Uncategorized

December 9 2021

Is your data prepared for a disaster?

Should’ve seen it coming…

You’ve invested in a BDR and now sleep more soundly at night, but the hardware itself is really only part of the solution. You want to ensure your provider does preventative maintenance, periodic testing, multi-location storage, and staff training. Having these things in place will help avoid downtime if the worst happens.

Preventative Maintenance: In addition to the hardware itself, a solid backup solution also has its own backup including generators, backup batteries, cooling systems, fire detection, suppression systems, and redundant cloud storage. You can’t necessarily head to your provider’s office to see for yourself, but you can read the fine print on your contracts as well as have meaningful conversations with potential providers.

Periodic Testing: Consistently ensuring everything is running as it should will allow you some peace of mind as well as lay the groundwork for successful backup. This goes beyond simply testing backup software or cloud storage. A good backup provider will run regular testing and provide reports on the health of the backup, size, and any glitches that you might be facing. This testing should also include 24/7 monitoring and alerting of any potential issues including cyberthreats or outages.

Multi-Location Storage: Regardless of how safe a location may seem, data needs to be stored in more than one location. Think about it; if the backup server for your company is sitting in a location that sees seasonal hurricanes or is located on top of an active earthquake fault, your data is still in danger. It’s about backing up your backup.

Team Training: Don’t leave it all to your IT company. When it comes to backup, security, and other breaches, employees truly are the weakest links. Cybercriminals are going after these individuals rather than attacking at a network level because they are easier to infiltrate. Make sure you have regular cybersecurity training in place for all employees to limit these potential breaches. Creating a strong disaster recovery plan is not all about the recovery part, prevention is equally important too.

December 2 2021

What Could Happen Without a Plan

Uncategorized 0

Backup Disaster Recovery is one of those things that all businesses need to have in case of disaster. Whether it’s a natural disaster such as a tornado, a hardware failure, or even an attack from a hacker. Anyone of these could permanently disable your business if you aren’t prepared or have a proper backup plan. For those of you still backing up data manually on tapes or *cringe* not at all, here are some reasons why you need a BDR solution and should stop tuning out potential disasters.

First of all, a data disaster is more common than you might think. Currently, 58% of SMBs are not prepared for data loss. Even worse, 60% of SMBs that lose their data will shut down within six months. Something that could have been prevented could potentially wreck your business, especially scary to think about when 29% of hard drive failures are caused by accident. It would be silly to have human error or a simple mishap put your company out of business.

You may have security protocols in place and your employees are well versed on avoiding things like malware. Well done. However, you’re still not protected. Human error is a large culprit in data loss. It could be unintentionally deleting items or accidentally overwriting data, but these “oops” can hit hard. Human error can result in other kinds of hardware damage like liquid damage from spills or even accidental reformatting. All of these things are possible and have happened to many SMBs before you. Sometimes recovery is possible from the software platform you were using, maybe your computer has your back and caught these things. It’s still a time consuming and money wasting error to fix, even if you are lucky to recover some of what you lost.

Viruses and malware can be a significant cause to software or hardware damage depending on what kind of bug found its way in. Usually, this can be avoided with proper employee training as well as an awesome firewall that will help filter malicious attacks. Yet another prey in the night is social engineering – the art of conning people. Hackers have been known to get into server rooms and other data-centric areas of the business. Employees may not even notice their mistake until it’s too late. I guess the “HVAC guy” turned out being a hacker in disguise.

Sometimes software corruption can come from unknown viruses lurking around your computer. However, most of the time it is due to improper usage. Things like not shutting down the computer properly or leaving unsaved documents open. Sometimes even a power outage can trigger corruption. Once the software processes are interrupted and damaged, it’s virtually impossible to recover data stored in the software.

Did you know that 140,000 hard drives crash every week? With that kind of number, it’s just a matter of time until it happens to you. That is not a comfortable position to be in if you know you don’t have backup. Unfortunately, hard drive corruption is usually due to mechanical issues. Things like age and dust build up can (and will) cause technology to fail. We’ve all used the old laptop we still have that’s been on its deathbed for months, freezing frequently, taking for-ever to load a webpage, and of course, acting as a heater for your lap or desk. All of these things are signs leading to a crash. You may not care if it’s an old hand-me-down laptop from the ’90s, but you will care when it’s your pricey equipment with all of your product data and client information stored on it.

