Cybersecurity services in Edmonton

Cyber security in Edmonton: the usual ways in

Attackers who go after a 20-person Edmonton office tend to come in through email and sign-ins. Cybersecurity in Edmonton starts with those two doors. Attackers take the cheapest route that works, and the elaborate hacks that make the news cost them time and money.

Phishing that looks like your inbox

Phishing is email built to get you to type a password or open a file. The common versions copy a Microsoft 365 sign-in page or a vendor invoice. One person enters their password, and the attacker can read that mailbox for weeks before anyone notices. Then they send invoices from a real address your clients already trust.

Passwords that leaked somewhere else

When a website or app gets breached, its stolen passwords end up on lists that attackers test against business accounts. If a staff member used the same password for a shopping site and for work email, nobody has to fall for a phishing email. Automated tools try those pairs by the thousand.

Old access and untested backups

Former staff keep working logins, and a past IT provider still holds a global admin account, the master login for your Microsoft 365. None of that shows up in day-to-day work, so it lasts for years.

Backups fail in the same quiet way. Ransomware gangs often look for backup servers on the same network and lock up or delete them early, so a copy that sits beside the data it protects may not survive the attack.

Security as part of managed IT

A security tool produces findings, and someone with admin rights has to act on them. An alert about a risky sign-in helps only if a person resets the account and checks what changed. When the monitoring and the administration sit with different companies, the alert waits while one passes it to the other.

For our managed IT clients, security runs as routine work alongside patching, tested backups and monitoring. The team that administers your email accounts and manages your firewall and VPN also watches for suspicious activity and responds fast.

If you're comparing managed security services in Canada, ask who acts on an alert, and whether that person has the admin rights to reset the account and change the firewall. If you already pay for security tools or another provider, a cybersecurity quote starts from what you have. Our pricing form asks about your current security tools, your highest-risk areas and any compliance needs, so we can tailor recommendations.

MFA, passkeys and security monitoring

MFA and passkeys

Multi-factor authentication adds a second check at sign-in, such as a prompt on your phone. Once it's on, the reused-password attack above stops working, because the password by itself gets an attacker nowhere. Passkeys go a step further. A passkey is stored on your devices or in your password manager and only works on the real site, so a fake sign-in page has nothing to capture.

Rolling either one out takes planning. Shared logins that several people use, a clinic front desk where three staff work at one workstation, and staff without company phones all need an answer before the switch. Skip that step and people find ways around it.

Suspicious-activity alerts in Microsoft 365

A SIEM (security information and event management) system collects records of activity such as sign-ins and admin changes, and flags patterns worth a look. A SIEM can flag things like a sign-in from another country an hour after one from Edmonton, a new rule forwarding a mailbox outside the company, or a burst of failed passwords against one account.

Microsoft 365 holds your email, files and staff logins, so it's usually where a stolen password gets used. That's why our SIEM monitoring runs over client Microsoft 365 environments.

Ransomware and recovery

Ransomware encrypts your files and demands payment for the key. Many groups also copy data before they encrypt it and threaten to publish it, so backups get you running again but don't undo a leak. Paying doesn't guarantee you get the data back, and it tells attackers you're willing to pay.

Your way back is a copy of your data the attacker couldn't reach, plus proof that it restores. For our managed IT clients, we use immutable backups, which can't be changed or deleted, to protect against ransomware and keep copies offsite.

Websites need the same plan. For sites we build and maintain, we keep a clean master copy of the site's code with its full change history, so if malware gets in we put the clean code back rather than cleaning infected files one at a time. Databases and files back up on an automatic schedule.

Incident steps: contain, then restore

An incident starts with an alert, or with a staff member saying something looks wrong. Containment comes first: lock the affected account and pull the compromised machine off the network. Then you work out what the attacker touched and restore clean systems.

If you spot something, tell your IT provider right away and leave the evidence alone. Deleting the suspicious email or wiping the laptop removes the record of what the attacker reached.

Locking out a departing IT provider

A provider who leaves on bad terms can keep the global admin password and the login for your domain registrar, the company your web address is registered with. You can't close accounts you don't know about, so start by finding out who holds the admin keys to your email and your domain.

We've taken on clients locked out of their own systems by a departing provider, and getting them back in is often step one. Once you have access, close the doors the old provider could still use. Change the global admin and registrar passwords, remove their remote-access tools from your computers, and check mailboxes for forwarding rules nobody set up on purpose.

Credentials and documentation for your systems should sit with you. To scope the work, request a cybersecurity quote through our pricing page.