Blog

Christmas is a time of giving, but don't accidentally give away too much!

Wed, 03 Dec 2025 00:00:00 +0000

I don't want to sound like the Grinch with the title of this article when I say don't give too much this Christmas, so let me explain a bit further.

Christmas is a time of giving and more people are using electronic cards and email to send Christmas messages, which makes it a prime time for cyber attacks as hackers take advantage of this time of goodwill. They are banking on the fact that people will be more willing to open emails, click on links and accidently infect their machines.

Remember, cyber criminals will be as active as Santa over the Christmas period so be careful.

They will use social engineering to find out people's contacts in various social networks, often focussing on old contacts that have not been in touch for a while, hoping it makes the recipient want to spark up a connection and open the email, or attachment, or click on a link. They will use multiple ways of trying to compromise your security, they don't care about being on Santa's naughty list!

So here are a few top tips for staying safe this Christmas:

Beware the ‘Phishmas’ grinches - Not every Christmas email brings good tidings! Cyber scammers dress up their messages to look like trusted retailers or even “Santa’s Helpers.” Watch out for suspicious links, odd greetings, and spelling that’s more tangled than a box of old fairy lights. Never click unless you’re sure it’s safe—don’t let phishing spoil your holiday spirit
Shop like a wise Elf - Stick to well-known online shops when searching for that perfect gift. Make sure you see a padlock (🔒) and ‘https’ in your browser—your clue that it’s safe to enter payment details. And remember: public Wi-Fi is for carols, not for shopping! Save your online purchases for your secure home connection rather than a public Wi-Fi hotspot, there are often fake hotspots (called an evil twin) that hackers use to intercept your details
Don’t let fake deliveries steal Christmas - With sleighfuls of parcels en route, you might get texts about deliveries. But beware: cyber crooks send fake notifications with naughty links. If in doubt, dash directly to the official delivery website or app to check your parcel’s journey - no reindeer required
Social Media: Watch out for festive fakes - Not every festive competition or charity appeal is real, even if it comes with cute reindeer emojis. Don’t overshare or click on links from unknown sources. Spread holiday cheer, not your personal info
Trust Your Festive Instincts - If a Christmas offer seems too sparkly to be true, or you get a message that gives you the holiday heebie-jeebies, pause! Double-check before you act, and don’t let the Christmas rush jingle-bell your judgement
Give Your Devices the Gift of Updates - Update your computer(s), phone(s), tablet(s) and apps so they’re wrapped up tight against cyber threats. Turn on automatic updates and let your devices become as secure as Santa’s workshop

Wishing You a Safe & Merry Christmas

By following these festive tips, you can sleigh the cyber criminals and enjoy a Christmas filled with joy, laughter, and peace of mind.

Share the good word with friends and family, and have the happiest—and safest— techie Christmas ever.

If you want help with any of the tips, call us on 01722 411 999 and we will be your jolly little helpers.

Christmas Opening Hours

Mon, 01 Dec 2025 00:00:00 +0000

Our Christmas opening hours are:

Mon 22nd Dec 8:30 - 17:30
Tue 23rd Dec 8:30 - 17:30
Wed 24th Dec 8:30 - 13:00 (HALF DAY)
Thu 25th Dec CLOSED
Fri 26th Dec CLOSED
Mon 29th Dec 8:30 - 17:30
Tue 30th Dec 8:30 - 17:30
Wed 31st Dec 8:30 - 17:30
Thu 1st Jan CLOSED
Fri 2nd Jan 8:30 - 17:30

Tech Tip – How to use the immersive reader in Microsoft Outlook

Thu, 27 Nov 2025 00:00:00 +0000

There is a feature built into Microsoft Outlook called The Immersive Reader, which is primarily to help people with Dyslexia, but it is also a very powerful tool that anyone can use to process emails. It is especially useful if you have long emails to get through or if you get emails written in another language.

You can use the immersive tool to read emails aloud, allowing you to listen to them rather than read them and you can use it to translate emails in real time, allowing you to focus on the content of the email rather than getting lost in the text.

To use the immersive email reader, do the following:

Open Microsoft Outlook
Browse to the email you would like to listen to rather than read
Open the email and click on the three dots "more actions" menu that looks like (...) that is typically at the top of the message
Select "Show in immersive reader"
This opens a new window, with the text of the email in a dyslexia friendly format
At the bottom of the screen, click on the play button (that is a right pointing triangle) to read the contents of the email aloud.