Finally, good old-fashioned acts of God. You can’t necessarily prepare for a natural disaster. Even if you hear the tornado siren, backing up your servers to tape will take longer than it will for the tornado to hit your business. Then what? That tape is left amongst the rubble, destroyed. This may seem like an exaggeration, but it has really happened to businesses. And even if only hypothetical, it makes for a great metaphor for any other crash within your business. This is also proof that on-site BDRs may not always be the final protective cover to your business. You may want to consider off-site or cloud data storage to ensure protection, so your data is safe even if your equipment is destroyed.

Protect your business and keep it running smoothly and successfully. Backup Disaster Recovery options are available for all kinds of SMBs and their needs. Don’t wait to be taught a lesson by the “big one” (as most California residents say). Protect your important data and enjoy the peace of mind that comes along with it. You’ve worked too hard to get your business where it is. Protect your hard work.

November 29 2021

Cyber Extortion: Don’t Be a Victim

Uncategorized 0

We’ve all seen movies where a couple of thugs in trench coats walk into a store, take a look around and say something like, “Nice place you got here, shame if something were to happen to it.” Many people might think the days of extortion went away with the end of mob-run New York and Chicago, but it’s still alive and well on the internet — in the form of ransomware.

To make things worse, as the world has been buckling down with the COVID-19 pandemic, hackers have been working overtime to take advantage of lax cybersecurity. But before we get into how to protect your company from ransomware threats, let’s see how we got here.

Understanding the Problem

For those unaware, ransomware is a form of computer virus that allows a hacker to enter your system and lock you out of every file and program you use. Then, out of the goodness of their hearts, the hackers give you two options: pay them a set amount of money or lose access to everything forever.

Ransomware has been around for decades (and we’ve written many blogs on the topic) but it has proliferated exponentially in recent years. The main reason for this is because it works. Merely stealing your information and then selling it can make them money, but not nearly as much as ransoming that same information to its rightful owner.

Over the course of just a few months (Q4 of 2019 to Q1 of 2020), Forbes magazine stated that overall attacks rose by 25%. Why such a rise? Well, it could have something to do with payouts also rising by 33% within that same timeframe. With that kind of increase, it’s no wonder why hacking is a growing industry.

Ransomware in the Age of Covid-19

When the pandemic started, many people began working from home. For many of us, working from home presents no problems at all, but for others, it creates a whole list of issues that won’t be resolved until their whole department can be back in the office.

This has especially been the case with IT departments. While it’s true that they can do a lot of their work remotely, sometimes they just need to be in the server room to do their job. And don’t think for a minute that hackers don’t know that.

With so many fractured IT departments out there, businesses have been getting swarmed with attacks. For example, the city of Florence, Alabama was attacked just a few weeks ago and said that paying the $300,000 demand was better than having its citizen’s information exposed and for sale.

Even more recently, Honda was attacked by a cybercriminal that actually ended up shutting down production. Ransomware is getting more dangerous by the day.

The New Frontier

The recent pandemic has taught us that we don’t need as many people in the office or even at the factory as we thought we did. Work can be done via automation or with remote workers and keep the business running. That means that our businesses can become even more efficient than ever before. It also means that if a hacker were to get into your system, the damage can be even more devastating.

With the way businesses are depending more and more on technology, your entire business can grind to a halt from a single bad decision someone took when opening the wrong email.

Lighting Can Strike Twice

Imagine your company has been a victim of a ransomware attack and the crisis passes. Perhaps you paid the hacker or were able to gain access to your system again some other way. Now imagine that life has gone back to normal until one day the unthinkable happens: you get hacked again with a ransomware demand.

Sadly, this is not a one-off situation. In fact, not only can this happen to a single business, but it can happen to multiple parts of an organization. One of the most famous examples of this is when a single school is hacked, then multiple other schools in the same district get hit with the same ransomware, one by one.

The reason this is somewhat common in the tech world is that organizations can have similar (or identical!) safety protocols across the board. It’s a lot less work for a hacker to work this way than to go search out other targets every time they want a hit. However, we all know one of the biggest reasons we’re unprepared is because we all think it can’t happen to us. The harsh reality is that’s what all the businesses who were hit thought too.

What Can You Do?

While it’s true that hackers are getting more sophisticated every day, the majority of their attacks are opportunistic. Hackers take the path of least resistance, so if they can enter your system by Carol in accounting falling for a phishing scam, or if your IT department did not update their protocols after a previous attack, they’ll take that route.

That’s where we come into play. By dealing with a company to work on your behalf, you don’t need to worry every time someone logs into your system. And why should you waste all that time? Any effort you put into protecting your system is effort that could have been spent growing your business. By having us go over your current system and helping you implement a better one, you stand a much better chance when the internet goons come for your data.

November 18 2021

How Secure is your Data?

Uncategorized 0

How Secure is Your Data?

