No Tricks, Just Tips: Happy Cybersecurity Awareness Month

October is Cybersecurity Awareness Month, which happens to land right in the middle of scary-movie season. Here at Techworks, we think that's a perfect match.

Think about it: every horror movie is basically a cybersecurity training video in disguise. Somebody ignores an obvious warning sign, somebody wanders off alone, somebody picks up a call they shouldn't. And you're sitting there yelling at the screen, "Don't go in there!"

So grab the popcorn. Here are nine rules from the genre that make for real, practical protection for your business. No tricks, just tips.

1. Don't Pick Up for the Mysterious Caller

Every great slasher opens with a phone call from a voice that's a little too friendly. In the real world, that's a scam call, and caller ID can be faked, so a familiar-looking number proves nothing.

If anyone calls or texts with urgency and asks for money, passwords, gift cards, or sensitive information, hang up. Then call back using a number you already know and trust, not the one they gave you.

2. The Call Is Coming From Inside the House

The scariest twist in the genre is the threat that was never outside at all. In business, it looks like a message that really does come from a coworker or a trusted vendor, because their email account was hacked.

Make it a rule that any request involving money, banking changes, or sensitive data gets confirmed a second way, such as a quick phone call or a face-to-face check, before anyone acts on it. It only takes a minute, and it stops some of the costliest scams out there.

3. Don't Open the Door for Strangers

Phishing emails are the knock at the door that looks harmless: a fake invoice, a "shared document," a package you never ordered. Before you click:

• Check the sender's actual address, not just the display name
• Hover over links to see where they really go
• Be suspicious of anything urgent, unexpected, or too good to be true
• Treat unexpected attachments and QR codes with the same caution

When in doubt, don't open it. Ask someone.

4. Never Split Up

In horror, the group that stays together survives. In security, the equivalent is layers. A password on its own is one lock on one door, and passwords get stolen all the time.

Turn on multi-factor authentication (MFA) everywhere you can, starting with email, banking, and anything with admin access. An authenticator app or security key is stronger than text-message codes, but any MFA is far better than none.

5. Never Say "I'll Be Right Back"

You know what happens to the character who says it. Don't walk away from your computer with your screen unlocked, even in your own office. It takes two seconds to lock it: Windows key + L on a PC, or Control + Command + Q on a Mac.

6. Beware the Zombies That Won't Stay Dead

Old software and unpatched devices are the undead of IT. They keep shuffling along long after they should have been retired, and attackers know exactly which weaknesses they carry. Install updates promptly, and replace systems that no longer receive security fixes.

We've written more about this in Why Patching Later Is No Longer an Option and Your Old Technology Is Broken (and We'll Prove It).

7. Watch Out for Ghosts

Every business has them: the account of the employee who left two years ago, the vendor login nobody uses anymore, the shared password everyone forgot about. Those lingering accounts are an open window for anyone who finds them.

Build offboarding into your routine. When someone leaves, their access should be shut off the same day, and every so often, review who still has access to what.

8. Don't Take Candy From Strangers

A USB drive found in the parking lot, a "free" download from a site you've never heard of, a mystery QR code on a flyer: these are the poisoned treats of the digital world. If you didn't get it from a source you trust, don't plug it in, install it, or scan it.

9. Every Good Horror Movie Has a Survivor

When everything else goes wrong, the Final Girl is the reason the story doesn't end badly. In your business, that's your backups. A good backup strategy keeps copies in more than one place, including at least one that ransomware can't touch, and, most important, gets tested. A backup you've never tried to restore is just a hope.

More on that in A Backup Isn't a Backup Until You've Tested It.

One Last Rule: Scream Early

The best thing anyone on your team can do after clicking something questionable is say so right away. Mistakes happen to everybody, and the damage almost always comes from the hours or days nobody mentioned it. Make it safe and normal to speak up fast.

Happy Cybersecurity Awareness Month

The goal here isn't to scare you; it's the opposite. A handful of simple habits makes your business a much harder target, and the same handful keeps getting skipped.

If you'd like a second set of eyes on where your business stands, we're always happy to have a conversation. No tricks, and no pressure. Happy Halloween! 🎃