Menu

sarahd

About sarahd

Posts by :

Untitled-design-6

Are you on a Hacker’s watchlist?

, , , 0

Breaches: Part 1

Why a comprehensive cybersecurity strategy is important to your business?

Here’s an alarming statistic for Small Business owners: 65% of cyber-attacks are aimed at small to medium businesses.

If you’re a small business owner, you’re aware that your company might be vulnerable to attacks by hackers. Even if they haven’t found a way to break into your system yet, you can be sure someone is trying to find a way to steal your precious data. Hackers enjoy a challenge, to a point. If they can’t crack your system the first time, it’s more than likely that they’ll keep trying.

If they can’t get in they’ll eventually go away, but that doesn’t mean they won’t be back.

There is a good chance a hacker is watching your business right now. And a chance someone has already breached your security. According to one study, it takes an average of six months for businesses to realize that they have been, or are being, hacked. It then takes up to 55 days to confront and suppress the attack. By then it’s too late: the damage has been done.

But why do hackers target small businesses? Some of the reasons are obvious, and some may surprise you. Here is a list of 6 reasons why Small Businesses get hacked:

  1. Under the Radar

Not every hacker wants to be famous. Most don’t care about getting their conquests splashed all over the news. Many hackers attack small to medium businesses because those groups are less likely to report security breaches. The first reason for not reporting the breach is that the damage to their reputation can be much more expensive than the temporary loss of revenue, or the price of the ransom they’ll pay to retrieve their data. The second reason attacks go unreported is because law enforcement agencies are not cybersecurity experts.

2. Complacency

Businesses go through cycles; some good, some bad, but hopefully at the end of the day those cycles will all lead to company growth. While planning budgets, new hires, and equipment purchases for growth, frequently the security updates and back-up (BDR) hardware needed to protect that growth will fall through the cracks. Your old security software probably won’t be good enough to take you safely into the future. Sure, it got you where you are, but don’t rely on it just because it’s been “good enough” up to now.

  1. Smaller budget for Security

It’s no secret that occasionally, especially during growth phases, budgets get shifted around, and what was allocated for security last year may not be in the budget this year. An alarming 90% of small businesses admit to operating occasionally with no security system in place at all. No virus protection, no firewalls, no spam filters, and no back-up systems. The scary part is that the remaining 10% probably just didn’t want to admit it.

  1. Lack of proper employee training

Here’s an alarming statistic for you: up to 95% of ALL cybersecurity breaches that hit small businesses are due to human error. You try to stay on top of cybersecurity training for your staff, but people come and go all the time and training is bound to get put on the back burner. Sometimes breaches happen because simple procedures aren’t followed correctly. Password hygiene is a basic skill everyone should know; things like how to create a password, and why you should never write down your password and leave it posted to your computer. Not opening attachments to emails is also important, since over 92% of all malware is delivered via email.

  1. Usually quicker to pay the ransom

One study has shown that 53% of small businesses will pay the ransom to hackers upon contact with them. This is related to our first topic, “Under the Radar,” since the reasoning behind paying quickly should mean you’ll experience a shorter downtime. Paying the ransom is still no guarantee that you’ll get your data back. After all, these are criminals you’re dealing with. Plus, when you pay a hacker, you only encourage them to continue attacking businesses like yours.

  1. You’ve been hacked before

Hackers are like sharks: they can smell blood in the water from miles away. Once the word gets out that you’ve been hacked, and that you’ve paid the ransom, you’ll have hackers lined up around the block. Like a lot of criminals, hackers are looking for the path of least resistance. Once they hear you’re an easy target you’d better prepare yourself for all kinds of cyberattacks.

It takes work to develop a comprehensive cybersecurity strategy, train your employees on what to look out for, and maintain regular data backups, but all these things and more are necessary in today’s cyber landscape. Almost every day there are news stories about companies getting hacked, corporations paying millions in ransom, and small businesses closing because of hacks. Companies like Apple, Amazon, Target, and Facebook can afford the best security available, yet they still get hacked. Make cybersecurity a priority for your business and you’ll increase your chances of staying off a hacker’s watchlist.