Hacking, Phishing, Ransomware, and over-all Data Breaches are on the rise. It seems that every advancement we make with data security, hackers are able to find a way through.

In this blog, we will discuss the importance of keeping your data secure. While we are using Medical Offices as an example, this information crosses over to almost every industry. If you use cloud storage, proprietary software, and store personal data, this blog holds valuable information for you.

Your Clients Put Their Trust in You

Medical professionals are not only entrusted with caring for the health of their patients, but also for keeping their information private. Given that, it’s no wonder why physicians must be some of the most trustworthy people in our communities.

However, on the other end of the spectrum are those who actively look to take advantage of the information that medical practices and hospital systems have accumulated over the years. But why are medical records so valuable and what can be done to protect them?

Richer Than You Think

Medical databases are among the top targets for hackers with more and more breaches taking place each year — but why? CBS News reported that while a social security number may be worth $1 and a credit card number $110 on the dark web (average numbers), a single medical record can be worth a whopping $1000 or more!

The reason for the value is that your medical records typically have more personal information than any other source out there. This may include your social security number, address, phone number, banking information, and a lot more. With so much at play, it’s no surprise why hackers are starting to focus more on these records than any other.

Who’s Bears the Responsibility?

Everyone in the healthcare industry in the US is aware that HIPPA prevents sharing medical information except under particular circumstances. But what if that information left your hands and was spread involuntarily? Although it may be a gray area, there’s still the strong likelihood that the medical office could be held liable, at least in a civil court — especially if they haven’t done everything possible to avoid the hack. Don’t forget that data breaches cost the healthcare industry upwards of $6 billion per year.

How to Protect Your Patients — and Yourself

Managed Service Providers (MSPs) are often used by the medical industry to help avoid such situations. One way we do this is by helping these customers when it comes time to update ICD codes, (International Classification of Diseases). This can be tricky since HIPPA approved systems aren’t always the easiest to upgrade. Not only is the computer update important, but the people updates are as well.

Also, there is plenty for your MSP to do in helping you avoid HIPPA violations. For instance, any device used that contains or has access to patient information needs to be encrypted. In 2016, one iPhone that was lost at a single facility ended up created a $650,000 fine. Remember: it’s not your fault if the device is lost or stolen, but it is your fault if you failed to encrypt the information beforehand.

In a similar vein, when you dispose of older devices, you can’t just toss them in a dumpster and go about your day. These devices must be wiped clean, often in a way more substantial than just deleting records. While that might be acceptable if you want to dispose of your personal devices, those who understand computers can quickly get access to files that weren’t properly deleted. A good MSP can make that happen as part of their standard service.

Who Watches the Watchers?

Where you store your data is also a major part of data security. As we previously mentioned, some medical practices have used standard cloud storage and paid a heavy price when data was easily breached. While it’s true that cloud storage is easy and often a more inexpensive option, you have far less control over the information and the security of that data if it is out of your hands. Unless you use a top-of-the-line service, your data will be vulnerable as weaker services make prime targets for hackers. After all, why go after an individual when you can get data from thousands of companies at once through a cloud service?

Even if you decide to go with local storage, who has access to your data? With the genuine value of these records along with the absolute risk of liability, if things go sour, you need to be very careful with whom you allow access to the database. MSPs make sure that not only will your information be safe, but that the people who oversee your databased have all the proper education and certifications to avoid any problems down the line.

Bottom Line

Let’s get real for a second here. Medicine and medical technology are advancing at breakneck speeds. Would most people feel comfortable with a physician who hasn’t been to a class or conference since graduating from medical school? Of course not!

Data security is exactly the same. As hackers become more and more advanced, MSPs must stay one step ahead of them to protect our clients. That’s why we make it a point to continually train our team on new security options and protocols.

If you don’t have a robust security plan in place for your office or business, don’t wait to give us a call. Every moment you’re not protected is a moment of opportunity for a pirate to rob you over your clients’ trust and confidence.

If your organization is starting to fall behind over a lack of attention to your IT, contact us today. Our expert team will be more than happy to evaluate your needs and help you implement and maintain the most reasonable and secure solution. The only thing you have to lose is sleepless nights.

November 11 2021

Is Cost Holding You Back?

Uncategorized 0

Managing expenses is one of the core tasks of any business owner or manager. Nothing is free, so if you want to keep the lights on and your office staffed, you need to know what’s coming in and what you’re paying out.

But to run operations profitably, you might find yourself having to prioritize your expenses. When you do that, what gets bumped up-front and what gets pushed to the back? A mistake that many businesses — especially medical offices — make is to give IT a lower priority.

