Posts

Which is more secure: Onsite or offsite servers?

/in /by

As your company grows, you will eventually reach a point when you must decide whether you want to use onsite or offsite servers. From a cybersecurity perspective, both options have their advantages and disadvantages.

Before you make your decision, get more informed about the pros and cons of onsite servers and offsite servers.

The security benefits of onsite servers

Some companies prefer onsite servers because they want full control of their data. They may worry that storing information on offsite servers gives criminals easier access to sensitive data.

As long as you’re willing to spend money on the right equipment and personnel, your business could benefit from onsite servers capable of giving your employees access to cloud solutions.

Security problems with onsite servers

There are a few security issues to consider before you choose onsite servers. Few SMBs can afford to hire IT professionals who focus on server security. Without the right personnel monitoring your system, the network could get infected by malware.

Choosing a reliable network monitoring tool lowers the threat of infection. Monitoring your network, however, isn’t the same thing as adding security that prevents hackers from attacking you. What will you do if you discover a new piece of malware on your network?

There aren’t many IT professionals working for SMBs that can eradicate every trace of malware, especially when the malware has been released recently and an antidote isn’t obvious.

Security benefits of choosing offsite servers

Over the last few years, more companies have started using hosted virtual servers. According to one study, 67 percent of organizations in 2014 relied, at least partially, on hosted systems.

There are several security reasons for companies to choose offsite servers. By choosing an offsite server, you get monitoring and protection from trained professionals. Placing your data in an offsite server also helps protect your business from disasters. If your office suffered a fire, flood, or other disaster, you could lose all of the information on your server. With offsite servers, though, you get added protection for disaster recovery and business continuity.

Keeping data on an offsite server only protects your business when you choose a reliable partner. Make sure you choose a company that takes security and uptime seriously. Otherwise, you won’t get the benefits that you expect.offsite servers

Problems with using offsite servers

While there are numerous benefits to choosing offsite servers, there are also some disadvantages.

Depending on how your partner structures its servers, your network could get infected by malware because of another company that uses the same servers. Without strict walls between accounts, another business’s poor security could hurt you.

You can improve the chance of choosing a reliable partner by asking companies about their rack space, cabinet space, and cage space. You should also ask about the company’s uptime, service level agreement, and data backup redundancy.

A hybrid approach to server security

Since there are pros and cons to both options, it makes sense to consider using a hybrid solution that combines the best qualities of onsite servers with the security advantages of offsite servers.

A hybrid cloud solution can give your business stronger security, automatic data backup, uncompromising performance, and the ability to scale quickly as your organization evolves.

You don’t have to choose between onsite and offsite servers. A hybrid approach might match your company’s needs better than those options.

5 ways employee education can make IT support infinitely easier

/in /by

IT support is an important part of any company’s technology plan, but there is another important component that should go hand in hand. Employee training is the perfect complement to strong IT support for many reasons. In fact, according to a workplace study, over 65% of employees prefer to learn at work, and more than 55% prefer to learn at their own pace.

There are options for employee training including online courses, face-to-face classes, training offered by your IT providers, and even technology classes at local community colleges or technological organizations. And for basic training, you likely have someone on staff who can lead the charge.

All of these are great ways to give your employees some additional training, which in turn makes your IT support more effective. Plus, employee education has added benefits like reducing turnover and helping employees feel valued.

Here are 5 ways employee training helps.

1. Better communication with IT professionals

Whether your IT support is provided by an off-site managed IT services partner or in-house staff who work in your office right along with other employees, employee training can help communication between teams.

Employees should have some guidelines for communicating tech problems with IT support. The better your staff is at accurately summarizing support issues, the more effectively they can explain those issues to the support team. And when IT support starts with a well-documented ticket, they can often resolve the issue much more quickly.

Less research and legwork means better network performance and faster recovery when things don’t go as expected.

2. Avoid simple issues

There’s a joke in the IT world about the most common troubleshooting suggestion: “Have you tried turning it off and back on again?” But here’s the irony. A surprising number of IT issues really can be solved by power-cycling a device.