Note: You can click on the picture of a speaker to adjust the voice and the playback speed

Give it a go and see how easy it is for Microsoft Outlook to read emails aloud for you rather than finding yourself adrift in a sea of words.

If you would like more information about what the Immersive Reader can do, click here to go to Microsoft's website about this Outlook feature.

Tips on how to protect yourself from Phishing attacks

Wed, 19 Nov 2025 00:00:00 +0000

Phishing attacks are getting more sophisticated and are often either difficult to spot or the email just doesn’t raise any red flags or suspicions and get through.

To get you thinking about how large the problem is, here are four headline statistics to think about:

On average every 1 in 4 email messages received by people is either malicious or unwanted SPAM emails.
20% of businesses experience at least one of their users mailboxes being compromised with an account take over each month.
83% of malicious Microsoft 365 documents contain QR codes that redirect you to phishing websites.
Half of all business still haven’t setup a DMARC policy, putting them at significant risk of email spoofing, phishing attacks and business email compromise.

Source of the above stats is from Barracuda email security.

Bearing all of this in mind, here are some tips you can use to protect yourself:

Check the email address and domain name carefully.

A little while ago there were emails doing the rounds asking people to change their Microsoft 365 passwords, the email came from support@rnicrosoft.com which fooled a lot of people. At first glance the email address looks legitimate, and a lot of people fell for it. Did you spot the issue in the email address?

Look for anything that is a mismatch.

When you get an email, there are two elements to the sender. The displayed name and the email address. Phishers often use the display name to try to spoof a sender name whilst the actual email address is different to the display name. Check that the contact information is consistent with emails that you have previously had and ensure that nothing is out of place.

Check the language to see if it is consistent with what you would expect to see

If you got an email from someone that you know, check the language. A common theme is that the sender uses American phrases or terminology, that is out of alignment with what someone in the UK would typically use. Examples we have seen include language like “Call me on my new cell number” or “could y’all give me an update on paying that invoice”, things that look out of place with communication you would expect to see.

Check the spelling and grammar

Phishing emails are often riddled with poor spelling, grammar and punctuation mistakes, often making them easier to spot. Whilst AI is making this less of a thing, it is still something that occurs due to the context in the message being messed up in translation.

Be wary of urgent or threatening language

Phishers want things to happen quickly because they only have a small window of opportunity, so they will use urgent or aggressive language to try to make the recipient act quickly, without thinking about the consequences. Phishing attacks often use social engineering to get information about senior people in the organisation, then they target someone, often in a junior post and spoof an email coming from the senior member of staff, often with an email with a payment request such as "Pay this invoice NOW!! It is urgent” and as it appears to come from a legitimate source, they often fall for it and pay the invoice to a phishing recipient.

Check links in the email and do not click on any if you don’t need to

Links in emails are a common means of phishing, so it is imperative that you are sure that the link in the email is valid rather than an attack site. To check the validity of a link, move your mouse over a link but don’t click on it. This will show the actual address that the link will take you to, rather than the text displayed in the link. For example, this link here says “www.microsoft.com” but if you hover your mouse over the words, the actual link www.google.com will show somewhere on the screen (bottom left corner in Microsoft Edge), this is because the display information and link are independent from each other, which is why it is so often used for deception in phishing attacks.

NEVER open unexpected attachments in an email

Email attachments are one of the most common mechanisms of getting malware, viruses or ransomware onto a computer so if you are not expecting an email attachment to get sent through to you, do not open it. If you are unsure, ask your managed service provider for advice or for them to check it first on your behalf, which they should be able to do without risk to their infrastructure.

What should you do if you suspect it’s a phishing email?

Don’t open anything in it, like attachments.
Don’t respond to it.
Don’t click on any links in the email.
Report it to your IT partner to check to see if the email is valid or malicious.

If you want to find out how secure your email environment is and you use Microsoft 365, we can run a free security scan on it to check for any threats that may have got through. Call us on 01722 411 999 and we can arrange a scan.

What is Microsoft Autopilot and why should you deploy it?

Wed, 12 Nov 2025 00:00:00 +0000

What is Microsoft Autopilot?

Microsoft Autopilot is a cloud-based deployment and management solution for Windows devices, designed to simplify and streamline the process of setting up new computers for your business using Microsoft 365 and the correct Microsoft licensing to deploy it.

In other words, Microsoft Autopilot allows a business or organisation to deploy a standardised computer or laptop, built to fulfil all the requirements for both the organisation and the user, giving users a standardised, consistent environment to work in that can, for want of a better description, self-heal as well should things go wrong.