In this blog, using medical offices as our example, we’ll discuss why most offices tend to place too low of a priority on their IT budget and what can happen as a consequence if they’re not careful.

Why Such a Low Priority?

Many types of businesses think nothing of dropping hundreds of thousands of dollars on diagnostic machines or specialty equipment, yet they drag their feet when it comes to upgrading outdated computer terminals. In all honesty, this shouldn’t come as a big surprise as CEO’s often have an “If it ain’t broke, don’t fix it” mentality. After all, how often have you been to a doctor’s office and have seen a scale that looked like it was manufactured during the Nixon administration?

While imaging systems and other medical equipment offer tangible benefits to physicians when caring for their patients, some feel that if the computer system can still do what it’s supposed to be doing, then what’s the point of upgrading or expanding? Additionally, and we’re just being frank here, new medical equipment can often mean more money in the pocket of the practice, whereas giving the reception desk updated terminals doesn’t seem to offer any real profit.

That being said, there are other reasons for not wanting to upgrade other than just dollars and cents. For instance, finding good hardware or software can be difficult as everything used needs to be HIPPA compliant — something that not every system can claim. As a result, upgrading can be a nightmare, especially when the current system that’s being used was installed decades ago.

The High Cost of Low Budgets

With many types of investments, including IT purchases, the less you pay upfront, the more you’ll pay in the future. In the example mentioned above of the old scale, as long as it’s accurate, it doesn’t matter how old it is since it does its job. But if you’re running older computer systems that don’t have modern safety protocols, for example, your system is exceptionally vulnerable to attacks.

While hackers wanting to steal credit card numbers is no surprise, what is surprising is the apparent value of medical records being sold inside the dark web. In last May alone, there were 28 reports of hacks stealing more than 500 records from medical systems nationwide. HHS’ Office for Civil Rights reports a 59% year-over-year increase in these sorts of attacks, with much of it blamed on outdated systems and hardware. Not only is it difficult for the patients whose privacy has been violated, but it also opens up these healthcare providers to a sea of liability.

In addition to security risks, you may also face the risk of being left behind. Patients are now treated at a higher level of service than ever before. For instance, who ten years ago could have ever dreamt of a world where you could receive your test results at the same time your doctor does, on your phone? These and many other services can be provided via patient portals, which are a major example of how the future is now alive in healthcare. A significant emphasis has been made making patients and doctors partners and the only way to do this is by easy access to information.

Lastly, modern IT just makes everything move faster. Whether it be billing, insurance claims, scheduling, or any other aspect of running a medical facility, there’s no doubt that the fewer resources that are dedicated to non-medical tasks, the better and faster your patients can be cared for.

Modern Solutions to Modern Challenges

Even with all these benefits made clear, the challenge is still in the acquisition, implementation, and upkeep of a modern IT solution that will work best for your operation. With so many options at so many price levels, it can be a major undertaking to know what will work best for you.

That’s where a quality Managed Service Provider comes into play. MSPs work well with healthcare organizations since we do all the IT work for you, allowing you to get back to taking care of your patients. We go over what you currently have and work within your needs and budget to see what will make your office run at top efficiency.

By using our experience and know-how, we cure your issues so you can cure the rest of the community.

November 4 2021

Who makes your IT purchases?

Uncategorized 0

This month we’ve been discussing the value of updating your current technology. We are using Medical Offices as our example, but in reality, this information is important to all small businesses. In this week’s blog, we will discuss the pitfalls of sticking your head in the sand by being resistant to change.

Let’s assume that everything we’ve said about upgrading your technology resonated with you, and you agree 100% — now what? Well, decisions have to be made. What kind of hardware will you be using? What about the software? When do you plan to make changes, and what’s your budget? Do you plan to hire new people for this undertaking or do you plan to use a vendor? But perhaps the most crucial question of all is, who will make the final decision?

While this might seem like an odd question, the truth is that many offices don’t have a go-to person for these types of decisions. Or maybe the person who is currently in charge of this may be too busy, too distracted, or not the best person to do so.

Who is your Decision Maker?

One of the biggest problems with a lot of medical practices is that they often don’t work like your typical business. While most traditional companies might have an owner, a president, or simply a manager, this isn’t always the case when it comes to doctors.

Medical practices, like attorney firms, typically use a partnership model where they may have more than five or six doctors who own the business and are in charge of making most of the larger decisions. While it’s true they often use office managers, these position holders usually handle the day-to-day operations and aren’t given the authority to make decisions for large purchases or contracts. But even if there’s only one person at the top, the decision may still not be an easy one to make.