Of course, IT professionals are more than happy to help if the problem is more complex. But there are several simple tips and tricks that any employee should know to try before contacting IT support. Power-cycling is one of them.

Training employees to check for basic issues before reaching out to IT could save resources and time on both ends.

3. Better security

Your IT team can do everything possible to secure your servers and important data, but if your employees don’t know about the latest phishing schemes, ransomware, and trends in strong passwords it can all go to waste.

Employee education is essential for securing company data, especially with the increasing prevalence of sophisticated modern targeted phishing attacks called spear phishing, voicemail phishing (vishing) and SMS/text message phishing.

4. Get into the cloud

As many businesses transition to the cloud, some employees may get left behind. Help them catch up with some education not only about your specific cloud technology but what the cloud is and how it impacts their work.

Any transitional to a new tech solution can be stressful. But proper training will set your employee’s minds at ease and help to avoid hassles. Any time your company adopts a new technology, it’s important to offer training to employees to smooth over the transition.

5. Stay calm in a crisis

With extra technological knowledge, your employees will feel more confident when things shift into crisis mode—whether it’s a natural disaster, a cybersecurity attack, employee error or a hardware failure. Employee education can lead to less downtime after a disaster, faster identification of a problem by IT professionals, and faster access to data backups to get essential information and keep things running.

Are you ready to take your IT support and employee education to the next level? Contact your managed IT services provider (MSP) for specific tips on things your employees should know about. Your MSP may even offer direct employee training assistance.

6 things your managed IT services provider should be doing to protect you

/in /by

Hiring a managed IT services provider is both a challenge and a necessity.

Today’s digital markets are experiencing escalating levels of cyber crimes so having an IT security expert is a requirement. However, the variety of services available and the extent to which those services are offered make it difficult to know which provider is right for your enterprise.

If you’re searching for a managed IT service to help with your organization’s security needs, consider how these options match up with your security concerns.

Protecting internal assets

Ensuring a tight digital perimeter is the first step to securing a company. Your managed IT services provider should ensure that your internal processes are safe.

Access to data

Most companies use authentication procedures to ensure only those authorized to access corporate data can access that information. These days, multi-level authentications are common and require every worker to pass through at least two portals to enter into company information vaults. You can also use the access process to limit who gets into which database, which is another security option.

Email safety

One of today’s biggest security threats is the phishing email. Your provider should have a robust spam and phishing filter to reduce or eliminate these threats.

Higher, stronger firewalls

One of the earliest forms of cyber protection remains one of its most valued services. Firewalls are hard- or software barriers that impede access by anyone without authority. Today’s firewalls deter known threats and can be reconfigured when new ones are discovered.

Protecting against external threats

Even with excellent internal protections, cybercriminals are still devising new threats to defeat them.

DDoS (Distributed Denial of Services)

These attacks are more frequent these days. They use multiple computers to attack a target server or network, then prevent users from accessing that server or network.

The nefarious brains behind the attack can be anyone from a single hacker to an organized crime ring (yes, those exist in cyberspace now). These attacks usually begin with the exploitation of a vulnerability within a server or network, which gives the attacker both an entry point and a home base. From here, the criminal can access multiple other computers, servers, and networks, infect them with malware, and cause the crash of the entire enterprise.

It’s worth it to pay more for heightened DDoS protections.

Mobile device vulnerabilities

Today’s “BYOD” (bring your own device) culture often permits workers to use their personal mobile devices for work purposes. By doing so, however, they open up innumerable vulnerabilities that most corporate security systems aren’t designed to handle.

Some companies curtail the threat with robust BYOD policies while others prohibit the practice entirely. Your managed IT services provider can identify for you how best to handle this situation within your organization.

IoT considerations

Think of the Internet of Things (IoT) explosion as an extension of the BYOD concern, only as a much, much bigger threat. There are hundreds of IoT devices available, some of which may already be installed in your facilities. Most of these digital items have little or no internal security features, so they can operate as an open portal within your enterprise.