Untitled design (5)

Training your Team to be the Best!

, , 0

March Madness of Cybersecurity: Part 2

Cyber threats are always on the rise, and businesses are constantly looking for ways to protect themselves. One of the most effective ways to train your team is through gamification.

What’s That?

Gamification is the process of using game design elements and principles in non-game contexts to engage users and solve problems. It is a powerful tool that can help organizations improve employee training and development. Gamification can be used to create immersive and interactive learning experiences that are more engaging and effective than traditional training methods. It makes learning more fun and interactive by incorporating game elements such as points, badges, levels, and leaderboards. This helps employees stay engaged and motivated to learn!

How It Works

We include this approach in our own cybersecurity training program for your team. This includes phishing simulations and scenarios that replicate real-world cybersecurity threats. This allows employees to experience and learn how to deal with cyber-attacks in a safe and controlled environment.

This can provide immediate feedback to employees, allowing them to learn from their mistakes and improve their skills. This can help identify areas where employees need further training or support.

It can also reinforce learning by incorporating repetition and feedback. This can help employees retain information and apply it in real-life situations.

And finally, it’s fun. Gamification can create a sense of competition and motivation to learn among employees. This can lead to improved learning outcomes and a stronger cybersecurity culture within the organization.

This effective tool for training employees and improving cybersecurity is just one component of our solution. By making learning more engaging, interactive, and effective, it can lead to a better-trained workforce and a more secure organization.

As cyber threats continue to evolve, organizations must invest in employee training and development to stay ahead of the curve, and we can help your business to achieve this.

Untitled-design-4

The MVP of Your Business’s Cybersecurity is YOU!

, , , 0

March Madness of Cybersecurity: Part 1

As a small or medium-sized business owner, you may not have the same level of resources as large corporations. However, that doesn’t mean you should overlook the importance of protecting your business from cyber threats.

Identifying the most critical aspects of your business that need protection and focusing your resources on those areas is a start, but there’s one component that can protect the business as a whole: your team.

The “MVP” or Most Valuable Player mindset puts your employees at the forefront of defense.

We can help you to make your entire team a roster of MVPs. We’ll perform a security risk assessment to identify gaps or any risks. This will review your business’s digital assets, including customer data, financial information, and intellectual property. We will identify which of these assets are critical to your business’s success and could cause the most damage if they were compromised.

Next, we’ll implement measures to protect those critical assets. This will include using strong passwords, multi-factor authentication, and encryption to secure your data. We will also implement our ongoing cybersecurity training program. This will help your employees recognize and avoid potential threats like phishing emails or malware.

Then we’ll create a plan in place for responding to a cyber-attack. This will include clear protocols for reporting and responding to security incidents, and make sure all employees are aware of the steps they should take in the event of an attack.

We’ll regularly review and update your cybersecurity measures as new threats emerge. By taking a proactive approach to cybersecurity and focusing your resources on protecting your most valuable assets, you can help reduce the risk of a damaging cyber-attack on your SMB.

Untitled design (3)

What you didn’t know

, 0

Backup Disaster Recovery: Part 3

Should’ve seen it coming…

You’ve invested in a BDR and now sleep more soundly at night, but the hardware itself is really only part of the solution. You want to ensure your provider does preventative maintenance, periodic testing, multi-location storage, and staff training. Having these things in place will help avoid downtime if the worst happens.

Preventative Maintenance: In addition to the hardware itself, a solid backup solution also has its own backup including generators, backup batteries, cooling systems, fire detection, suppression systems, and redundant cloud storage. You can’t necessarily head to your provider’s office to see for yourself, but you can read the fine print on your contracts as well as have meaningful conversations with potential providers.

Periodic Testing: Consistently ensuring everything is running as it should will allow you some peace of mind as well as lay the groundwork for successful backup. This goes beyond simply testing backup software or cloud storage. A good backup provider will run regular testing and provide reports on the health of the backup, size, and any glitches that you might be facing. This testing should also include 24/7 monitoring and alerting of any potential issues including cyberthreats or outages.