A Question of Qualification

There is no doubt that doctors are qualified to do their jobs. Few professions require as much education and experience before they can start their career path. Even so, that expertise does not extend to understanding technology in their offices. Why is it that someone with the skills to cut you apart then put you back together can look like a deer in headlights when confronted about server clients, cloud systems automation, and WANs? Probably because this was never a taught to them in their years of medical school.

But in defense of these physicians, there is a lot more to IT than simply understanding computers. For instance, understanding budgeting is an essential part of any IT desision. Even if you have the money, just buying everything there is does not a good IT system make. Having a thorough understanding of the specific needs — including future needs — of the office is crucial before spending a single penny.

In addition, healthcare systems are some of the most difficult to set up and manage because of strict government regulations regarding patient privacy. While there are plenty of great software programs that can help the office run smoothly, HIPPA compliance should be at the front of your mind before implementing anything. Sadly, it seems that many software programs (and even operating systems) don’t go out of their way to answer whether or not they are HIPPA compliant, so you need people who can find out that information to help you make the correct decision.

Here Today, Gone Tomorrow

It’s no secret that technology is moving at breakneck speeds these days, so if you’re not making efforts to keep up, you can fall behind in a blink of an eye. New solutions for storage, operating systems, and security are being developed almost daily. Also, there may be a need to upgrade systems for other reasons, such as when it’s becoming clear that your needs are growing or evolving.

Again, this process is difficult for any business but much more so in a medical environment, mostly because of HIPPA compliance. This may either lead a practice to fall out of compliance or choose to forgo upgrading in general to avoid a situation like that, even at the expense of efficiency. A major reason for this is a lack of guidance, with people having a very specific specialty being unaware or unsure of what needs to be done to upgrade.

This can cause major problems down the line as the most common solution to this problem tends to be a piecemeal replacement process. A computer here or a printer there may seem like a reasonable way to get things done, but the fact is that it ends up costing a lot more than making regular replacement of all outdated equipment at once. Additionally, it can make migrating files and systems much more complicated in the future since all these different pieces of equipment will be running various operating systems or in other ways be non-uniform.

If you find yourself in this situation, it could lead to security breaches, lowered employee morale, and downtime that will lead to a loss of efficiency. If the problem started because there wasn’t a single person taking charge, it would be a lot more difficult to resolve these issues.

A Streamlined Solution

The best way to get your office on track is to make a formal decision as to who handles IT across the board. While you may want input from the various departments, a single, qualified person should be pulling the lever on these decisions.

Since medical facilities tend to be such busy places, many have chosen to go with an outside vendor to provide these IT services, such as us. From our experience, when having a single person or group meet with us to address the needs and current status of the office, we’re able to quickly work out a solution. Not only are we able to make sure that the needs of everyone in the office are met without all the hassle usually needed to maintain such a system, but that system ends up being well within their budget.

If you find yourself being the person responsible for making these decisions, contact us to see how we can be of service. You’ll be amazed by the positive atmosphere you can create with just a few changes to your IT. But don’t worry — we’ll let you take all the credit!

October 28 2021

Phishing 101

Uncategorized 0

While the number of people falling for sending personal information to the crown prince of Nigeria in hopes of receiving his promised wealth and riches seems to be dropping, phishing remains a major issue. In fact, the number of phishing campaigns pursued by hackers around the world increased 65% in the last year.

What exactly is phishing? Hackers mimic the emails, forms, and websites of legitimate companies in an effort to lure people into providing their private, personal information, like credit cards numbers, social security information, account logins, and personal identifiers. The victim typically doesn’t realize they’ve been compromised until long after the event, and oftentimes only after their identify or finances are affected. In the past, an attack was carried out relatively quickly. As soon as the victim gave up their information, the hacker moved in and stole money from the compromised bank account. Today, it’s often more lucrative for hackers to sell that information on the Dark Web, resulting in longer-lasting, even more devastating attacks.

3 Types Of Phishing Attacks

Spear phishing

Phishing attempts directed at specific individuals or companies have been termed spear phishing. Attackers may gather personal information about their target to increase their probability of success. This technique is by far the most successful on the Internet today, accounting for 91% of attacks.

Threat Group-4127 used spear phishing tactics to target email accounts linked to Hillary Clinton‘s 2016 presidential campaign. They attacked more than 1,800 Google accounts and implemented accounts-google.com domain to threaten targeted users.

Clone phishing

Clone phishing is a type of phishing attack whereby a legitimate, and previously delivered, email containing an attachment or link has had its content and recipient address(es) taken and used to create an almost identical or cloned email. The attachment or link within the email is replaced with a malicious version and then sent from an email address spoofed to appear to come from the original sender. It may claim to be a resend of the original or an updated version to the original. This technique could be used to pivot (indirectly) from a previously infected machine and gain a foothold on another machine, by exploiting the social trust associated with the inferred connection due to both parties receiving the original email.