Look for a comprehensive cybersecurity package that includes your IoT assets.

On a final note, remember that top-notch security doesn’t equate to complete compliance. If your company has compliance obligations, be certain that your new provider structures your services to meet those, too.

The essential components for complete ransomware protection

/in /by

For criminals, ransomware is big business.

The methodology is simple: attackers target a company with malware which encrypts their data, then send a request for money, usually in the form of Bitcoin or another difficult-to-trace cryptocurrency. Should the company refuse to pay up, their data will remain encrypted and inaccessible. Or it might even be shared publicly on the internet.

Given the potential damage both financial and reputational that might result, it’s no wonder that many companies choose to pay the ransom.

Kaspersky Lab noted a thirteen-fold increase in ransomware attacks in the first quarter of 2017 compared to the previous year. With the average cost of a ransomware attack sitting at over $1,000, the danger is a significant one . . . and no company is safe.

Victims range from small businesses to huge organizations, such as the UK’s National Health Service and aeronautical engineering firm Boeing. Whatever the size of your company, protecting data against ransomware is every bit as essential as physically protecting your premises from burglars.

Here are four things you can do to ensure that you are effectively protected against ransomware.

Backup everything, often

A robust backup plan can make all the difference to a company hit by a ransomware attack.

Rolling back to a previous version may make it possible to avoid paying the ransom and resume normal operations. But beware. Ransomware is becoming increasingly sophisticated. Many new viruses are designed to seek out backups and encrypt those as well.

To avoid this worst-case scenario ensure that you employ a backup solution with versioning or one that is physically disconnected from your system, like a cloud backup solution.

Train your staff

Every staff member in your organization is a potential entry point for malware. Many attacks still succeed largely due to human error.

Indeed the “WannaCry” attack which struck Boeing was transmitted by means of a zipped file attached to an email. In order for the malware to take effect, an employee within the organization had to unzip and run the file.

Train your employees to identify fake emails and encourage a culture of double-checking the origin of any suspicious attachments. Also, establish robust procedures for employees to follow when they think they might have exposed a device to malware. A swift response can isolate the machine in question and potentially save thousands of dollars in damages.

Stay up to date

There are many reasons to keep the operating systems, browsers and plugins up to date. Ransomware prevention is just one of them.

Many ransomware attackers gain entry to a system via weaknesses inherent in out-of-date plugins and other tech. By recommending (or, better yet, enforcing) updates, you can stay ahead of the criminals and keep your sensitive data secure.

Employ ransomware protection

Last, but by no means least, you should ensure that every machine (even personal devices used for work purposes) in your organization is running malware protection software from a reputable provider. While no program can prevent every single attack, most will be able to guard against a whole raft of common exploits.

If the worst does happen . . .

If you are subject to a ransomware attack and cannot recover your data from backup, your options are limited.

Paying the ransom might seem like the most sensible course of action, but there have been numerous cases in which doing so didn’t yield a decryption key. If that happens, you’ve only added an extra cost to an already-expensive situation.

An expert might be able to help you mitigate the damage, but it is vastly preferable to avoid attacks in the first place. The time to act is now—protect your data and ensure that your company doesn’t end up on the long list of ransomware victims.

The best IT support tasks to trust to your MSP

/in /by

Have you ever forgotten to install that Windows update you ‘rescheduled’ for a later date? How about installing those 5 new security patches?

Well, you were going to do it, but then you had a meeting. That meeting led to a mandatory orientation. From there, you nipped out for a cup of coffee and returned to an office with no working phone lines. Now, you must drop everything to troubleshoot while your computer systems remain open for attack without those oh-so-important security patches installed.

Welcome to the world of an IT technician.

With so many things to do, new systems to learn, new compliances to go over it’s little wonder these small problems grow out of control so quickly. Small businesses usually have small IT departments, so there’s not a lot of room for mistakes.

