop Puts Your Business At Risk

    When a person works with admin rights, every program they run gets those same rights. That includes the malicious attachment they open by accident.

    One phishing email. One bad download. With a standard account, the damage usually stays on one computer. With admin rights, malware can install itself, switch off security tools and spread.

    The fix is well documented. Removing local admin rights and controlling what can run has historically mitigated 75% of Microsoft’s critical vulnerabilities (BeyondTrust Microsoft Vulnerabilities Report, 2024).

    Who In Your Business Needs Admin Rights?

    For day-to-day work, almost nobody.

    • Your staff: standard accounts for everyday work
    • Your IT team: separate admin accounts, used only for setup, updates and fixes
    • One-off needs: an approved request, not permanent admin rights

    When staff need new software, they ask, the request gets approved, and the software gets installed. Your team keeps working, and your computers stay locked down.

    Why Your IT Company Needs Admin Access

    Managing your computers well takes admin access. Your IT company uses it to:

    • Install security updates and keep protection tools running
    • Install, update and remove business software
    • Fix problems for your team quickly
    • Watch system health and catch problems before they stop work

    What Safe Admin Access Looks Like

    Admin access is safe when it is controlled, visible and reviewed. Look for these 5 things:

    • Separate admin accounts: used only for management tasks, never for email or browsing
    • Strong sign-in: multi-factor authentication on every admin account
    • Activity logs: a record of what changed, when and by whom
    • Regular reviews: admin access removed when it is no longer needed
    • Emergency access: a documented, secure way in when something breaks after hours

    This is how we set up every client: no admin rights for staff, full control of your Microsoft 365 tenant, and Conditional Access everywhere. We always make sure our clients have secure emergency access if they need it. Learn more about how to build trust with your MSP and emergency admin access.

    Shared Admin Access And Co-Managed IT

    This article is about the admin rights given to individual staff on their own computers. That is separate from co-managed IT, where a business with its own internal IT team shares admin control with an outside provider on purpose. Co-managed is a valid model for some larger teams. Our guide to co-managed vs managed IT services covers the trade-offs.

    What Changes For Your Team

    Less than most owners expect. Email, documents, Teams and business apps all work the same on a standard account. The one change: new software goes through a quick request instead of a self-install.

    In return, a single click on a bad link stays a small problem instead of a business-wide one. You also always know who changed what on your computers, and why.

    Admin Rights FAQ

    What are admin rights on a computer?

    Admin rights let a user install or remove software, change security and system settings, and open files that belong to other users. A standard account can only run installed programs and manage its own files.

    Should employees have admin rights on their work computers?

    In most small businesses, no. Staff do their work on standard accounts. Admin access sits with your IT team on separate accounts, and software requests go through a simple approval.

    Is it safe to give my IT company admin rights?

    Yes, when the access is controlled. Your IT company should use separate admin accounts with multi-factor authentication, keep logs of changes, review access regularly and document how emergency access works.

    Related reading:

  • MFA Fatigue Attacks: What Is Push-Bombing?

    MFA Fatigue Attacks: What Is Push-Bombing?

    In this post we cover MFA fatigue attacks, also known as push-bombing, so that if it happens to you or your team, you know what to do.

    Multi-factor authentication (MFA) remains essential for account security, but push-bombing attacks exploit the notification approval process to get around it. Understanding how these attacks work helps your team recognize and respond calmly when targeted.

    How Do MFA Fatigue Attacks Such As Push-Bombing Work?

    With MFA, receiving a notification is a normal part of the login process. It’s something you are familiar with.

    With push-bombing, attackers already have your password. They may get it through phishing or from a data breach password dump.

    With the correct password, they target the push notification process. They attempt to log in many times in quick succession, which sends you several push notifications, one after the other.

    Many people will question an unexpected prompt they didn’t request, but when someone is bombarded with them, it is easy to approve one by mistake just to make them stop.

    If it happens to you: put the phone down and do not approve anything. Once the notifications stop, change your password, because it has been compromised, and tell your IT provider right away so they can check the account.

    Push-bombing is a form of social engineering attack designed to:

    • Confuse the user
    • Wear the user down
    • Trick the user into approving the MFA request to give the attacker access

    For businesses, a successful push-bombing attack can lead to email compromise, data theft, and failed vendor security screenings if attackers reach administrative accounts.