Multi-Location Storage: Regardless of how safe a location may seem, data needs to be stored in more than one location. Think about it; if the backup server for your company is sitting in a location that sees seasonal hurricanes or is located on top of an active earthquake fault, your data is still in danger. It’s about backing up your backup.

Team Training: Don’t leave it all to your IT company. When it comes to backup, security, and other breaches, employees truly are the weakest links. Cybercriminals are going after these individuals rather than attacking at a network level because they are easier to infiltrate. Make sure you have regular cybersecurity training in place for all employees to limit these potential breaches. Creating a strong disaster recovery plan is not all about the recovery part, prevention is equally important too.

Untitled design (1)

Are you protecting the right data?

, 0

Backup Disaster Recovery: Part 2

You’re ready to purchase a BDR. You’ve done all of the research, found a company you’re confident in and are excited to finally have peace of mind. Now, you start thinking about exactly what you need to back up. Is all of your data necessary or should you salvage a little server room? Most businesses want to back up everything – you never know when you’ll need it, but sometimes that is cost prohibitive.

Depending on what kind of BDR you’ve purchased, you will first need to delegate what data is stored, is not stored, and how often. There are three different kinds of backup in today’s tech world: straight to cloud services, software-based products, and a hybrid approach that combines on-site hardware and software with the cloud. The amount of data you can back up, how you can segment that data, how often it’s backed up, how it’s backed up (all the data every time creating enormous backups, versus incremental backups that key-in on changes) and how easy it is to access will be affected based on the solution you chose. It’s not always necessary to back up everything daily, but there are some things you will want to consider.

First is credit card transactions or receipts. Your accounting software should keep an eye on this and automatically back up this data. This also includes things like invoicing, receivables, payroll and just about anything that is financially related. All financials are incredibly important, even one lost invoice could really hurt your business.

Second, protect all intellectual property. Unless you’re rocking an amazing vault to store a famous recipe like Coca-Cola or KFC, make sure that you back up everything that brings you a competitive advantage in the marketplace. Anything with hackable data or items that could be compromised need to be backed up daily as well.

Next, you will want to back up any client files. Not only is it invaluable to keep this information safe, but it would certainly affect your client confidence if anything was lost or stolen. In addition to client files, make sure you’re backing up your client and prospect lists (anything that you’re storing in your CRM, really). You spend a great deal of time developing your list for marketing purposes. Losing this information is one of the major reasons companies go out of business within six months of experiencing data loss.

Finally, you must back up all project management software. Anything that your business uses to keep track of daily activities and work being done needs back up to make sure that you can maintain progress in the event of a data loss and you maintain a “paper trail” on project communication.

When it comes to BDR, you ideally want to back up every piece of data that you have. Sometimes, though, this is impossible based on the cost involved in maintaining that hefty data chain. At the bare minimum, keep these items in mind and you should never have to deal with a business killing disaster.

Untitled design

What Could Happen Without a Plan

, 0

Backup Disaster Recovery: Part 1

Backup Disaster Recovery is one of those things that all businesses need to have in case of disaster. Whether it’s a natural disaster such as a tornado, a hardware failure, or even an attack from a hacker. Anyone of these could permanently disable your business if you aren’t prepared or have a proper backup plan. For those of you still backing up data manually on tapes or *cringe* not at all, here are some reasons why you need a BDR solution and should stop tuning out potential disasters.

First of all, a data disaster is more common than you might think. Currently, 58% of SMBs are not prepared for data loss. Even worse, 60% of SMBs that lose their data will shut down within six months. Something that could have been prevented could potentially wreck your business, especially scary to think about when 29% of hard drive failures are caused by accident. It would be silly to have human error or a simple mishap put your company out of business.

You may have security protocols in place and your employees are well versed on avoiding things like malware. Well done. However, you’re still not protected. Human error is a large culprit in data loss. It could be unintentionally deleting items or accidentally overwriting data, but these “oops” can hit hard. Human error can result in other kinds of hardware damage like liquid damage from spills or even accidental reformatting. All of these things are possible and have happened to many SMBs before you. Sometimes recovery is possible from the software platform you were using, maybe your computer has your back and caught these things. It’s still a time consuming and money wasting error to fix, even if you are lucky to recover some of what you lost.

