Posts

Password Management Tools: An overview

Effective password management is an essential aspect of cybersecurity. With the increasing number of online accounts and services, remembering all those passwords can be a daunting task. Password management tools provide an effective solution to this problem. This blog discusses the benefits of using password management tools and some password management best practices to be followed.

Some of the key benefits of deploying password management tools are:

Enhanced Security

The primary benefit of password management tools is enhanced security. Password managers store passwords in an encrypted format, making them less susceptible to hacking and phishing attacks. These tools also allow businesses to generate and store complex passwords for their employees. As a result, businesses can ensure that their employees use strong and unique passwords for every account, reducing the risk of a breach.

Easy Password Access and Management

Password management tools offer an easy way to access and manage passwords. Rather than manually entering passwords every time an employee logs into an account, password managers automatically fill in the necessary information. This feature not only saves time but also eliminates the risk of human error.

However, there are a few things to consider before you invest in a password management tool.

One of the things to consider is a security breach. Password managers are third party platforms. If your password management experiences a security breach, it can put all of the stored passwords at risk. Additionally, if the tool goes down, you may not be able to access your accounts.

Secondly, while password management tools reduce the risk of human error, they are not foolproof. Employees may still make mistakes, such as sharing their passwords or writing them down, which can compromise security. Additionally, if an employee forgets the password to their password manager account, it can cause problems. Hence it is important to ensure that you have good password hygiene in place.

Password hygiene refers to the practice of creating and maintaining strong passwords and protecting them from being compromised. It involves using unique and complex passwords for each account, changing passwords regularly, and storing the passwords securely so it isn’t accessible to unauthorized entities.

/by

Infection protection: Nine steps to start protecting your company today

Malware is a generic term that covers all manner of software that is designed to attack your devices, applications, programs, and networks. It is software that has bad intentions. Yes, stealing. Either by directly pulling money out of accounts, or improperly acquiring data that ultimately provides access to funds. Example: Stealing your SSN and setting up a credit card to use that info, or convincing you to provide the password to your checking account. Others will snatch your organization’s data and hold it for ransom. As usual, it is all about money. What can you do?

Nine steps to avoid malware

1) Don’t go it alone – As a small- to medium-sized business, you have limited resources, all of which need to be focussed on running the business and planning for the future. That makes it difficult to direct an IT operation that has the depth to address all of the security issues you face. For example, a business owner cannot possibly keep up with the changes and details of tax laws. Doing it themselves, they would likely overlook important tax advantages or inadvertently break some IRS rule. As a result, tax preparation and accounting above the level of basic bookkeeping is outsourced to an outside accounting firm. You should consider looking at IT in the same way.

2) Pay attention to those update windows – Don’t procrastinate. Those update requests aren’t just for adding a new feature. Each update probably addresses some vulnerability in the software that could be exploited by a virus. You may also want to consider outsourcing this project. In a complex business, there is a long list of installed software that needs to be updated. An MSP can coordinate that project and handle any glitches that appear when an update is installed. Also, be mindful that if you permit BYOD- all of those remote devices are vulnerable if their owners neglect updates.

3) Multi-factor Authentication – It is getting tough to log into much of anything these days without hitting MFA. And for good reason. MFA is a tool that works to cut down fraud by asking for additional data to verify your password in order to gain access. Generally it involves entering a password then following up with a token you might be sent via text or email, or using a biometric measure, such as a fingerprint. An MSP can provide applications that can set up MFA to protect your data.

4) Create a strict backup policy and follow it – Data can get corrupted, lost, or stolen. Handling backups is more than just downloading data to a hard drive every evening. An MSP can provide you with the tools needed to handle backups appropriate to the needs of a business operation or take on full responsibility for the task.

5) Manage access – Who can look at what data? In a smaller business, we often just provide access to data to an employee or we don’t. Why? Because it is simple. Instead, tighten your security by segregating data access. Individuals get access only to the data needed as defined by their job description. Follow the Principle of Least Privilege. That is, each individual only has the access to accounts, databases etc. that are absolutely necessary for them to do their assigned tasks.