Whaling

Several phishing attacks have been directed specifically at senior executives and other high-profile targets within businesses, and the term whaling has been coined for these kinds of attacks. In the case of whaling, the masquerading web page/email will take a more serious executive-level form. The content will be crafted to target an upper manager and the person’s role in the company. The content of a whaling attack email is often written as a legal subpoena, customer complaint, or executive issue. Whaling scam emails are designed to masquerade as a critical business email, sent from a legitimate business authority. The content is meant to be tailored for upper management, and usually involves some kind of falsified company-wide concern. Whaling phishers have also forged official-looking FBI subpoena emails, and claimed that the manager needs to click a link and install special software to view the subpoena.

Have you ever gotten an email from your bank or medical office asking you to update your information online or confirm your username and password? Maybe a suspicious email from your boss asking you to execute some wire transfer. That is most likely a spear phishing attempt, and you’re among the 76% of businesses that were victims of a phishing attack in the last year.

Method of Delivery

Phishing scams are not always received through email and hackers are getting trickier and trickier with their preferred method of execution. Last year, in 2017, officials caught on to attacks using SMS texting (smishing), Voice phishing (vishing) or social engineering, a method in which users can be encouraged to click on various kinds of unexpected content for a variety of technical and social reasons.

Ransomware: The Consequence

Phishing is the most widely used method for spreading ransomware, and has increased significantly since the birth of major ransomware viruses like Petya and Wannacry. Anyone can become a victim of phishing, and, in turn, ransomware attacks; however, hackers have begun targeting organizations that are more likely to pay the ransoms. Small businesses, education, government, and healthcare often, unfortunately, don’t have valid data backups, so they are unable to roll back to a pre-ransomed version of their data. Instead, they have to pay their way out or cease to exist. Outside of ransom costs, victims of phishing campaigns are often branded as untrustworthy, and many of their customers turn to their competitors, resulting in even greater financial loss.

Why are effective phishing campaigns so rampant despite public awareness from media coverage?

Volume: There are nearly 5 million new phishing sites created every month, according to Webroot Threat Report. There are now even Phishing as a Service companies, offering phishing attacks in exchange for payment. One Russian website, “Fake Game,” claims over 61,000 subscribers and 680,000 credentials stolen.

They Work: Over 30% of phishing messages get opened, and 12% of targets click on the embedded attachments or links, according to the Verizon Data Breach Investigations Report. In short, these hackers have gotten really good at looking really legitimate.

They’re simple to Execute: New phishing campaigns and sites can be built by sophisticated hackers in a matter of minutes. While we think there are far more legitimate ways to be earning money, these individuals have made a living out of duplicating their successful campaigns.

How do you protect yourself from a phishing attack?

Now that you have an understanding of what phishing is, our next two blogs will teach you How to Spot a Phishing Attack, and Fixing Your Weakest Link: Your Employees.

October 21 2021

Are you on a hackers watchlist?

Uncategorized 0

In the last decade, billions of people have had their information stolen from one, if not multiple, business sectors. Technology is constantly expanding, and with new technology comes new ways of hacking into seemingly secure data. As technology advances, people tend to forget about outdated technology and are lackadaisical about security. Outdated devices, human error, malware and theft are all things that contribute greatly to the possibility of a data breach. It’s important to ensure companies are well aware of all possible breaches in order to secure them. No business wants to face the PR nightmare other companies have.

Outdated devices and software increase risks of malware infections due to the fact that devices are susceptible to vulnerabilities that have yet to be patched. Often times, these patches don’t even occur because of a lack of memory or non-compatible OS software. Another issue that can occur when using outdated technology is not meeting the newest WIFI protocol standards. This means the device would not be receiving a secure connection, something hackers love to see. You make their job so much easier that way.

This list would be incredibly inaccurate if human error wasn’t on it. Human error is a huge reason data breaches occur. It’s not new information that humans are flawed and often let things slip through the cracks. Majority of the time, these errors are not made on purpose and are simply an accident. However, that doesn’t excuse them from potentially wrecking a business. Some examples of these missteps are using weak passwords, falling for phishing scams and sending sensitive information to the wrong recipient. This can be avoided with employee education and basic data security training.