Outsourcing to a managed IT services provider (MSP) is an attractive proposition for both business owners and IT staff. It allows a trustworthy company with IT know-how to handle the most crucial tasks, while everyday business operations remain unscathed. IT techs can focus on growth-related tasks, while MSPs keep an eye out for alerts, updates and threats.

To get the most ROI from working with an MSP, outsource tasks that need more hands on deck to complete.

Tasks that you can easily outsource to an MSP are:

Security

Each year businesses spend millions in lawsuit payouts for data breaches, phishing scams and security compliance failures—and this isn’t the only loss businesses incur due to lapses in security.

According to Kaspersky, $1.3 million is lost each year on average due to cyber attacks. Sadly, much of this loss could’ve been prevented through simple data security measures. Many of the companies affected by security breaches had IT departments that were just too stretched to catch security threats before they created problems.

If the skills on your team aren’t as diversified as you’d like, or you lack the budget for a full-sized IT team, you can outsource your security to an MSP.

An MSP works hand and hand with your in-house IT team to deflect security breaches. This way your team can focus on pertinent tasks such as onsite equipment repair and installation, software setup, server maintenance and technical support.

Compliance Requirements

As you may have read recently, the EU introduced The General Data Protection Regulation (GDPR) rule requiring all businesses with clients/customers in the EU to tweak their Terms and Conditions. This new rule helps customers understand how their data is being used.

According to Intersoft Consulting, businesses that don’t comply with this regulation risk losing customers and incurring a penalty equaling 4% of the company’s global turnover or $20 million (whichever is the highest of the two).

Most businesses—if not all—simply cannot afford to lose this amount of money. Outsourcing your compliance watch to an MSP insures you’re on top of these new regulations when they are first introduced.

Updates

Since in-house IT departments work traditional business hours on average, they have a very small window to deal with a heap of technical issues. Phones, computers, software, hardware, servers and websites are all under their radar—but what about maintenance and updates?

As software companies work to keep the risk of technical issues to a minimum, important updates are required to continue using their programs in the most efficient way. These updates take hours and may not finish by the end of the workday.

Some updates can’t even begin until everyone’s logged out for the day. This means the update will run overnight. If there’s a glitch anywhere along the line, or permission screens prevent the update from completing, the whole process will be repeated again.

MSPs start and monitor the progress of these updates from start to finish. If there are any hang-ups along the way, they will troubleshoot allowing it to complete. Best of all, MSPs are available after business hours so the updates can be installed on time.

Troubleshooting

Occasionally, IT staff will run into a glitch they just can’t seem to troubleshoot. Glitches of this magnitude can grind business to a complete halt.

MSPs work along with onsite IT staff to troubleshoot and solve these issues as soon as they occur. This minimizes downtime and in some cases, prevents it entirely.

VOIP Service

More and more businesses are looking to VOIP cloud-based phone systems over traditional landlines. VOIP systems are flexible and allow businesses to conduct business from anywhere, anytime so long as there’s a good internet connection. This saves time setting up new phone systems and troubleshooting traditional phone lines when they go down.

VoIP service also makes a great addition to any disaster recovery plan as it allows workers to continue from remote locations. MSPs offer VOIP services which they monitor and troubleshoot all without disturbing your everyday business tasks.

Backup Services

Rolling blackouts and power surges go hand and hand—but you know what else goes hand and hand? A loss of data and corrupt software.

When systems suddenly blackout due to storms or power outages, improper shutdown creates an avalanche of glitches. These systems generally require hard resets, essentially losing all data stored within them. According to Computer World, Superstorm Sandy caused this very issue, forcing some businesses to close permanently due to an inability to recover data.

MSPs offer real-time backup systems ensuring that your latest keystroke is recorded and saved. In the event of an emergency, this data can be uploaded to a new system or reinstalled on your existing PCs.

 

No matter the size of your business, an MSP provides great value for service. Not only will you save yourself the nightmare expenditure associated with data breaches, but you can also relax knowing that your most important IT tasks are in good hands—inside and outside of normal business hours.