6) Train everyone on basic data security – Humans are still a very weak link in an organizations defense against cybercrime. Poor password hygiene and inattention to scams are the biggest concern for business owners. Here are some areas where training can help.

7) Identify phishing emails – These are mails that appear to come from legitimate sources, but are faked. Because the reader trusts the sender, they naively open a link that might be attacked which then downloads some forms of malware.

8) Prevent a “Lost” USB – Too often, individuals will find a USB drive left near a desk or dropped somewhere. The temptation to insert it into their computer to see what’s on it can be very hard to resist. This was part of what caused the Target data breach.Train employees to only insert company verified hardware into their computers.

9) Password etiquette – Define standards within your organization about acceptable passwords. An MSP can help you set up programs that require employees to create passwords that meet your defined criteria. Also, consider fostering a culture that makes the sharing of passwords a performance issue that will be addressed by an individual’s supervisor.

10) Take the step beyond anti-malware software – Anti-malware software is necessary, but it isn’t as proactive as one might want. Your MSP can design an endpoint detection and response solution.

/by

So, what, exactly, is Malware

Listen to the news? Read the internet? You know cyber crime is a very big business. Hackers and criminals are out there doing all sorts of nefarious things. Most generally, you hear that malware is some kind of virus that attacks your software programs, infects your hardware, and bungles up your network. But there are many different types of malware, just as there are many types of criminals–each with their own MO and bad intentions. In this e-guide, we will run through some of the major categories of malware, and then suggest 7 different ways you can work to protect your business from malware.

Malware defined – Malware is a generic term that covers all manner of software that is designed to attack your devices, applications, programs, and networks. It is software that has bad intentions. Malicious + Software= Malware. Hackers and criminals create malware for an array of reasons. Some may create it just to attack massive amounts of machines just to show that they can disrupt the cybersphere. Other malware may be created for political reasons. The major reason criminals create malware? To make money without earning it. Yes, stealing. Either by directly pulling money out of accounts, or improperly acquiring data that ultimately provides access to funds. Example: Stealing your SSN and setting up a credit card to use that info, or convincing you to provide the password to your checking account. Others will snatch your organization’s data and hold it for ransom. As usual, it is all about money.

FUN FACT: Before the internet, passing around malware to infect a PC meant a criminal had to find a way to infect a floppy disc and trick users into inserting it into their computer. One of the first was created by a high schooler in the early 80’s. It was relatively benign and just created a pop-up with a Seuss-like poem

“The program with a personality
It will get on all your disks
It will infiltrate your chips
Yes it’s Cloner!
It will stick to you like glue
It will modify RAM too
Send in the Cloner!”

Unfortunately, most viruses now have far more nasty intentions, and the internet has made it much easier for criminals to break in. No waiting for you to insert a disc drive to steal your data, disrupt your internal business operation, or take down your website. One bad click and you’re in trouble.

Malware is a general term and there are several types.

VIRUS – Like the pathogen we associate with human disease, a virus is a “piece of code that is capable of copying itself and typically has a detrimental effect, such as corrupting the system or destroying data.” Source: https://languages.oup.com/google-dictionary-en/.

A characteristic of a virus is that it requires the user to take some action for it to infect your hardware, software, network, etc. For example, inserting an infected thumb drive or clicking on a link found in an email.

ADWARE -Adware is less a type of malware than a symptom created by the infection. Adware invades and then drives the user crazy with endless pop-up advertisements.

WORMS – Similar to viruses, worms replicate and attempt to cause damage but they don’t require a user action. Worms find vulnerabilities or holes in code that allows them access.

TROJAN HORSE – Yes, named after the Greek myth, Trojans trick you into accepting something you want, but inside it has bad intentions. A trojan refers to the method the cybercriminal uses to get you to download a virus or other infected program, rather than the nature of the specific virus.

KEYLOGGERS – This is malware that can track your keystrokes. This particular malware’s goal is to track your keystrokes and identify passwords or credit card information, and then log into your accounts.

