Categories
Technology

Phishing Attacks In The Real World

 

When was the last time you almost lost $23,000 to a phishing email? This nearly happened to one of our clients this week. Fortunately, this phishing attempt was spotted before the funds were transferred, however, there are a few good lessons to take away from this story and we want to educate you so you can protect your company from these sorts of attacks.

“Bob’s Company” received an email at Accounting@Bobscompany.com. The email was from Bob@Bobsscompany.com.

The email wrote:

“Good Morning,

Please pay the attached invoice in the amount of $23,000.

Thank you,

Bob”
For the accounting manager, this was business as usual. The boss regularly sends requests to the accounting department to have bills paid. At a glance, there is nothing wrong with the email but in this instance, the tone of the email was unusual which caused for further investigation.

This phishing attempt was sophisticated enough to the point where the scam artist even took the time to forge a signature on the attached invoice that matched Bob’s signature. Fortunately, the accounting manager double checked with the boss before processing the transaction. What’s scary is just how close the accounting manager came to processing the payment which is a mistake any one of us could make. If they weren’t paying attention or were just in a hurry, anything could have happened.

What’s important to take away is just how predictable we are. Most companies operate the same way with similar departmental and communication structures. If this wasn’t true then social engineering scams wouldn’t work. This was a close call for just one company and it isn’t hard to believe that whoever sent this email has sent thousands of them and likely got paid on a handful.

These types of attacks are becoming more prevalent than any other because they are cheap, easy and work on businesses of all sizes. “Bob’s Company” is a small business, not a behemoth company that you surmise a hacker would go after. Small businesses are easy targets from a hacker’s perspective because many of them do not invest in security and user training like large companies do.

Some actionable steps you can take to avoid falling prone to this type of attack are:

  1. Avoid using departmental emails like Accounting, Payroll or HR. This lets the hacker know that they are sending the phishing email to the right person making it more likely for the email to have the hackers desired effect.
  2. Use regularly changing keywords when sending requests for a transfer of funds. Change this keyword every month and instruct your staff never to transfer funds without the keyword in the email. This is a really low tech solution but it works. These attacks are intended to trip you up when you aren’t paying attention. The majority of attacks never involve someone spying on your network and learning your passwords and company secrets. Simple though it may be, this is an effective form of two-factor authentication.
  3. Use free spoof phishing tools like KnowBe4 to test your employees to see who is likely to click on phishing emails. Invest in those employees by training them on what to watch out for.

We are living in an ever-developing world where cybercrime is global, the barrier to entry is low and we humans are the weak link in the chain. Since cybercrime has such low risk and high reward these scams will become more frequent and sophisticated. Businesses will have to adapt to these changes and develop strategies to protect their resources. It is important to consult with your IT partner to learn how you can train your employees and set up security measures that will prevent this coming wave of cybercrime.

Categories
Technology Training

Harden Employees Against Ransomware With KnowBe4

Are you curious to see who in your company is most likely to download a virus on your network? Well now you can find out and the best part is, its free. With KnowBe4 you can administer a range of free tools that will allow you to see which of your users is most likely fall for phishing emails.

The sad truth is that some people will click on anything that comes across their email inbox. This is how most network infections start. Till more recently, there hasn’t been a lot anyone could do to prevent this. KnowBe4 allows you to find those trouble users and train them so that this major hole in your network can be filled.

From a compliance standpoint, KnowBe4 offers actionable data that will allow you to show your HIPAA or PCI compliance officer that you are taking actions toward due diligence.

As an IT company, we do our best to prevent major disasters with layered security involving anti-virus, managed firewalls, Office 365 spam filtering, security permissions and most important, great backups. Even with all of these security measures in place, there isn’t a foolproof method to ensuring that a few phishing emails won’t slip by unnoticed. We rely on backups to get our clients up an running quickly but even under the best of conditions, it is still better for the virus to have never been clicked on to begin with.

For a small investment in time, you can’t afford to not use these great free tools from KnowBe4. Take a few minutes to watch our new video on how to get started with KnowBe4 and harder you users against malicious emails.