    How To Stop MFA Fatigue Attacks

    Turn On Number Matching Or Use Passkeys

    Since May 2023, Microsoft Authenticator shows a number on the login screen that the user must type into the app before approving a sign-in. An attacker sending prompts from somewhere else cannot see that number, so a tired or confused approval no longer works. Make sure every account uses the Authenticator app, not text messages.

    For the strongest protection, move to phishing-resistant MFA such as passkeys or physical security keys. They only work on the real website and the user’s own device, so there is nothing to approve by accident.

    Educate Your Employees

    MFA fatigue attacks can be confusing and stressful. When your team knows about them beforehand, they recognize the attack and stay calm. Share this post with them, remind them never to approve a prompt they did not start, and ask them to report these attacks to your IT provider so others can be warned and the account secured.

    Curate And Reduce Approved Apps

    Review and reduce the number of apps approved for use across your organization. This helps in two ways:

    • Fewer logins for each staff member to manage
    • A chance to re-assess the security of each app

    Review your productivity suite for apps and services you can access behind a single login. By maximizing your Microsoft 365 subscription or Google Workspace account, you can improve productivity and security in one move.

    Create Strong Password Policies

    Push-bombing only works when attackers already have a password. Strong, unique passwords for every account make that much harder. Current best practice is to:

    • Use long passphrases rather than short, complex passwords
    • Never reuse a password across accounts
    • Store passwords in a business password manager
    • Block passwords that appear in known data breaches

    Adopt An Advanced Identity Management Solution

    Identity management solutions can also help prevent push-bombing. They typically combine logins through single sign-on, so users have one login and one MFA prompt to manage instead of several.

    They also let you set contextual login rules, such as blocking sign-ins from outside your country, from unmanaged devices, or when a sign-in looks risky. Learn more in our Identity And Access Management Guide.

    Other Ways Attackers Get Around MFA

    Push-bombing is not the only way attackers get past MFA. In this short video, Zoe explains how attackers also steal session tokens and cookies to walk into email accounts without ever needing a password or an MFA code.

    Session Token And Cookie Theft

    Instead of your password or code, the attacker steals the session token your browser uses to prove you are already signed in. It often starts with a convincing email link that leads to a fake login page sitting between you and the real one. With that token, the attacker can open your email as if they were you. See how this plays out in The Vendor Banking Email Fraud We See Every Week Now.

    SIM Swapping And Help Desk Tricks

    Attackers also move a victim’s phone number to their own SIM card to receive text message codes, or call a help desk pretending to be the user to get MFA reset. This is why text message codes are the weakest form of MFA, and why every MFA reset should be verified.

    The protection is the same for all of these: phishing-resistant MFA, Conditional Access rules that only allow trusted devices, and regular cybersecurity awareness training.

    Frequently Asked Questions

    What is push-bombing?

    Push-bombing, also called an MFA fatigue attack, is when an attacker who already has your password sends you login approval prompts over and over, hoping you will approve one by mistake.

    What should I do if I get MFA prompts I did not request?

    Do not approve any of them. Once they stop, change your password, because the attacker already has it, and tell your IT provider right away.

    Does number matching stop push-bombing?

    It stops most of it. With number matching, you must type the number shown on the real login screen into your authenticator app, which an attacker cannot see. Passkeys and security keys go further and remove the approval step completely.

    Stronger MFA For Your Business

    Phishing-resistant MFA, Conditional Access and identity management are part of the fully managed IT we provide, and part of how we help clients pass vendor security screenings. If you are looking for an IT partner who sets this up and looks after it for you, book a discovery call.

  • Is Antivirus Enough To Protect Small Business Data?

    Is Antivirus Enough To Protect Small Business Data?

    No. Antivirus is still worth having, but antivirus alone is not enough to protect business data. It catches known malicious files, and most attacks today do not use one.

    79% of attacks to gain initial access are now malware-free (CrowdStrike 2025 Global Threat Report). Attackers sign in with stolen passwords and use tools that are already on the computer. There is no bad file for antivirus to find.

    Here is what antivirus does well, where it falls short, and what a small business needs on top of it.

    How Antivirus Works

    Antivirus compares the files on a computer against a list of known malicious files. When it finds a match, it quarantines the file. Real-time scanning checks files the moment they open, which is a big improvement over scheduled scans.