RANSOMWARE – If there was any malware that gets more media attention, we aren’t aware of it. And it deserves everyone’s attention. Unlike some other forms of malware, once this has invaded, there is very little you can do to eliminate the virus. Ransomware sneaks in, snatches your data and holds it for ransom. Unless you choose to pay the ransom fee, usually in some cryptocurrency, you are out of luck. In the specific case of ransomware, prevention is the key. Having clean backups of your data which are kept continuously up to date is about the only way to sidestep a ransomware attack on your data.

/by

Strategic IT planning for your business

One thing that the best MSP can do is become a strategic partner. Your expertise is your industry, business, or profession. Trends and innovations in technology aren’t your focus. However, your business can benefit from some long-term strategic planning in terms of the technology you will deploy to remain competitive. New technology will offer new opportunities. An MSP who has experience in your industry can become a partner. After taking the time to learn your business, your goals, and the competitive field in which you operate, an MSP can take a seat at the table of your business planning. At the highest level, this is where a skilled MSP becomes a significant asset as your business grows and faces new market challenges.

Additionally, An MSP can help with other parts of your IT infrastructure to protect your data as well as facilitate more effective collaboration internally as well as with clients. Here are three examples.

Backup and recovery

Another area related to data security is the process of securing your data in the event of theft, a hardware or software issue, or even a natural disaster that cuts access to your data’s physical location. Backing up your data needs to involve a lot more than running nightly backup to an external drive. That may be ok for your home laptop, but it doesn’t cut it if you want to protect your business data. An MSP can support continual data backup to offsite locations. This means at any point there is a system failure or breach, all of your data remains secure at one or more distant locations. Backup also includes recovery. Having your data safely stored in the event of a disaster isn’t enough. Your business will need continuing access to that data. An MSP can develop recovery plans that work to ensure your operations see minimal disruption in the event of a failure. Also, clean backups are critical for avoiding the consequences of a ransomware attack. Poorly handled back procedures can leave your data vulnerable,

Cloud Services

The decision to use cloud services is closely related to data security and cybercrime. Locating all of your data and software applications physically in your own location may seem like the safest thing to do, but that may not be correct. If you utilize cloud storage, you can maintain access to that data from any location. If a natural disaster or other emergency limits access to your physical locations or disables it, your business and employees can access the data from anywhere. Also, the cloud offers economies of scale. To maintain sufficient capacity to meet peak times, maintain all of the necessary hardware and software, and monitor it 24/7 involves considerable in-house labor and capital expense. Migrating to the cloud means you share those fixed costs with others. An MSP can handle selecting and designing a cloud solution most appropriate to the needs of your specific industry and business.

Unified Communications

Unified communications is a service that pulls together the different channels your employees and clients use to collaborate, sell, communicate, etc. Unified communications systems have many moving parts. Encryption, data security, ease of use, cross platform support as well as other support services can create a communications system that works for everyone, no matter what channel they choose to be using.

/by

Like it or not, you business relies on technology

Technology isn’t just something used by Silicon valley firms and large corporations. Even the smallest start-up is now reliant on technology and the virtual marketplace. A business cannot function without operating in the digital world. At the very least, it means having a website, a social media presence and an online database of customers and prospects. Most likely it means conducting business online, which means you’re responsible for the security of client data: names, credit cards, addresses, and probably more information. Much of that information may be personal Information that you have an obligation to keep secure. That duty brings along many challenges because cyber criminals and even benign human error could mean that data is compromised. Data breaches can bring litigation, possible regulatory sanctions, and very importantly, damage to your brand and reputation. Because so much rides on the stability and security of your digital infrastructure, serious attention has to be paid to data security protocols. The problem is, tech is a complex and specialized field that most small businesses owners have little time to focus on. And spending time trying to understand and maintain an IT infrastructure means siphoning off attention to the operation of your business. That is why a Managed Service provider can be a lifesaver for a small business.

A Managed Service provider is an IT consultant that can provide some or all of the support you need for your IT infrastructure. They can provide help with specific issues–migrating data to the cloud, setting up new software and hardware, designing data security protocol, etc,. They can also become a strategic partner. That means they team with you and learn your business goals and plans and help you understand how new and existing technology can help your business expand. They can use their expertise to guide you to new technologies and digital applications you might not be aware of.