How does it work?

The way it works is that a applications is pretty straight forward:

Applications that you want to use in the business are packaged up and uploaded to Microsoft 365 in a portal called Intune
Each application will be assigned to a group for deployment
Computers are enrolled in Microsoft 365 using their serial number
Users are added to each of the applications groups they need installed on their computer
When the user switches on the laptop and logs in for the first time
- The computer checks to see if it is associated with a Microsoft tenant, finds it is and runs the deployment script setting up the computer to work with the organisation right from first boot up, running through the user setup process using the autopilot out of box user experience script
- The computer prompts the user to login to the tenant and displays any tenant branding
- The user logs in and the computer then runs all of the application installations in the background, building the computer from scratch with all of the applications assigned to that user
- The computer deploys all configurations setup for the organisation, examples include:
  - Renaming the computer
  - Installing applications such as Microsoft Office 365, Adobe, Chrome Edge,
  - Deploying organisation branding such as wallpaper
  - OneDrive sync and backup
  - Wireless network settings
  - Disk encryption and key management
  - Security settings including firewall configuration
  - Application updates
  - Local administrator management
  - Port management (USB lockdown)
  - Enrolling the device in remote management and monitoring (RMM)
  - Setting up templates and file usage
  - Setting up SharePoint locations in Windows Explorer
  - Setting up Printers and printer ports depending on location
- Once built, the computer is enrolled in Microsoft 365 and the status of the installation is displayed in the Microsoft Intune portal

Why should you use it?

The three S's, simplification, standardisation and security.

Simplification... whilst the above steps seem complicated, it really is introducing simplification because once it is setup, all computer installations are simplified. They follow the same process whilst installing, meaning the process for the organisation and users is simple, the computer is assigned to the tenant and when the user logs into the computer, it self builds. Simple!

Standardisation... the computers are all built using scripts and templates so they are all the same, they are standardised. This doesn't mean the computers are all identical because different people need different applications and settings in an organisation, it means they are built to the same standards, however different users are added to different application deployment groups providing them with the applications they need to do their jobs. Users automatically get the correct applications when they login to a computer, if they use someone else's computer in the organisation, their applications will still be available because they are deployed for the user that is logging in. This process is automatic so users can use any enrolled devices without needing to get the computer setup for them, it happens based on the standardised setup in the environment.

Security... computers that are enrolled in Autopilot and Intune are locked to an organisation's tenant, if a device is lost or stolen and someone finds it, then wipes the disk to install Windows on it, the next time the computer connects to the internet, it checks in with Microsoft and sees its serial number is associated with a tenant and will only allow the computer to login to that tenant. It will also display the tenant branding, showing the person that is using the computer who the device belongs to. This makes recovery of lost of stolen devices far more likely because the person recovering the device can't use it, it is always locked to the tenant meaning the computer is useless to anyone outside of the organisation.

It also makes it far easier to get Cyber Essentials and Cyber Essentials Plus accreditations if the environment is standardised, secure and managed.

Faster turn around of faults

If one of your users were to suffer a loss of their device, either lost, stolen or it dies, getting them back up and running is a simple process and one that often doesn't even require anything other than shipping a new device to them. The new device just needs to be enrolled in the tenant before it is shipped to them, the get the computer, connect it to the internet and log in. It then builds itself and syncs up their data to look and feel like their previous device.

Likewise is a computer has an issue that is software related, it can sometimes be beneficial to rebuild the computer from scratch, wiping the device and reinstalling everything, in the past this would result in a lot of downtime as the computer would typically be sent back to us to do the rebuild, but with Autopilot and Intune, there is no need to ship the device to us to rebuild, instead we can trigger a remote wipe and because the device is tied to the tenant, it checks in with Microsoft when it connects to the internet and then rebuilds itself, including all of the applications and data for the user, all automatically and all in situ. The process usually only takes between 30 minutes to an hour, resulting in far less downtime than before, improving productivity for the user and organisation.

Faster application deployments

If you want to roll out a new application to some or all of your users, again this can be packaged up and deployed to users without any downtime or requiring "techies" to remote onto the computer to install it. It can all be done from a central deployment in Microsoft 365 for the users that need the new package. Again this saves time as once the application is uploaded to Intune, it can just be deployed using Microsoft groups and the users that need the new application are just added to the application group, the rest happens automatically in the background, with the user getting the application installed on their machine over the internet. The computer will check in with Intune periodically and when it sees a new application waiting for deployment, it will download it and install it for the user. What's more, and depending on the app, it can even automatically configure the settings you want for the users with the application, if the application supports this feature.