Categories
Technology Training

Learn how to use a VPN

You may have heard of, or even used, a virtual private network (VPN), but do you know what it is? A VPN is an encrypted tunnel through a wide area network (WAN), also known as the Internet. This means that the network does not have to be located in one physical location, unlike a local area network (LAN). By using encryption and other security measures, a VPN can scramble all the data sent through the WAN, so the network is “virtually” private. In other words, a VPN allows you to access the files on your local network over the internet from an airport, coffee shop or another country, and you will be as secure as if you were sitting in your office.

Businesses commonly use VPNs to communicate across multiple locations. A large company that has offices in several cities may need to send data between their locations via the Internet. To keep the information secure, the company will set up a VPN with an encrypted connection, effectively giving the company a secure intranet over the Internet.

In this video, we will show how you can download one of the many VPN services on your computer. Once downloaded, we will show you how to set up and use this tool. Although there are many VPN options to choose from, most of them work the same way. If you are going to be traveling for work, or need to work from home or a coffee shop, it is important to send and receive sensitive data over a VPN. Otherwise, you are opening a direct access to all of your company’s sensitive information, and risk a security breach. For more information, or if you would like to set up a VPN for your company, contact eTop today.

Categories
Technology

PCI Compliance Audits

Have you ever been audited for PCI compliance? If not, it is most likely that at some point you will be. In order to maintain the ability to process payments electronically, this will be a fact of life. The more transactions you process in a year, the more often you will be getting a visit from your friendly neighborhood qualified security assessor (QSA).


In short, a PCI compliance audit should not be something to fear as long as you are willing to rectify any issues that your QSA finds. This is a matter of determining liability on the part of your electronic payment processor. If you are not PCI compliant and you have a security breach, then your payment processor will not cover damages.

In most cases, you will receive a notice that you are being audited by your payment processor for PCI compliance. The audit will be performed and you will receive a report stating whether or not you are PCI compliant and if not, what you need to resolve in order to get there. At this point, it is up to you to work with a partner to help resolve any issues found by the QSA.

When you receive your PCI report, it can be confusing knowing how to implement the requirement without a partner that is experienced in compliance audits. Working with a company like eTop Technology can help you plan and implement solutions to ensure that you pass your PCI compliance audit both now and in the future. If you find your company in this position, please reach out to us and we will help you build a secure future.

Categories
Technology

How to prepare for ransomware

Lately, there has been a lot of talk about ransomware: a type of computer virus that encrypts your files and holds them for ransom. Worse yet, there is no guarantee that your data will be released if you pay the ransom fee. In light of the most recent ransomware attack called “WannaCry” that infected a substantial number of businesses in Europe, it is important that you are taking measures to ensure that your business is safe.

Antivirus and firewall concept with businessman protected with umbrella

If you are not familiar with the statistics, ransomware was a billion dollar industry in 2016, and every cyber criminal knows it. There is exceptional financial motivation for these scams to be produced indefinitely, and they become increasingly sophisticated every day. As a business owner, ransomware is a constant threat that cannot be ignored.

Playing defense in the ransomware game is a layered approach, with several security methods to prevent ransomware from getting to your network. The first line of defense includes anti-virus, a good firewall, and effective spam filtering. The next important step in any security plan is user training. Ransomware is generally not a problem until someone within your network clicks on the wrong email or web link. The final layer of defense are things like an insurance policy or data backups.

Preferably, investing in each one of these layers is best practice. However, if you have to choose one component over another, backups are the most important investment that you can make. With a good backup system, you may lose some time and a nominal amount of data after an attack, but you will be able to restore your data without the ransomware affecting your business.

In addition to having the data backups in place, it is also essential to ensure that your backups are up-to-date and running properly. Backups have a tendency to face errors that can disrupt a backup schedule. With proper backup monitoring, you may find that your backups were not operating as expected, thus leaving your data vulnerable.

Talk to your IT professional to ensure that you have both preventative security measures and contingencies in place to protect your data in the event of a ransomware attack.

Categories
Technology

Business Information Technology Risk Assessment

In the spirit of St. Patricks Day, it is a good time to ask yourself how lucky you are. Since we are an IT consultant, we are going to focus on what that means when we look at an IT network. As an IT company, we get to see how a lot of businesses operate and manage their IT and it ranges from systems that completely rely on luck to operate from one day to the next to businesses that have more layers of redundancy than employees in the company.