Also, you can sign a service contract with an MSP. At the most basic level, a service contract will mean that if you need emergency tech support, you have priority. Otherwise, you will be at the bottom of the list if something goes wrong.

Finally, let’s consider strategic planning. Your business isn’t static, It will grow in volume, it will expand its product and service lines, and it will move into entirely new, unfamiliar markets. There may be new technologies and applications out there that you are unaware of. If you overlook them and your competitors don’t, you can begin to lag behind. You need long-term strategic planning in terms of the technology you will deploy to remain competitive. New technology will offer new opportunities. An MSP who has experience in your industry can become a partner. FInd an MSP who will partner with your business and learn your operations and your future plans. In that way they don’t just support the IT you have now, they become a key voice in strategic planning for future growth.

/by

How Can an MSP Keep Your Business Safe

Are you a small- or medium-sized business that is in need of a more complete, dependable IT solution to support your business than you presently have? When your main focus is running your business, everything else becomes an afterthought. Other support operations tend to take a backseat. However, your business depends upon a reliable, stable “always running” IT infrastructure and you probably find that isn’t always the case. Even if you have an in-house staff, it isn’t large enough to put out fires and handle strategic planning and provide 24/7 support when something goes wrong. That is why many businesses large and small rely fully or partially on the support of a Managed Service Provider (MSP).

So what are the typical services available from an MSP? There are many different types of support that can be provided to clients. In this e-guide we will break them down.

Managed IT Services

This is the overarching set of services that define the purpose of an MSP. Generally, a business will sign a service level contract with an MSP for a set of defined IT services for a period of time. One advantage typically derived from such an agreement is that the contract provides that you get 24/7 emergency support with priority. Typically, if you have a crisis and call a provider, the non-contract clients take a lower priority. This can mean longer down times and those mean revenue losses. Also, your contract with an MSP means that you can do a better job predicting your IT expenses into the future, and predictability is always a benefit for any enterprise.

Cyber Security Services

One specific area of expertise that everyone needs, no matter how small the business, is up-to-date, ongoing protection against data theft and cyber crimes. An MSP can bring a depth of knowledge that is difficult to create in-house. Ransomware and data theft are rampant. Cyber criminals attack businesses of any size ( in fact, small ones can be more vulnerable. And smaller businesses often don’t have the deep pockets to recover from the revenue losses of a cyber attack). This is a very specialized sector of IT management where businesses frequently choose to use the services of an MSP because of its complexity. Also, keeping up-to-date with the latest malware, and handling 24/7 monitoring can be very labor intensive if done in-house.

Compliance Management

  • There are a number of data protection laws (HIPAA, FERPA, CA Privacy Act, GDPR, FTC Safeguards Rule) out there that not only provide penalties if a data breach occurs, many of them mandate specific protocols to better ensure your data is protected. Avoiding a data breach isn’t enough. Some of these protocols can be quite demanding and some require periodic testing and are subject to audits. Samples of the types of requirements mandated by some of these laws may include.
  • Designating one individual to oversee data protection and security
  • Conducting a risk assessment – This means analyzing what data you possess, where it is stored, and in what ways it is vulnerable.
  • Creating safeguards to address all potential areas of vulnerability
  • Designing and documenting tools to secure your data and tracking access
  • Tracing the location and security of all data whether it is at rest or in transit.

An MSP can be a critical resource in designing these safety measures and ensuring your company is in compliance and remains so. Handling compliance issues and audits can be a big distraction when you are trying to run your business and drive revenues.

/by

Can a small business use AI?