Why cloud computing is safe

/0 Comments/in , , , , , , , , /by

Cloud computing has been gaining popularity in the business space over the last couple years. Organizations are abandoning server-based data centers in favor of a third-party-provided solutions. Yet as more data is stored digitally, the danger of hacking grows. Companies are losing significant income to data breaches, and cybercriminals are developing new, sophisticated ways to steal data.

So why are companies taking their information to the cloud? Many executives want to push their businesses to the cloud but don’t fully understand how it works. As such, they may be wary over the idea of removing confidential information from complete corporate oversight. However, the cloud is not as penetrable as its name might imply.

Three factors driving cloud safety
According to Forbes, there are three principal factors helping to keep data secure when it is in a cloud platform. The first is redundancy. Losing data can be almost as harmful as having it stolen. When a server fails or a hacker gains access to a corporate network and deletes or attempts to ransom vital information, companies can lose months of productivity. Most cloud networks, however, typically keep data in at least three locations.

This means that lost data at one location, such as data loss caused by a server failure, will not have the disastrous impact that it could in an organization relying on an on-premise data center. By keep copies of each file, cloud solutions are making sure mission-critical data is accessible until the user no longer wants it.

The second factor is the safe sharing policy. Anyone who has ever used the popular Google Docs knows how file sharing works. Rather than making a copy, the user must enter the email address of anyone they want to see the file. These extra users can’t share the file on their own (unless given express permission), they simply have access to the information. This is how safe sharing works. It prevents any unauthorized copies from being created or distributed. Users have access to their own data and can control exactly who sees it.

The last factor driving cloud safety is encryption. Provided a user keeps track of their password, it is very difficult for a hacker to gain access to the files. They are being stored either entirely in the cloud or at a secure, remote facility in an unknown location. Since the user’s connection to this information is encrypted, following it to gain access would be difficult, if not impossible for a human hacker.

“Cybersecurity today is more about controlling access than managing data storage.”

It’s all about access
As TechTarget pointed out, cybersecurity today is more about controlling access than managing data storage. When hackers breach data, they typically do so because they have access to sensitive information. This can be a password or even a corporate email address. Cybercriminals infiltrate and steal information based on the access they’ve gained, typically from an unknowing authorized user.

Cloud solutions help monitor this access, keeping secure data under control. The providers offering these platforms have the expertise and the resources to keep cybersecurity evolving alongside the threats. In most cases, they have more resources than the client companies using their solutions.

The cybersecurity arms race
One popular cloud vendor is Microsoft. Each year the company invests over $1 billion into cybersecurity initiatives for its Azure platform. The money, explained Azure Government CISO Matthew Rathbun in an interview with TechRepublic, isn’t just about maintenance, it is about innovation:

“Ninety percent of my threat landscape starts with a human, either maliciously or inadvertently, making a mistake that somehow compromises security,” said Rathbun. “In an ideal state, we’re going eventually end up in a world where there’ll be zero human touch to an Azure production environment.”

Overseen by talented specialists with ample resources, cloud solutions are a safe form of data protection in today’s digital business space.

Is physical data destruction completely secure?

/0 Comments/in , , , , , , , , /by

Cybersecurity is a paramount issue facing businesses in the digital world. The average costs of a successful cybercrime in 2017 were roughly $1.3 million for large enterprises and $117,000 for small- to medium-sized businesses, according to Kaspersky Lab. These figures include the cost of data theft but do not encompass the additional potential price of a damaged reputation and ensuing legal action. Data also indicates that cyberattacks will become only more expensive and damaging in the coming years.

Defending an organization against cybercrime requires a multi-channel approach. Companies should be open to software solutions, employee training and hardware upgrades whenever necessary. However, another avenue for cybercrime is occasionally overlooked. Physical theft of connected mobile devices, laptops and even desktop computers can lead to an open pathway for cyberattacks. In addition, some businesses simply sell their used electronics without first doing a proper data cleanse.

But can information to completely and permanently removed from a hard drive?