Closeup of messed wires connecting computers and printers in office

It is truly amazing how lucky you can be when operating a business with a network that is patched together. Eventually, however, luck runs out and this can be costly. What we have put together is an easy way for you to self-asses how lucky you are. Using a scale of one to ten, run through the follow list of questions and use this metric to give yourself an accurate risk assessment.

The categories below are based on a company that has 10 to 50 employees and is hosting a network internally. Each category will give you 10 points for a total of 50 if you are doing your due diligence to protect your network and your company.

Backups
There are two types of backups. Local and off-site or hosted. A good way to look at an effective backup system is through a layered approach. Ideally, you should have a server that is backed up to a local storage. The local storage should then be backed up off site. This way you accomplish speed and redundancy. Give yourself three points if you have a local backup system, an additional three points if you have offsite backups and four points if you are using a backup monitoring system to ensure that your data is actually backed up.

Network Age
A network is not like a fine wine. It doesn’t get better with age. The older your hardware, the more likely you are to have to respond to downtime and data loss. We recommend that our clients replace their computers on or before the five-year mark and replace servers at three years. Other network hardware such as switches, battery backups, firewalls, routers and WIFI access points should be replaced at the same time you replace the server. To the best of your ability, try and assess the age of your network hardware. If 10% of your network falls within this specification, give yourself 1 point. If 70% then 7 points and so on.

Security
You can never be too secure so it is difficult to score a 10 on this scale. Just doing your due diligence will get you a long way and that is what we are going to focus on here. Give yourself two points if you have each of the following.

  • Anti-virus on each workstation and server.
  • Managed Firewall
  • If you scored over a 6 on your network age
  • If you have passwords on each workstation that expire every 90 days
  • If you are PCI compliant

Software Patch Level
Do you know the current patch level for all of your supported software? This could be the operating system on your server, the firmware on your firewall or the version of anti-virus you are running. Your hardware is only as smart as the software that is running on it. If you are running software that is out of date or is not supported you are at risk. Give yourself two points for each of the following.

  • Is your firewall running the latest firmware?
  • Is your server OS under support?
  • Is your anti-virus running the latest version?
  • Are your computers running the latest version OS?
  • Are you using a line of business application that is up to date?

Vendor Support 
Vendor support for applications plays a critical role in keeping networks running smoothly. If you are using a line a business application for the majority of your day to day operations but haven’t purchased a vendor support package with this product, you are exposing yourself to potential downtime. Partnering with an IT support company will not necessarily fix this issue due to the fact that no support partner will know that important application like the company that created it. In addition to purchasing vendor support for your most important application, you should also work with an IT partner that can provide preventative support for your network to ensure that you are as protected as possible. If you have purchased an application support package then give yourself five points. Also, if you are working with an IT support partner for all of you daily IT needs, give yourself five points.

If you tally up your point and find that you have between 40 and 50, Congratulations! You are doing your due diligence to ensure that your network is running smoothly and you are protected against downtime and data loss. If you are between 25 and 40 you should consider working with a consultant to make a road map for improving your network. If you scored less than 25 you are relying on luck to keep your network operational. In this case, you should reach out to an IT consultant and consider making serious improvements to your network infrastructure and support.

Categories
Technology

Microsoft Windows Server 2016

Happy New Years! We hope that 2017 is your best year to date! As a technology company we want to start off the new year by telling you about new technology emerging in 2017. Perhaps the most notable and important software for small business is the Windows Server operating system. It is true, the newest release of Windows Server is 2016. That being said, 2017 will be a year when a lot of business owners start considering this operating system for their company.
Image result for windows server 2016
As a best practice, when it comes to choosing new software for your business, it is important not to choose the newest product off the shelf. For the sake of your company, it is better to see what the consumer reviews are for the software and allow for several updates to be released so that you do not lose precious resources due to downtime caused by poorly functioning software. Even a company as reputable as Microsoft still releases products that need refinement. Now that Server 2016 has been on the market for a while and has been updated several times, it is a safe bet to implement it for your company.