One area where AI tools can help even the smallest business is in sales and marketing. Every business is marketing and selling in the online digital world. Marketing on social media is a given for every business, and can be a game-changer for a small startup. However, a lot of the tasks of marketing on social media and through your website can involve tedious, time consuming tasks. Marketing tools that use AI can help with drip email campaigns, website visitor tracking, and understanding where each customer exists in the sales funnel at any given moment. Other digital tools that increase customer engagement and drive sales are available and are an excellent introduction to AI as a marketing tool. Using these tools, you can focus your limited sales resources on other, more critical tasks such as closing a sale with a customer that is now ready to buy and not simply exploring vague options. These AI tools are readily available and your MSP can guide you in the adoption and use of them

AI and that data you collect. An MSP or MSSP can also be a resource for data protection. As you begin using such tools, you amass enormous amounts of data about prospects as well as customers. How you hold, use, transmit and store this data is subject to some data regulations, either by your state, a federal agency, or even the European Union. Regulation is growing because of the increasing concern about an individual’s online privacy. Because so much personal data is being collected about each of us, there is increasing concern about misuse of that data, protecting it from bad actors, and other privacy rights issues. While you may not be physically located in a state that has data privacy regulations, if you conduct business in a state or country that regulates data privacy, you are likely subject to their rules. An MSP or MSSP is an important resource to determine where you are subject to those laws. More importantly, if you are subject to those laws, (e.g. HIPAA, The FTC Safeguard Rules, the CA Privacy act or the General Data Protection Regulation of the EU), you may also be required to prove that you have developed protocols for the protection of data as defined under those regulations. It isn’t enough to say “everything is safe.” You may have to provide evidence you have created the specific data protection protocols specified under the regulation.

In short, AI can be a helpful tool to grow your business, but it comes with responsibilities and concerns that may not have concerned you before. An MSP is an important resource as you wade into the world of marketing, sales, and other operational areas.

/by

Risk assessment: A Value model

Risk assessment means looking at all the conditions, situations and threats that exist that could damage or bring down your business. Risk assessment is all about identifying the external and internal threats that exist and measuring the likely consequences if that threat becomes reality. A data security risk assessment would identify what data you have, how you use it, how confidential it may be, how it is affected by regulations and the ways it could be compromised. A major focus of a data security assessment is cybercrime.

In terms of developing an IT staff, the alternative approach to building out a team is to determine your IT staffing needs in terms of risk assessment. That means evaluating risk and directing staffing resources to those areas where the risk is greatest and the consequences most severe. Basically, it is an evaluation on the ROI of your IT staffing in light of identified risk. In particular, what is the return on your risk management investment? The goal is to evaluate risk in light of business and operational consequences. Put simply, which point of failure leads to the most destructive consequences. Once that is determined your limited IT resources can be directed at those most critical areas.

In the short term, you can try to find the specific applicants that have what you need to plug the holes. Is that workable given the challenges to hiring? The market is very competitive.

The alternative is an MSP. Using a Managed Service provider for at least some of your most critical needs can be a very effective way of targeting your IT resources to where you are most vulnerable.

You have more freedom to move resources to where they are most needed.

Opting for an in-house IT team limits you in terms of scalability. You cannot just add or reduce the strength of your IT team anytime. Choosing a managed services provider, however, provides the flexibility to scale up or scale down your IT investment to suit your business needs.

You are better prepared for IT emergencies

Having a service contract with an MSP helps you tackle IT emergencies better because you get access to top-level IT expertise. An MSP’s core business is IT so they are naturally more knowledgeable and up-to-date when it comes to the latest IT challenges, including cybercrime. Plus, an MSP can deploy more resources if need be to solve your IT emergency, helping your business get back on its feet sooner.

You will be ahead of the curve

The IT industry is constantly evolving. The in-house IT team may find it challenging to keep up with the latest trends and norms of the IT industry as they will be caught up in managing the day-to-day IT activities at your office. Also, IT is a very broad field, and only a diverse IT team has the depth to cover all of the different areas. With an MSP, you don’t have to worry about how technology is changing. A good MSP will not only be up-to-date with the latest in tech but also advise you on what tech changes you need to make to stay ahead of the curve.

The lesson for hiring IT is that you should focus resources, be they in-house or external, on the areas where your business is at highest risk from a single point of failure or a cyber attack. Not all IT needs are equal, and traditional models don’t always recognize this. A Managed Service Provider can also assist you in determining a hierarchy of your IT needs.

/by

Forego the standard IT staffing model?