Colored Gradient Illustration Data Protection Facebook Post

Malware breaches are easy to get caught up with if you don’t know what you’re looking at. An anti-virus will help patch vulnerabilities in your device, but other forms of malware may not be as obvious. Plus, as mentioned before, with new technology, comes new ways to hack your data. For example, a packer is a type of malware that could hide from your antivirus because of the coding that compresses it. A crypter creates altered, and infected, copies of a program. As soon as it’s clicked on, it begins to decrypt. Polymorphic malware is malware that repeatedly uses packing and crypting methods to change the way it looks. Then finally there are many kinds of malware staging programs called droppers or downloaders which first learn about the system and then proceed to infect with the real malware.

Physical theft is always a risk as well. Whether it is an employee or a stranger, depending on the data stolen, the effect can be detrimental to a business. Especially if there is no backup data recovery set in place, important data could be lost forever. This vulnerability is hard to predict due to the opportunistic nature, but keeping important items secured at all times can reduce these opportunities.

Are you guilty of any of these items? Don’t worry most of us are but knowing that will enable you to stay off a hacker’s radar and save your data. Knowledge is power and prevention.

October 14 2021

Mischievous Malware

Uncategorized 0

Unfortunately, malware is not a foreign term, in fact it’s well known to anyone that uses a computer. There are several types of malwares, as well as mediums in which you may receive it. So, before you click on that link for the free cruise you won, think about all the personal data you could be giving away.

First, let’s take a quick tour of the types of malwares you may run into.

Viruses: These act very similar to the flu virus. Once it gets into a computer, it propagates by copying itself and becoming part of another program. Then just like the flu at an elementary school, it spreads from computer to computer. However, a virus must be activated, by opening or running the file. Viruses also include worms and trojans.

Spyware: This form of malware works just as its name intends. It is a software that usually piggybacks on legitimate downloads. Once it is in your computer, it spies on the information you key in and sends it to a website. The first sign of spyware usually is a slow computer since it takes up many resources to run.

Adware: We all know this one all too well. Those pesky pop-ups telling you your computer is infected or that you won money. These also piggyback on other applications or downloads, such as free computer wallpaper, widgets or toolbars. Adware is kind of tricky, inherently it isn’t dangerous to your computer, annoying, but not dangerous. However, once clicked on you’ve basically opened the floodgates.

Ransomware: With the popularity of cryptocurrency, ransomware has become more and more abundant. Often, this type of malware won’t damage your computer… right away. Instead, it locks it and holds it hostage. The hacker asks for a ransom and will provide a key only if and once the ransom has been paid. If not, the hacker will usually wipe your device of all its data.

Botware: This is another malware beginning to gain popularity due to the cryptocurrency gold rush. Botware ultimately turns your computer into a zombie by flooding it with denial-of-service attacks. It helps hide anything going on below the surface. A surprising symptom of botware is a higher electric bill. Your computer’s CPU will be running constantly, and the fan will run for longer than usual.

Now that you are a bit more familiar with the mischievous malware that could corrupt your devices, it’s time to delve into a lesser-known malware scam. Malvertising.

This has been gaining headway on Google, so much so, they created an individual landing page asking consumers to report malvertising and explaining how to combat it. The way this works is that cyber-criminals utilize several types of display advertisements to distribute malware. A few ways you’d see malvertising is through auto-redirecting ads that will take you to a phishing page, click bait and malicious code hidden within an ad.

Sadly, cybercriminals usually use legitimate ad networks because of the high volume of ads they distribute. It makes it incredibly easy for them to throw a code into an ad without the advertiser having the slightest clue. The worst malvertising connects users’ computers to an exploit kit that runs analysis on the defending computer, looking for vulnerabilities and exploiting them. From there, attackers can install malware, ransomware or gain full access to the computer and sensitive information. Sometimes Google may even flag your website for hosting malware, which will affect how you show up in search results.

Like most other malware situations, the best way to keep it from ruining your device or even your life, is to keep everything up to date. It is important to ensure any scripts ads may be running on are current. This includes programs like Java, Flash and Microsoft Silverlight. Ad networks are working hard to stay above the curve, but it is your responsibility to help with that.

Be sure to report any suspicious ads to Google. If the ad’s script contains suspicious code, including encrypted code, it should be treated with suspicion. Remove the ad from your website and report it to your ad network. Also, there are many ad verification websites that help back check ads for suspicious code. The bottom line with any mischievous malware is to keep your eyes open and report foul play.

October 7 2021

Breaking Down Social Engineering

Uncategorized 0

Most people are aware of terms like phishing and malware, but do you know those are a part of a larger scheme called social engineering? This is not a new kind of fraud, in fact it’s been used for many years to manipulate a wide range of people into giving up important data about themselves or workplace. A prime example of social engineering goes back to Greek mythology with the Trojan horse. They infiltrated the city of Troy with a “peace offering” filled with soldiers, thus winning the war. With technology at the forefront of our lives, social engineering has entered a new era. Physical human interaction is not necessarily required anymore. These criminals can gain information through emails, pop-ups and public Wi-Fi networks, to name a few. The main objective is to influence, manipulate or trick users into giving up privileged information or access within an organization. They are doing this right under your nose, and if you’re not paying attention you will be a victim of this as well.