Hard drives are traditional data collection units that can be altered in a number of ways. However, the question is "can data be permanently removed."Hard drives are traditional data collection units that can be altered in a number of ways. However, the question is "can data be permanently removed?"

The levels of data destruction
Deleting data is not as secure as some might assume. In actuality, when information on a computer is "deleted," the files themselves are not immediately removed. Instead, the pathing to that information is expunged. The data is also designated as open space, so the computer will eventually overwrite it. However, until this rewrite occurs, it is relatively easy for the information to be restored and accessed by any tech-savvy user.

Fortunately for organizations trying to permanently dissolve their data, deletion is only the first step of the process. Lifewire recommended three additional methods to ensure that information remains lost.

First comes software – using a data destruction program on the hard drive. This method has been met with approval from the National Institute of Standards and Technology as a secure way to permanently remove information from a hard drive, according to DestructData. However, drawbacks include resource consumption, as this can be a time-intensive process. In addition, some overwriting tools can miss hidden data that is locked on the hard drive.

The most secure method to completely remove data is degaussing. Hard disk drives operate through magnetic fields, and degaussers alter those waves. The result is a drive that can never be read again. In fact, the computer will not even register it as a hard drive from that moment on. However, the downside in this process is twofold: One, the drive is useless after degaussing. Two, this method can on only hard disk drives. Solid state drives and flash media do not use magnetism in the same way, so a degausser will be ineffective.

The final option is to physically destroy the data drive. While many people think that this task can be done with patience and a hammer, it is unfortunately not that simple. Hard drives can be rebuilt with the right tools and expertise. According to the Computer World, NASA scientists were able to recover data from the charred wreckage of the Columbia shuttle after its disastrous explosion and crash in 2003.

Computers that are simply thrown out can still possess classified data, which can return to haunt the company. Computers that are simply thrown out can still possess classified data, which can return to haunt the company.

The resiliency of hard drives
In short, it can be difficult to permanently expunge data from a hard drive. This reality is in part why businesses are opting for less internal data centers and more dependency on cloud solutions. According to TechTarget, cloud solutions represent a more secure method of data organization than traditional IT infrastructure.

While data can be safely deleted, the reality is, unless a degausser is used, there is always some chance of information recovery. Cybercriminals are becoming more sophisticated, and given the expensive nature of dealing with data breaches, it is understandable why the cloud is becoming the preferred solution.

5 things every employee in your company needs to know about phishing attacks

/in /by

First things first, just to make sure we’re all on the same page.

Phishing is a type of cybersecurity attack. Someone impersonates a legitimate entity to try to persuade the recipient to hand over sensitive information. Most phishing happens via email.

Compared to other forms of hacking, phishing is quite easy to execute. In fact, the first “phishers” used AOL in the 1990s to get information from unsuspecting AOL users. These attacks were painfully simple. But here’s the kicker. They didn’t differ much from phishing attacks of today!

The attackers simply pretended to be AOL employees. Even if only a few victims believed their ruse, the attack was worth it. That’s because if even one person falls for a phishing tactic, the results can be devastating.

Here are the fundamental things all your employees need to know to protect your company from phishing attacks.

1. Phishing can happen anywhere

While most people think of phishing as occurring exclusively via email, it can also happen on social media sites, in messaging apps, and through any method of online communication.

If your employees are communicating anywhere online, they need to make sure they really know who is at the other end.

2. Phishing can get complex

Some phishing attempts are just hackers sending out emails to a random group of people and hoping one of them will bite. But an increasing number of phishing attacks are getting more sophisticated.

In some cases, hackers will spend months or more building a relationship with the target through false social media profiles and frequent communications. This combines catfishing and phishing, forming a dangerous combination.

After a while, the target grows comfortable with the hacker and trusts them enough to share personal information.

3. Phishing costs businesses a lot

Some sources estimate that phishing attacks may cost American businesses up to $500 million per year, with thousands of businesses targeted and more personal consumers attacked at home.

That figure comes only from the attacks that were investigated by the FBI over a period of three years, so it is likely that the total cost to US businesses is more than that.