Viruses and malware can be a significant cause to software or hardware damage depending on what kind of bug found its way in. Usually, this can be avoided with proper employee training as well as an awesome firewall that will help filter malicious attacks. Yet another prey in the night is social engineering – the art of conning people. Hackers have been known to get into server rooms and other data-centric areas of the business. Employees may not even notice their mistake until it’s too late. I guess the “HVAC guy” turned out being a hacker in disguise.

Sometimes software corruption can come from unknown viruses lurking around your computer. However, most of the time it is due to improper usage. Things like not shutting down the computer properly or leaving unsaved documents open. Sometimes even a power outage can trigger corruption. Once the software processes are interrupted and damaged, it’s virtually impossible to recover data stored in the software.

Did you know that 140,000 hard drives crash every week? With that kind of number, it’s just a matter of time until it happens to you. That is not a comfortable position to be in if you know you don’t have backup. Unfortunately, hard drive corruption is usually due to mechanical issues. Things like age and dust build up can (and will) cause technology to fail. We’ve all used the old laptop we still have that’s been on its deathbed for months, freezing frequently, taking for-ever to load a webpage, and of course, acting as a heater for your lap or desk. All of these things are signs leading to a crash. You may not care if it’s an old hand-me-down laptop from the ’90s, but you will care when it’s your pricey equipment with all of your product data and client information stored on it.

Finally, good old-fashioned acts of God. You can’t necessarily prepare for a natural disaster. Even if you hear the tornado siren, backing up your servers to tape will take longer than it will for the tornado to hit your business. Then what? That tape is left amongst the rubble, destroyed. This may seem like an exaggeration, but it has really happened to businesses. And even if only hypothetical, it makes for a great metaphor for any other crash within your business. This is also proof that on-site BDRs may not always be the final protective cover to your business. You may want to consider off-site or cloud data storage to ensure protection, so your data is safe even if your equipment is destroyed.

Protect your business and keep it running smoothly and successfully. Backup Disaster Recovery options are available for all kinds of SMBs and their needs. Don’t wait to be taught a lesson by the “big one” (as most California residents say). Protect your important data and enjoy the peace of mind that comes along with it. You’ve worked too hard to get your business where it is. Protect your hard work.

Latest Technology

Compliance is a Team Project

, , , , 0

Compliance Series: Part 3

With all the rules and regulations surrounding the compliance alphabet soup in play today, it will take more than one person to bring your company in line. We’ve laid out the multiple roles needed to up your compliance game, especially when it comes to HIPAA, PCI, and GDPR.

IT Team

Your first line of defense against compliance failures is the technology in use and the team you have to maintain it. Consult with your IT team to discuss:

  • Email Encryption: How are emails and files that go in and out of your office protected to avoid nefarious hands and revealing identifying information?
  • Data Encryption: How do you collect and retain credit card information? Are there any gaps where that information could be stored or released in an identifiable way?
  • Firewall: Are you protecting your company data and communications using a screen door that is easily opened by hackers, or are you using a multi-level security system preventing intrusions?
  • Backups: How often, when and where is your precious company information backed up? Can you test your backups to prove that they’re effective? Is your current backup plan compliant with regards to customer data?
  • Data Availability and Storage: Who has access to your data? Only certain individuals in your company should be able to access all data, like financial records or payment information. How are you restricting access on your network or within line of business applications to ensure safety?
  • Physical Access: Who can actually access computer systems and servers? Do you train your staff to lock their systems every time they leave their desks? Are you using privacy filters on appropriate screens to avoid wandering eyes?

Internal Compliance Officer

While this may not need to be a full-time role within your organization, you should have a compliance champion on staff. Your IT company can absolutely set you up for success, but they are not around to police your staff every hour of the workday.

The Compliance Officer is responsible for ensuring that your staff follows important compliance policies, maintains vigilance surrounding compliance, keeps documentation up to date, and works with authorities if necessary. Specifically, they:

  • Watch for employees falling into bad habits, like leaving computers unlocked or sending credit card data willy-nilly throughout the organization.
  • Conduct/coordinate online or in-person training to keep compliance top of mind. We recommend quarterly training, at least, in addition to proper education as soon as a new employee comes on board.
  • Maintain all the documentation required for compliance, like backup plans and communication standards.
  • Liaison with federal and state regulators, as necessary to prevent or mitigate an issue (with the support of your IT Team and legal team).