Demo and more information

If you would like to see Autopilot in action and see how easy it is to deploy applications in your organisation, please call us and we can show you a demonstration of Autopilot from start to finish. From getting a new computer that boots for the first time connecting to the tenant and deploying all its applications. Call us on 01722 411 999 to see Autopilot in action.

Why choose The Silver Cloud Business as your managed service provider?

Wed, 05 Nov 2025 00:00:00 +0000

Why choose us?

This week we were asked to provide a presentation to a management consultant on what we did for one of our clients under management and it got me thinking, why should you choose The Silver Cloud Business as your MSP?

When ever we take on a client, the first thing we do is to build a solid IT foundation. The foundation we use for our clients is to ensure each complies with Cyber Essentials.

This doesn't mean each client will automatically be taken through the accreditation, it just means we follow the guidelines IASME has set out to make our client's environments compliant so should they wish to get the accreditation, it would be a straight forward process.

The reason we do this is because these are solid foundations that we can then build on, knowing that the underlying infrastructure is secure from cyber attack and everything running on it is in a supported state from the manufacturers.

Why is it important to have everything in support?

Cyber threats to businesses are increasing each day, bad actors, hackers use technology to exploit any weaknesses and one of the main weaknesses in IT infrastructure is equipment that is running out of date software, firmware or drivers that have known exploits.

Manufacturers often update their software because a third party has found a weakness and has notified them for a bounty. It is in the interest for manufacturers to run bounty schemes like this because it is far cheaper to fix a problem and roll out the update than to allow customers using their product to run code that can be compromised.

BUT... the manufacturer releasing an update is like an arms race. By announcing the update, they are also letting the world know about the potential exploit, so all hackers know to target this exploit and they go hunting for unpatched, out of date devices running the old software that has the exploit, allowing them to get in.

"They won't bother with my business, its small"

This is often an excuse used by smaller businesses thinking they are off the radar owing to their size, but this is not the case.

Yes larger, higher profile organisations are often targeted for attack, but exploiting vulnerabilities is just a numbers game, where the hackers will set off an an automated attack that just probes anything and everything for vulnerabilities and it is just a matter of pot luck which businesses are included in these bulk attacks.

They don't care, they just want to impact as many vulnerable systems as possible.

What do we do to protect our clients?

Cyber Essentials is built on five areas of technical control which are:

Firewalls - Firewall is the generic name for a piece of software or a hardware device which provides technical protection between your network devices and the Internet. We make sure these are enabled and secure.
Secure Configuration - Computers and cloud services are often not secure upon default installation or setup. An ‘out-of-the-box’ set-up can often include an administrative account with a standard, publicly known default password, one or more unnecessary user accounts enabled. We make sure default accounts are either removed, disabled or have their security reset to prevent their usage.
Security Update Management - To protect your organisation, you should ensure that all your software is always up to date with the latest security updates. We do this but can take it one step further. We have a patch management service that does more than just patch the operating system, we can patch 3rd party applications as well adhering to IASME standards, not as a snapshot in time, but in real time, all the time.
User Access - It is important to only give users access to the resources and data necessary for their roles, and no more. We work with clients to introduce roll based access and remove elevated rights from day to day user accounts, reducing the risk of exploitation.
Malware Protection -Malware (such as computer viruses) is generally used to steal or damage information. Malware is often used in conjunction with other kinds of attack such as ‘phishing’ (obtaining information by confidence trickery) and social network sites (which can be mined for information useful to a hacker) to provide a focussed attack on an organisation. We use a layered security approach, running multiple layers of protection for our clients to prevent the various threat vectors, such as email, internet and portable data storage (such as pen drives). The layered approach means that it is far harder for threats to get through the layers and exploit the device. We use solutions that are found in the Gartner Magic Quadrant leaders quarter, who are the best at delivering solutions and leaders in their field.

This is our baseline for customers under management, it is just the foundations we then work from with our clients, it is not limited to the five areas of technical control, it is just where we start and build from, providing our clients under management with a very secure foundation to develop their IT services from.

The best part is that it doesn't impact our clients, it just makes their working environment a lot more secure, and a lot less likely to be exploited and it means that if they want or need to get the Cyber Essentials accreditation, it can be obtained without the need to change anything, because our baseline is to get all our clients under management to this baseline already.

If you want more information about our services or would like to become Cyber Essentials certified, call us on 01722 411 999 and we can help you achieve this, quickly and with little fuss.