4. There are multiple types of phishing attacks

There are a few major types of phishing attacks. The most basic is when attackers email a random group of people and hope that a few of them will fall prey to the scam.

“Spear phishing” is a targeted attack that centers on one organization or a group of individuals. Attackers pretend to be someone from within the organization—a client or vendor—in order to infiltrate and get access to sensitive information. Some spear phishers are able to hack into organizational communication systems so the messages really do appear to be coming from the inside.

“Whaling” is when a spear phisher goes after a huge target.

5. Here’s how you can recognize phishing

There are many trademarks of a phishing attack. Educating employees about these signs can save your business a whole lot of money. Some of these may seem a bit obvious, but to those who are not as savvy, it’s important information that could stop an attack.

Phishing emails often come from addresses that seem like they could be legit. But if you examine the address more closely you’ll notice that it’s a little off. Perhaps it’s one letter off from the company’s actual name or the email address doesn’t follow the convention of other people you have met from that organization. You will find a similar situation with URLs in phishing messages.

Many phishing emails have bad spelling and improper grammar, typically due to poor translations. If it was coming from a legitimate organization, typos are possible, but not usually at the magnitude seen in phishing emails.

Finally, if a message seems too good to be true, it probably is!

Use these tips to avoid harmful phishing attacks. For more information on how to protect your business, be sure to contact your IT support partner.

5 things every employee in your company needs to know about phishing attacks

/in , , , /by

First things first, just to make sure we’re all on the same page.

Phishing is a type of cybersecurity attack. Someone impersonates a legitimate entity to try to persuade the recipient to hand over sensitive information. Most phishing happens via email.

Compared to other forms of hacking, phishing is quite easy to execute. In fact, the first “phishers” used AOL in the 1990s to get information from unsuspecting AOL users. These attacks were painfully simple. But here’s the kicker. They didn’t differ much from phishing attacks of today!

The attackers simply pretended to be AOL employees. Even if only a few victims believed their ruse, the attack was worth it. That’s because if even one person falls for a phishing tactic, the results can be devastating.

Here are the fundamental things all your employees need to know to protect your company from phishing attacks.

1. Phishing can happen anywhere

While most people think of phishing as occurring exclusively via email, it can also happen on social media sites, in messaging apps, and through any method of online communication.

If your employees are communicating anywhere online, they need to make sure they really know who is at the other end.

2. Phishing can get complex

Some phishing attempts are just hackers sending out emails to a random group of people and hoping one of them will bite. But an increasing number of phishing attacks are getting more sophisticated.

In some cases, hackers will spend months or more building a relationship with the target through false social media profiles and frequent communications. This combines catfishing and phishing, forming a dangerous combination.

After a while, the target grows comfortable with the hacker and trusts them enough to share personal information.

3. Phishing costs businesses a lot

Some sources estimate that phishing attacks may cost American businesses up to $500 million per year, with thousands of businesses targeted and more personal consumers attacked at home.

That figure comes only from the attacks that were investigated by the FBI over a period of three years, so it is likely that the total cost to US businesses is more than that.

4. There are multiple types of phishing attacks

There are a few major types of phishing attacks. The most basic is when attackers email a random group of people and hope that a few of them will fall prey to the scam.

“Spear phishing” is a targeted attack that centers on one organization or a group of individuals. Attackers pretend to be someone from within the organization—a client or vendor—in order to infiltrate and get access to sensitive information. Some spear phishers are able to hack into organizational communication systems so the messages really do appear to be coming from the inside.

“Whaling” is when a spear phisher goes after a huge target.

5. Here’s how you can recognize phishing

There are many trademarks of a phishing attack. Educating employees about these signs can save your business a whole lot of money. Some of these may seem a bit obvious, but to those who are not as savvy, it’s important information that could stop an attack.

Phishing emails often come from addresses that seem like they could be legit. But if you examine the address more closely you’ll notice that it’s a little off. Perhaps it’s one letter off from the company’s actual name or the email address doesn’t follow the convention of other people you have met from that organization. You will find a similar situation with URLs in phishing messages.