From the outset, even the smallest start-up is reliant on an IT infrastructure. Digital technology cannot be avoided. For small-to medium-sized businesses, developing and bringing on staff to support that IT infrastructure is often a low priority compared to ramping up operations and meeting the revenues goals necessary to stay operational. Resources to address IT needs may not be available (for at least, perceived to be unavailable) Management is focussed on revenue growth and meeting operational and business requirements. Management may also be incentivized to direct available funds in these directions, rather than building out a robust and sufficiently risk averse IT infrastructure. Also, management may not have the background that provides sufficient experience to identify areas where IT staffing is necessary to maintain a stable and sustainable business.

In a small- to medium-sized business beginning to explore the development of an IT support staff, or even in a large organization undergoing significant transformation, there may be a tendency to begin the process of IT staffing with a top level individual–a CTO, IT director or IT manager. Once hired, that individual would be relied on to begin the process of building out an IT staff.

Problems facing organizations: initiating an IT staff build-out

For any organization, from a small firm looking to bring on its first dedicated IT staffer to a large organization, there are a number of hurdles that may be encountered. One of the most immediate is the shortage of available IT professionals. No matter what your needs, it may be difficult to find appropriately skilled applicants to meet your staffing requirements. This may mean that following the top-down development model may cause risky delays in your goal of protecting and securing the IT infrastructure needed to remain competitive. The job market in IT is especially competitive. This is just one reason we are suggesting that you consider setting aside the top-down build-out model and take a different approach.

Another reason that the top-down model may be problematic, especially for small- to medium-sized businesses, is that it may be a little too “perfect.” When resources for IT staffing are limited, creating the IT department that covers everything can be unrealistic. Creating this traditional model takes time and resources to make sure you have the IT support that possesses all the diverse skills needed to meet the many requirements of a sound IT infrastructure. As a result, this model may not truly meet the immediate/urgent needs of a developing or transforming organization. As ever, the perfect may be the enemy of the good.

So how does a firm looking to strengthen its IT infrastructure and protect itself from vulnerabilities–from cyber attack to single point of failure– protect itself? Lack of available applicants and limits make traditional build outs unrealistic. And will also take too long to address urgent needs.

In our next blog post we discuss a value based approach

/by

Cyber insurance 101

,

What is cyber insurance

With cybercrime becoming a major threat to businesses across the world, irrespective of their size, cyber insurance is fast becoming a necessity more of a necessity than a choice. However, the concept of cyber insurance is still fairly new and not many SMBs are aware of its benefits. Cyber insurance is an insurance that covers your liability in the event of your business becoming a victim of cybercrime. For example, a data breach puts you at risk of lawsuits, makes you liable to your customers/other parties whose data has been compromised because of/via your organization. Cyber insurance covers the financial aspect of such liabilities, making it easier for you to deal with them.

Why do you need cyber insurance

Many organizations think of cyber insurance as an added cost. They believe they don’t need it for various reasons.

Bigger organizations think their IT security measures are watertight and they won’t fall victim to cybercrime, and they also tend to believe that even if they are affected in a one-off case of cybercrime, they are solid enough to discharge their liabilities and come out of the incident with their brand value intact.

SMBs, on the other hand, think cybercriminals are most likely to target the bigger players and they don’t need cyber insurance. But, in reality, it is the smaller businesses that are at a greater threat–primarily, because

  1. They lack the resources to strengthen their IT infrastructure and their staff is less likely to be trained in identifying cyber threats, making them more vulnerable
  2. They are less likely to recover from the damage to their financial and brand health as a result of falling victim to cybercrime

The bottom line is, every organization–big or small, needs cyber insurance today. Cyber insurance, however, is not a replacement for cybersecurity. Having cyber insurance doesn’t mean you can be lax about cybersecurity. It is meant as a buffer, to help.your business survive when something slips through the cracks. An MSP can help you tighten your cybersecurity and prevent data breaches and other untoward incidents. Also, being well versed with the IT industry, your MSP can help you understand the IT risks that you need to get covered for. They can also help you pick out the right cyber insurance policies, in some cases, some of them even being insurance advisors or agents.

/by