Microsoft has made some substantial improvements to the Windows Server operating system with the release of 2016 that will improve virtualization, security, remote access, active directory, management, automation, storage and redundancy. The full list of new features is much too long to cover in one article, however, you can find it on Microsoft’s website here. If you are in a position where you are needing to consider upgrading your server in 2017 then we highly recommend that you consult with your IT professional about Windows Server 2016. For some businesses, there may be applications that you use that are not compatible with Server 2016 yet. For this reason, be sure that all of your current programs will work with Server 2016 before deciding to make this move. If all of your applications are compatible, then chances are good that your company will benefit from all of the new features in Server 2016.

Categories
Technology Training

Block Access To Websites/Parental Controls

There are many reasons why you may need to limit access to certain websites or entire areas of the web. Maybe you are a parent and you are trying to limit your children’s access to the web. Maybe you are running a school where you have to take the protection of minors into consideration. Maybe you own a company and you want to make sure that your employees are being efficient.

Whatever the case may be, it is useful to know the different ways to block access to websites. One way is to use software that will block access to all social media. This is a great method and there are many programs available to help you with that. For the purpose of this video, we will show you a free method that is build into Windows 10.

You will need to modify the host file on your computer. The host file is hard to find because in most cases you do not want to edit it. In order to do this you will need to open the start menu and type in “notepad”. Right click on the notepad icon and select “run as administrator” from the drop down menu. Once notepad is open, select the file menu and then select “open”. You will need to open your C drive, navigate to “Windows”, open “System 32”, then open the “Drivers” tab and you will see an “ect” tab. Here you will find the host file. In the bottom left corner of the open window you will see a drop down menu. Select “All files”. Open the host file.

From here you will be able to add in any websites that you do not want this computer to have access to. To do this you will want to redirect certain web searches to an unresolved DNS. This means that the search will return nothing. Simply type in 0.0.0.0 followed by the web address that you would like blocked and when the search engine recognizes this web address it will return a blank web page. You can add as may websites as you would like to this list. Before you leave don’t forget to save the edited host file.

Categories
Technology

Train Employees What To Click On

October is cyber security month – a month dedicated to ensuring that you and your business are as safe from online threats as possible.
Cyber security threats are real, and they are more common than you may think. Whether it is a phishing scam coming through your e-mail or targeted malware, cyber criminals are constantly coming up with new ways to target your business.
Unfortunately, no matter how effective your network security is, there’s one factor that you can’t account for – and that’s the human users on your system. Unfortunately, many phishing scams are becoming so good that it’s easy for intelligent, aware people to be sucked into their trap.
Thankfully, with all of the constantly evolving threats out there, a new industry is emerging. Companies are now being created that focus solely on identifying and preventing threats to cyber security.
One example of these companies is knowbe4.com, a site that offers security awareness training to employees who may not be aware of the best strategies for avoiding phishing attacks. The site also offers simulated phishing attacks for practical testing, and statistics to demonstrate how effective the training efforts have been.  Other similar education programs include Secureworks and Rapid7.
When it comes to avoiding cyber security threats, the best offense is a good defense. Training your employees to recognize phishing scams and avoid falling prey to their schemes is one of the best investments you can make for your business’ network security system.
These companies are experts at targeting specific cyber threats and in-depth training. However, there are several general guidelines for cyber security that you and your employees can be begin implementing immediately.
Firstly, phishers can imitate internal e-mail addresses, so attachments in e-mails should never be opened unless they are expected. For the same reason, it’s best to avoid sending sensitive information over e-mail – confirm through another method of communication to make sure that it is necessary before doing so. Lastly, use extreme caution when clicking on links or images online or on e-mail – if something seems too good to be true, it probably is. Extreme caution should always be used online in order to ensure that your network remains as secure as possible.
Even though cyber security threats are highlighted in October, they are a constant threat to businesses of all kinds and sizes. If you have any concerns about your business’ current level of network security, want security education for your employees, or are interested in learning more about the education programs mentioned above, call eTop Technology. We will be able to help you tailor your approach to cyber security for your industry and business needs.