Many phishing emails have bad spelling and improper grammar, typically due to poor translations. If it was coming from a legitimate organization, typos are possible, but not usually at the magnitude seen in phishing emails.

Finally, if a message seems too good to be true, it probably is!

Use these tips to avoid harmful phishing attacks. For more information on how to protect your business, be sure to contact your IT support partner.

The biggest cybersecurity breaches of 2017 and what we can learn from them

/in /by

If we’ve learned anything from the biggest cybersecurity breaches of 2017, it’s this: no one is immune from online threats. Not even the largest companies with millions in technology resources, serious cybersecurity measures and strong reputations as household names.

2017 came and went with multiple significant cybersecurity breaches involving major organizations. And the bad news doesn’t stop there. Cybercriminals aren’t going anywhere. Cybersecurity breaches are still very much a thing.

The average cost of a data breach in 2020 will exceed $150 million by 2020, as more business infrastructure gets connected. – Juniper Research

Here are three of the biggest cybersecurity breaches of 2017, what happened, and what we can learn from them.

Equifax

One of the worst breaches of all time happened in 2017 with Equifax. Equifax, as you almost certainly know, is one of the three largest credit agencies in the United States. Their data, the data that was compromised, is extremely sensitive.

Stolen information included names of customers, their dates of birth, credit card numbers, addresses, driver’s license numbers, and social security numbers. That’s pretty much everything a cybercriminal needs to engage in identity theft.

Verizon

In July of 2017, Verizon had a major cybersecurity breach that affected over 14 million subscribers.

A third-party analytics provider, NICE Systems, was using Amazon’s S3 cloud platform to store “customer call data” from telecom providers including Verizon. – Forbes

While this breach was claimed to have been brief, the 14 million affected had their data exposed, including their names, addresses, phone numbers, and most importantly, their plain text PINs. Again, this is prime information for identity theft.

This happened because some of Verizon’s security measures simply weren’t set up the right way.

Instead of a private security setting, the information was made public. Anyone with the public link could see the Verizon data, which was stored on an Amazon S3 storage server—a commonly used cloud storage for data.

Uber

While Uber’s security breach wasn’t at the same level as the Equifax or Verizon cybersecurity breaches, it was still embarrassing and alarming. In this case, the worst of it was how Uber managed things in the aftermath of the cybersecurity breach.

Uber paid a 20-year-old hacker $100,000 to keep quiet after he managed to get his hands on the personal data of 57 million users.

Instead of being transparent about the leak, Uber tried to conceal it. Not only is that illegal in California, where the home company is based, but it further erodes customer confidence. Any company that falls prey to a cybersecurity breach will take a hit to their reputation. But if you continue to mishandle things, your reputation can suffer even more.

Just ask the folks at Uber.

What we have learned

One of the major takeaways here is that while the cyberattacks have grown sophisticated and complex, there’s a lot companies of all sizes can do to be proactive. The threat is valid, but if you address potential vulnerabilities in a timely manner, you’ll be able to avoid making these kinds of headlines.

For instance, the Equifax attack was due to a flaw in a web application, Apache Struts. The tool is used to build web applications. And here’s the kicker. The problem that led to the breach was identified months earlier, but all of the Equifax machines were not updated. This allowed hackers the ability to enter.

The Uber fiasco illustrates another compelling point. If you do suffer a cyberattack, there are good ways to handle the situation and bad ways to handle it. Restoring customer trust is critical, so it’s best to be transparent and take full responsibility.

Protecting your company from a cybersecurity breach

Your company’s critical data must be protected not only for your customers and their peace of mind but for the sake of your data, as well. You need to stay ahead of ever-changing threats. Cybercriminals are constantly changing their tactics. You have to constantly adjust your protection just to keep pace.

Know where your data is stored, how it’s protected, how often that protection is updated, and utilize data analytics to strategically update your protection as needed.

Cybersecurity breaches are on the rise. Companies must take proactive steps in order to keep their data secure.