    But the method has one limit that no feature fixes: antivirus can only stop what it recognizes as a bad file.

    What Antivirus Still Catches

    Good business antivirus still does useful work against file-based threats:

    • Viruses: malicious code hidden in attachments, downloads or shared files
    • Spyware: software that collects passwords and personal data
    • Adware: software that tracks browsing and can carry spyware with it
    • Other known malware: trojans, worms and similar threats

    That is why we keep it. It is one layer, not the whole wall.

    Antivirus Disadvantages For Business

    Most Attacks Do Not Use Malware Files

    Fileless attacks run in memory or use built-in tools like PowerShell. With 79% of initial access attacks now malware-free (CrowdStrike, 2025), a file scanner misses most of the front door.

    Stolen Passwords Walk Straight Past It

    Use of stolen credentials was the top hacking method in small and medium business breaches, at 33% (Verizon 2025 Data Breach Investigations Report, SMB Snapshot). When an attacker signs in to Microsoft 365 with a real password, antivirus on the laptop never sees it.

    Phishing Links Are Not Files

    Most phishing emails carry a link to a fake sign-in page, not an attachment. Antivirus has nothing to scan. Teach your team how to identify phishing emails.

    It Cannot Bring Your Data Back

    Ransomware was involved in 88% of breaches at small and medium businesses (Verizon 2025 DBIR, SMB Snapshot). Antivirus has no recovery tools. Once files are encrypted, only a backup brings them back. See how our backup and recovery services restore your data.

    It Does Not Stop People With Too Much Access

    Mistakes and misuse from inside the business are a real risk. Read more about insider threats. Antivirus does not control who can open which files.

    What Small Businesses Need On Top Of Antivirus

    Endpoint Detection And Response (EDR)

    EDR watches behaviour, not just files. It spots a normal tool doing something abnormal, isolates the computer and alerts a person to respond. See our managed EDR and MDR services and how endpoint management works.

    Identity Protection: MFA And Conditional Access

    Since attackers sign in instead of breaking in, protect the sign-in. Multi-factor authentication and Conditional Access check who is signing in, from which device and from where. Learn how to protect business email and cloud accounts and read our identity and access management guide.

    No Admin Rights For Everyday Work

    Staff work on standard accounts. When malware runs without admin rights, it cannot install itself across the computer. Read why sharing admin rights with your IT company is safer than giving them to everyone.

    Automatic Patching

    Attackers use known security holes that already have a fix. Keep Windows, macOS, browsers and business apps updated automatically, on a schedule your IT team checks.

    Backup Of Microsoft 365 And Your Files

    Back up every mailbox, OneDrive, SharePoint site and Teams, and test that you can restore them. A tested backup turns ransomware from a disaster into a bad day. See our backup and recovery services.

    Email Authentication

    SPF, DKIM and DMARC stop criminals from sending email that looks like it came from your domain. They also help your real email reach the inbox.

    Security Awareness Training

    Your team is the last check before a click. Short, regular cyber awareness training helps them spot phishing and report it.

    Protect Your Toronto Business With Layers, Not One Tool

    Each layer covers a gap in the others. That is a defense in depth strategy, and it is how we protect small businesses across Toronto and Durham Region. Antivirus stays in the stack. EDR, identity protection, patching and backup do the rest, managed by the same team that knows your people and your setup.

    Explore our cybersecurity services.

    Antivirus FAQ

    Is antivirus alone enough for a small business?

    No. Antivirus catches known malicious files, but most attacks today use stolen passwords and tools already on the computer. A small business needs EDR, identity protection, automatic patching and a tested backup on top of it.

    Do I still need antivirus if I have EDR?

    Most EDR products include antivirus scanning, so you get both in one tool. You do not need a second, separate antivirus product.

    Is Microsoft Defender Antivirus enough for a small business?

    Defender Antivirus is built into Windows and is a good antivirus layer. On its own it is still antivirus. Microsoft Defender for Business, included in Microsoft 365 Business Premium, adds EDR and central management.

    Can antivirus stop ransomware?

    It can stop some known ransomware files. It cannot stop an attacker who signs in with a stolen password, and it cannot restore encrypted files. You need EDR, identity protection and a tested backup.