External Threats

With technology at the forefront of most businesses, external threats are becoming the benchmark for social engineers. They can hack into core business processes by manipulating people through technological means. There are so many ways for social engineers to trick people, that it is best to ensure you are well versed in some of the ways they can hack your system.

Baiting

First of all, baiting can be done both in person and online. Physical baiting would be a hacker leaving a thumb drive somewhere at a business, then an employee picks it up and plugs it into a computer. Could be curiosity, or simply thinking a co-worker left something behind. However, as soon as the thumb drive gets plugged in, it will infect your computer with malware. The online version of this could be an enticing ad, something to pique interest. Things like “Congrats, you’ve won!” Also, there is scareware, in which users are deceived to think their system is infected with malware, saying things like “Your computer has been infected, click here to start virus protection.” By clicking on it, you unintentionally downloaded malware to your computer. If you understand what you are looking for, you can usually avoid these situations.

Phishing

This is probably one of the most popular social engineering attacks. Fairly generalized, this usually comes in the form of an email. Often, they ask the user to change their email, or login to check on a policy violation. Usually the email will look official and even take you to a site that looks almost identical to the one you may be used to. After that, any information you type in will we transmitted to the hacker. You just fell for the oldest online hack in the book.

Spear Phishing

Similar to generic phishing, spear phishing is a more targeted scam. This does take a little more time and research for hackers to pull off, but when they do it’s hard to tell the difference. They often tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. This could be in the form of an email, acting as the IT guy with the same signature and even cc’s to co-workers. It looks legitimate but as soon as you click the link, you are allowing malware to flood your computer.

Yellow and Black Work Safety is Our Priority Circle Sticker

Internal Threats

Originally, social engineering took place in a physical setting. A hacker would do some preliminary research on a company structure or focus on behaviors in order to get that initial access into a building, server room or IT space. Once they have a “foot in the door” so to speak, obtaining pertinent data or planting malware becomes that much easier.

Tailgating

Often, they will enter a building without an access pass by simply acting like an employee that left it at home, this technique is known as tailgating. The only credential they need is confidence. This can also include a hacker posing as an IT person and conning people into believing that to be true so they can gain access to high-security areas. This is far easier than it sounds too. You can find company shirts at your local thrift store, exude confidence and gain access.

Psychology

Another interesting process hackers use to con their way into a business is by creating a hostile situation. According to PC World, people avoid those that appear to be mad, upset or angry. So, a hacker can have a fake heated phone call and reduce the likelihood of being stopped or questioned. Human psychology really is a tricky thing, isn’t it?

Public Information

Then of course, the more you know about someone the more likely you are going to gain the information you need from them. This involves everything from scoping out parking lots, observing the workspace and even dumpster diving. Nothing is safe anymore and your life is not always as secure as you’d like to think. Something as innocent as a bill can be used to harvest more information about a person.

Pretexting

Similar to online phishing, pretexting is a popular fraud tactic for phone calls. Often, they will disguise themselves as an authority such as a bank, tax official or even police. They will probe you with questions that could lead to giving up information that could compromise your identity. This personal information can be used to find out a whole slew of things. Not only can they get away with your money immediately, they can easily steal your identity with pertinent information like social security numbers or banking information.

Prevention

Social engineering can be prevented by being educated in it. With so many different ways to steal your important data its imperative that individuals and businesses go through some sort of training regarding these issues. However, on a day to day basis, getting into certain habits can help. First of all, pay attention to your surroundings. Remember that physical social engineering still exists and you don’t want to be the one that caused your business corrupted data. Next, do not open emails or attachments from suspicious sources. Moreover, if a legitimate looking email seems slightly suspicious, go to the source and find out for sure if they sent it. Also, multi-factor authentication can curb fraud immensely. One of the most valuable pieces of information attackers seek are user credentials. Using multifactor authentication helps ensure your account’s protection in the event of system compromise. Furthermore, if an offer seems too good to be true, it probably is. Don’t click the link, you didn’t win a cruise. Then finally, keep your antivirus and/or antimalware software updated at all times. This is the best line of defense if for some reason your system has been compromised. For the most part, use your best judgment and common sense. Social engineers have gotten very good at their jobs, but that’s okay because you’ve gotten very good at yours too and can combat these sneaky hackers.