All Employees

You can have the best technology, the most intense compliance officer, and still completely fail at successful compliance if your employees are not onboard. At the end of the day, it comes down to successful employee implementation and clear communication. In order to get employee buy-in, here is what we recommend:

  • Gather everyone together: When you first make tweaks to your company’s security protocols to ensure compliance, explain why to your team. If they suddenly all need to remember 16-character passwords, replace those passwords every 90 days and have 5-minute time outs on their systems; they’d appreciate learning it’s not because you’re paranoid. You can utilize your IT Team to conduct this meeting.
  • Send regular reminders: It’s simple to fall into what’s “easier” rather than compliant. Consider sending a weekly or monthly compliance tip to all of your staff to keep it top of mind.
  • Conduct ongoing trainings: These trainings should be mandatory, involve your IT team, and vary enough to stay interesting. Quarterly should be sufficient unless some regulation change calls for additional meetings.
  • Multi-departmental planning: Different teams have different uses for data. For example, what makes the salesperson tick may make it impossible for accounting to operate within compliance. When it comes to collecting information that must be compliant, every department must be involved in process development to create smooth operation within rules and regulations.

Compliance is not a one-man game. It involves the whole company and IT team engagement to really be successful. Next blog, we’ll cover the processes necessary to build a compliance-friendly environment.

Professional,Financial,Experts,Collaborating,During,Brainstorming,Meeting,Listening,Information,From

GDPR – Should you Care?

0

Compliance Series: Part 2

In 2018, the European Union enacted a new directive to protect its citizens from having their personal information stolen or sold known as GDPR or General Data Protection Regulation. This legislation protects EU citizens, but in reality, it is a global law at this point. Any businesses in the world that mishandle the personal information of an EU citizen, including something as simple as improperly tracking a cookie on your website, could be fined for non-compliance. Those fines are not cheap. A company failing to comply with the regulation could be subject to a 4 percent forfeiture of its annual revenue. In its first year, there were 95,000 complaints from Data Protection Authorities all over the EU. It’s here to stay, so should you care?

Of the 95,000 complaints received, telemarketing, promotional e-mails, and video surveillance were the top culprits. So far, three fines were issued by DPAs for GDPR violations. The largest fine issued was in the sum of €50,000,000 for lack of consent to processing personal data. Compliance is no joke and it can be tricky to implement. 50% of all businesses still have not migrated into the world of GDPR compliance, though they know it could end in litigation. This carries over for American companies that either employ EU citizens or service them. Even though your business is in the states, you can still get fined from across the pond.

The main idea behind GDPR is protecting citizens and consumer rights. Not only are businesses held responsible for storing people’s information, but they are also held accountable if any misuse occurs to that information. If data is hacked, that business is obligated to report it within 72 hours of the breach and give a detailed account of the data that was stolen. In addition, under GDPR, citizens can request to have their information taken out of data storage, and a business must comply.

Currently, social media networks and automated email services are the heaviest hit by GDPR. Facebook has seen a steady decline in European consumers. Also, it has cracked down on how people can use FB ads when targeting certain audiences. Email marketing has seen an increase of opt-outs and tighter spam regulations, changing the marketing game for many companies.

In order to become compliant with GDPR, you will need to first appoint someone as your DPO, or data protection officer. This person will be the point of contact and GDPR expert. They’ll need to be able to handle IT services as well as monitor all the data handling processes in your company. Then, of course, they’ll need to be able to consistently monitor any area that may be impacted by GDPR and ensure they’re within compliance. It is highly recommended that the DPO goes through thorough training on the subject so they know exactly what to look for when it comes to staying compliant.

GDPR is great at protecting citizens, and most professionals believe it’s only a matter of time before the United States adopts similar regulations. It’s always better to be prepared, so perhaps it’s time to look into GDPR compliance.